non fungible dad security researcher
Joined April 2018
- Tweets2.2K
- Following1.1K
- Followers342
- Likes1.7K
RustyRabbit retweeted
Disappointed by the European Central Bank’s (ECB) and European Banking Authority’s (EBA) responses to the MiCA consultation.
They are not only advocating for a prohibition on paying yield on stablecoins, but also for restrictions on CASPs providing access to DeFi, including protocols offering yield on non-MiCA-authorized stablecoins, without providing a clear framework for how access to DeFi should work in practice.
They also suggest that CASPs offering access to DeFi should restrict it to certain groups of users through so-called “suitability tests,” alongside a potential certification regime for DeFi lending protocols.
It is unclear how these requirements would work in practice. If regulators determine which protocols are deemed suitable for European users, the result risks looking very different from the open DeFi that exists today.
Instead, we could end up with more walled gardens that undermine the liquidity and network effects of open financial networks, ultimately limiting Europeans’ ability to access new ways to grow and preserve wealth.
These proposals are presented as measures to “protect consumers.” But excessive restrictions can instead create more friction for innovation and slow the development of open, transparent, and auditable financial infrastructure that can benefit consumers.
The reality is that onchain finance, including stablecoins, DeFi, and tokenized securities, has the potential to reshape financial infrastructure by reducing friction, increasing transparency, and expanding access to financial opportunities.
European consumers and businesses stand to benefit significantly from this transformation, particularly if the companies building this infrastructure can continue to build and compete from within Europe.
Meanwhile, U.S. regulators, including the SEC and CFTC, have increasingly taken a more pragmatic approach toward enabling onchain financial innovation.
European regulators should put users and their interests at the center of the framework. Banks and other incumbents should be able to adapt their businesses to serve users in an increasingly onchain economy, rather than relying on artificial restrictions that risk increasing costs and reducing access for Europeans as the rest of the world moves onchain.
DeFi will win.
This is the crux of it all:
"some of the people saying it's over are not scared. They just can't see where the new value went. That's a harder failure to admit than fear, because fear at least means you're paying attention."
RustyRabbit retweeted
true, but most users don't understand how their hardware wallet works 👇
the most important thing related to immutability (your privater keys will never be exfiltrated) is which chipset signs, and can that chipset be updated?
a hww is made of two chipsets: an MCU (general purpose microprocessor, not built for security, upgradable on 100% of devices) plus a secure element.
90% of hwws sign on the MCU. Which btw means your private keys leave the secure element for a not so secure microprocessor every single time you sign.
very few hwws sign inside the secure element. To our knowledge:
— Ledger does BUT the secure element is remote upgradable. Which is what happened in 2023, which means the behaviour of the secure element can change and an upgrade can exfiltrate secrets.
— Tangem does, from what we can tell. It's closed source, so we can't verify.
— @keycard_ shell does. the secure element is the card. it generates the keys, stores them, signs with them. And the applet is locked at production and is thus immutable. not upgradable by you, by us, or by a subpoena.
if you don't want to trust our factory process at all: buy a blank javacard, load the applet yourself from our github and lock the card. the whole stack is open and verifiable, all 100% of it.
there's a cost for this architecture though: immutable means new signature primitives need a new card. we think that's the right trade, and javacards are both the cheapest secure elements on the market and the only ones you can build yourself.
our view: a hardware wallet should be an upgradable, stateless interface talking to an immutable secure element. upgrade the thing that shows you what you're signing. never the thing that holds your keys.
that's what we tried to build with @keycard_ shell, and it's open source with permissive MIT license (sw, hw, mechanics) for any one to build this type of architecture.
RustyRabbit retweeted
PLEASE every protocol read this. Your bug bounty submission might be malicious:
The incident was the result of a sophisticated, multi-stage attack that combined social engineering with a trojanised proof-of-concept test suite.
The attacker initially established credibility by submitting a plausible responsible-disclosure report describing a potential reward-distribution front-running vulnerability in the vault contracts. The report referenced legitimate-sounding contract functions, followed a standard vulnerability disclosure format, and offered to collaborate on mitigation steps. These elements appear to have been deliberately crafted to encourage our team to review and execute the attached proof-of-concept.
RustyRabbit retweeted
The scary part about Anthorpic's Fable nerf is not that it refuses to answer biology or cryptography. It's that it foreshadows what's coming. A world where a couple companies decide what you can and cannot do. They're building a new ruling class and you're not in it...
RustyRabbit retweeted
this rug was quite well-hidden actually
🚨SlowMist TI Alert🚨
💸 Loss: 14.411518807585587 ETH
🔍 Root Cause: Storage slot collision between `ATOHook.rewards` mapping slot and Solady `ReentrancyGuard` fixed slot (`0x02215292eb9609279094554c6e223f800950648ddfa3da30329838d6c170928d`). The `nonReentrant` modifier in `getReward()` writes sentinel value `0xffffffffffffff` to the guard slot, which is simultaneously read as `rewards[attackContract]` due to the collision. This inflated reward is paid as ETH each call, allowing 200 repeated claims.
📌 Attacker (EOA): 0x2d2aafc193c24e59bd16139056ac9b4df4d37ad0
📌 Victim Contract: 0xa10de71ddb4e0d51938ef6e0118822e157a62888
📌 Attack Contract: 0x2441e480f62bf609a08da09143e4baf8a817d757
Storage collision between reward accounting and reentrancy guard enables unlimited reward drainage.
Powered by #SlowMist.AI
etherscan.io/tx/0xe4e2cc3b06…
RustyRabbit retweeted
People do not trace back the bugs and validate them, people do no use false claim filter for maybe third run to validate bugs, they just submit what the Ai report to them.
RustyRabbit retweeted
You think there's been lots of hacks?
There are companies right now replacing software that was working perfectly well for years, that we can inspect and find bugs in...
with "agents" we can't inspect, commanded by prompts that influence its output in ways we can't map, and that are mathematically incapable of separating instructions from untrusted data.
All of that for 1,000,000,000x the compute cost, and an error rate orders of magnitude worse than before.
Since businesses now apparently exist to be AI customers and justify AI valuations instead of providing products and making profits, you can expect the trend to keep going for a while.
RustyRabbit retweeted
layerzero attack was not rpc poisoning
in networking poisoning is when the attacker outside the trust boundary taints a shared lookup (dns, arp, cache). the consumer has no reason to distrust the source.
this was not that.
the attackers got inside layerzero's trust boundary. they accessed the rpc list, compromised two nodes the dvn depended on, and swapped the op-geth binaries. that's an infra breach within the perimeter. supply-chain shaped, not network shaped.
and the payload was surgical. the malicious binary cloaked by ip, served forged payload only to the dvn, told the truth to scan and every other caller, then self-destructed to wipe logs and binaries.
rpc poisoning makes it sound like something that happened to the infra from the outside. the real story is a targeted implant operating inside the trust boundary.
that's a meaningfully scarier attack than the label suggests.
RustyRabbit retweeted
Kraken Security Update
We are currently being extorted by a criminal group threatening to release videos of our internal systems with client data shown if we do not comply with their demands. It’s important to start with the most important points: our systems were never breached; funds were never at risk; we will not pay these criminals; we will not ever negotiate with bad actors.
Kraken identified and shut down two instances of inappropriate access to limited client support data.
In February 2025, we received a tip from a trusted source regarding a video shared on a criminal forum that appeared to show access to our client support systems. We immediately launched an investigation and quickly identified the individual involved as a member of our support team. Their access was revoked immediately, a full investigation was conducted, additional security controls were put in place and a limited number of affected clients were notified.
Since then, we have been collaborating with industry partners and law enforcement to investigate and disrupt insider recruitment efforts targeting not only crypto companies, but also gaming and telecommunications organizations.
More recently, we received another tip, along with a new video showing similar activity. We quickly identified the individual involved and terminated their access. As before, we acted immediately to revoke access, conduct a full investigation, and notify the small number of affected clients.
Across both incidents, only a very small number of client accounts were potentially viewed - approximately 2,000 in total (0.02% of clients).
Shortly after access was terminated, we began receiving extortion demands. The criminals threatened to distribute materials from both the February 2025 incident and the recent incident to media outlets and on social media if we did not comply. We will not pay these criminals.
Based on intelligence gathered across both incidents, along with extensive ongoing analysis, we believe there is sufficient evidence to support the identification and arrest of those responsible.
We are actively working with federal law enforcement across multiple jurisdictions to pursue all individuals involved and bring them to justice.
Due to the ongoing investigation, we cannot share additional details at this time. However, anyone with relevant information is encouraged to contact us directly.
The security of our clients is our highest priority, and we remain fully committed to combating the growing global threat of insider recruitment and constantly enhancing our security practices to combat new threats.
Note: If you are a client potentially affected by this, you've already been notified.
RustyRabbit retweeted
- Drafted a blog post
- Used an LLM to meticulously improve the argument over 4 hours.
- Wow, feeling great, it’s so convincing!
- Fun idea let’s ask it to argue the opposite.
- LLM demolishes the entire argument and convinces me that the opposite is in fact true.
- lol
The LLMs may elicit an opinion when asked but are extremely competent in arguing almost any direction. This is actually super useful as a tool for forming your own opinions, just make sure to ask different directions and be careful with the sycophancy.
RustyRabbit retweeted
security auditors only have 5 moods:
1. fk I hit the Claude limit again
2. how we gonna get rich
3. random 2 am motivation
4. intense loneliness
5. my family needs me
