BV CyberSec -- https://teapawt.net/t.co/fNnHyNrpHO https://teapawt.net/t.co/30RvJtEghC -- Associated with @BitcoinVN_io
Globally
Joined May 2026
- Tweets103
- Following38
- Followers22
- Likes58
General advice:
Don't put private keys / seed phrases on hot devices - given enough time, the wallet will get drained.
Treat a hot wallet on your phone like an old-school wallet:
Keep enough cash for your immediate spending needs, but nothing that would hurt for more than a day if you lose it!
A vulnerability (worse_query) affecting iOS 26.7.1, 27.0.1, and 27.2 allows malicious apps to read local files from other apps, putting seed phrases, private keys, and login credentials at risk across the entire ecosystem. This is an iOS-level issue, not unique to Binance.
Immediate Action Required:
- Delete any apps installed from untrusted sources (such as sideloaded or manually signed IPAs).
- Update iOS and all apps to the latest official versions.
- If you suspect a breach, transfer funds to a new wallet created on a clean device and reset all active login sessions.
Never install unauthorized packages, and keep your software up to date.
Readers added context they thought people might want to know
Binance recommends updating iOS to the latest versions against worse_query, but researchers describe it as an unpatched 0day and Apple's iOS 27.2.1 notes omit any such fix.
github.com/forcequitOS/wo…
support.apple.com/en-us/149715
x.com/0xjohnny/statu…
45
If you do anything in crypto (or on the internet at all these days…) - enable 2FA on all your accounts.
Ideally, not via email or SMS if a stronger option is available.
On 19 September an attacker emptied 24 Blink accounts.
He failed to empty 9 accounts with 2FA. We said we should have required it for all larger accounts.
Now we do:
blink.sv/blog/how-to-set-up-…
If you knowingly “invest” in scams hoping to get out before everyone else, take the L and learn (or don’t).
There is already more cybercrime to investigate than the limited number of qualified threat intelligence professionals can handle.
If you keep handing your money to the same scamcoin grifters despite repeated warnings, don’t expect investigators to prioritize rescuing your "trade".
You voluntarily entered the casino.
You lost your money - as entirely expected and predictable.
Hi because you get rinsed by the same KOL grifters who have done it for years and never learn.
I tried calling out Ansem numerous times in the past for promoting micro cap and celeb tokens but gamblers brought him credibility and exit liquidity yet again this cycle.
So why should I care at all?
I am busy with recent incidents like the French bank heist, DPRK, or The Com where my work actually brings measurable impact rather than engagement from calling out known bad actors and saying the obvious.
1
1
76
We have to operate with the justified assumption that the "sophisticated attempts" of today will look like complete amateur hour in two years from now.
Too much money is to be made in this sector by developing ever more advanced intrusion techniques.
At last, the industry is finally alert that investing significantly into cyber defense is not optional.
Everyone is at risk - some more, some less.
I've been invited to one of those fake teams meetings, they even got AI generated videos of people I know appearing to wait for me to join the meeting, while that modal on top explains I need to "upgrade my audio drivers" (bs of course, a browser app can't touch drivers).
1
17
The “fight” stage is certainly here.
It is exhausting work - but what more meaningful work could you be doing at this critical juncture...
I know multiple people who basically quit working on Bitcoin because of how stressful it is to maintain software that handles money nowadays.
I tell them all the same thing: What do you think will happen if we all quit and become gardeners? Are we just going to give up on the internet? Do we just accept fiat as the end game? Are we just going to let go of the dream of an internet that doesn't exploit your humanity and take away your rights to privacy and self-determination?
I know, fuck, it is hard. But you're not alone.
We must fix this. Nobody else is there to do the necessary work. If we stop doing this, we're 100% doomed. I can guarantee it.
But if we continue, we have a chance.
11
"A customer list is a target list."
If you work in this space, minimizing the data you collect and retain is becoming a more pressing issue by the day.
6
Successful crypto exploits of 🇰🇵 are now measuring up to what some of the largest 🇰🇷 conglomerates contribute to their respective state coffers in any given year...
12
Good job everyone - stellar response time given the severity and scale.
The industry has learned some expensive lessons from past mistakes - especially that fast communication channels have been established between most teams to counter-act threat actors in real time.
1
85
It seems safe to say that nobody is safe in this environment.
Another day, another time:
Unprecedented times.
Binance wallet 16 came online 2021.
Why it got compromised now?
Smart people work at Binance, one would assume key cannot be exported from the server over network.
The attacker either waits 5 years.
... Or ...
The wallet server itself is not compromised but the communications. Maybe compromise some other server in the network and start messing with the traffic. Like some otherwise harmless monitoring software.
If the wallet server communicated with HTTPS there cannot be man-in-the-middle. Normally.
Unless TLS intermediary is compromised.
GM eMudhra.
13
Not good.
If you're 🇺🇸 based, see what you can do to steer the conversation around this topic.
✉️ New: Samourai Wallet developer Keonne Rodriguez recounts a 29-day prison transfer
13 days in Oklahoma City’s lockdown transit hub, 18 days caged 23 hours a day at USP Lewisburg, where he learns his grandmother has died.
By @keonne
8
Where we're going, levels of paranoia will be required previously unknown to humankind.
Unprecedented times.
Sneaky fuckers. From my clanker.
It's a scam ad that changes what it shows based on who it thinks is looking.
You click the ad and land on a "One moment please, verifying the link" page. That page quietly looks up the current scam address from a blockchain contract, so the operator can swap domains at will, then hands you to a lookalike link made three days ago.
That site runs a commercial fingerprinting service on you, which checks your browser, device, IP and behavior, and its own server decides whether you look like a real target. If you look like a bot, a researcher or a security scanner, or the check fails at all, it sends you to the real `foundation.xyz`, so anyone investigating sees nothing wrong. That's exactly what happened when I first opened it. If you look like a real victim, you get a fake "Passport recall" that asks for your 12 seed words or gets you to "create a new vault" whose words the attackers already hold. The operator can even ban or redirect specific visitors by hand from an admin panel.
20
When we launched this account to discuss cybersecurity concerns separately from our regular company communications, we already anticipated a “bull market” for cybersecurity topics, content and expertise.
Boy, did we still underestimate the size of that wave…
8
Difficult times...
I've been spammed with password reset demand from my Microsoft account. At a rate of 2 per days. Not phishing, just pure brute force.
Password resets needs 6 digits they send by email. So it doesn't seem likely to find anything.
But a malicious actor which try every day, with a dump of millions of leaked account he found somewhere?
Well he will crack a few of those with brute force every day...
Use 2FA.
10
...now #electrumwallet affected by a serious vulnerability.
Be extremely careful when utilizing the RBF feature in Electrum - your funds might be at risk of total loss if you run an unpatched version.
Important detail: the theft path required a malicious server to replace a just-broadcast transaction in wallet history, then the user to manually fee-bump and sign it.
Update to 4.8.3; until then, verify every output address and amount before signing any transaction.
1
40
Attackers constantly calculate cost/benefit for their next moves.
Once the benefit of a successful compromise appears to outweigh the costs - you must assume the attack to occur.
Why don't I ego max and tell everyone to go back to bitaddress paper wallets?
Because modern devices and printers use cloud based wifi for convenience and your document passes through a third-party.
If people go heavily back into paper wallets then printers in Singapore will have spyware in them eventually.
2
16
One of the dumber conspiracy theories currently floating around there:
People and organizations argue for multivendor multisig “just to sell more devices”.
Yes - they often DO have a direct financial incentive to sell you more devices.
That does NOT automatically mean multisig is some ulterior scheme by industry insiders to make you spend more on hardware.
It’s like arguing that guns with 20-round magazines are an evil conspiracy by “Big Ammo” - and that, for home protection, you should rely on an old-school single-shot firearm to avoid enriching the big, bad ammunition producers.
Yes, here too, they have a direct financial incentive to sell you more ammo.
No, that does not automatically make opting for more rather than less ammo a bad choice when building out your home defence...
And FWIW:
You CAN set up multivendor multisig without buying ANY dedicated hardware wallets. The average user, however, is simply not going to build and maintain that setup themselves.
That is not a limitation we celebrate/endorse/ promote - it is our experience from dealing with thousands of customers on the frontlines over more than a decade.
When @Trezor first came to market with a dedicated hardware wallet, part of the mission was to make keeping signing keys off internet-connected devices a simpler task for a larger userbase.
Hardcore Bitcoiners back then already knew NOT to keep their keys on hot, internet-connected devices...
But many people still opted for a blockchain dot info web wallet or other internet-connected key storage solutions (because convenience!), plenty suffered losses as a result...
For users who would otherwise have continued with those setups, devices such as Trezor made better (on a practical, relative scale) key management more accessible.
We KNOW there is technically no need to give your money to a dedicated hardware wallet provider.
We also know the limits of the technical knowledge, time and patience of the “average” (or even above-average!) person out there.
Being keenly aware of financial incentives is one thing - but the existence of a manufacturer’s financial incentive does not automatically turn its offering into some sinister scheme...
1
41
Koji is correct.
Unless you pick up the device directly at the factory/office of the supplier, you always have supply chain risk involved.
"just buy direct bro" completely ignores that your supply chain might actually be more exposed/vulnerable this way depending where you're located in the world.
A (non-rogue) reseller (hopefully...) has a tight grip on its supply chain (you should not rely on it though...) - while if you look to get a device shipped as an individual... let's just say it can be quite an experience to receive the device at all. 🙂
If you self-custody any serious amount of savings - you must eliminate single points of failure.
--> Multi-vendor Multisig
The only prudent advice to take here.
ハードウェアウォレットとサプライチェーン攻撃について。自分もLightning Baseなどでリセラー、販売者側でもあることも含めいくつか雑感。
まずリセラーの選定のデューデリは実際そこまで厳しくないことが多そうなのと、途中で運営者が変わったりしても製造者側は通常そこまで細かいチェックはしないと思う。つまりかなり信頼ベースで回っている部分が多く、今回のような攻撃は確かにやろうと思えば比較的容易にできる環境にはあったと思う。
今後ここら辺のリセラーの選定なども厳しくなると思うけど、いずれにせよリセラー側で細工ができる以上、リセラーの中でも信頼できるかどうかは異なってくるし、リセラーを信頼するリスクもある程度考慮しないといけない（理論上はLightning Baseなども含めて）
今後はなので公式ショップからの購入をする人も増えるかもしれないけど、ただそうすると匿名配送や店舗での販売などに対応しづらくなるので、今年に入ってから頻発したハードウェアウォレット事業者からの住所情報の流出のリスクなども上がる、ということで、完璧なソリューションでもない。
Coldcard事件では特定のベンダーのハードウェアウォレットを信頼するな、という話だったけど、今回は製品自体には本来問題なかったとしてもサプライチェーンの途中の攻撃もありえる、という話でユーザーとしてはさらに悩ましい問題が増えた感じはある（自分は個人的にはすでにこういう事態も想定はしていたが）
解決策としてはやはりマルチベンダーマルチシグが今回の件でもリスク軽減になるし、やっぱそっちを推奨していく流れになりそう。
1
30