DCWebGuy retweeted
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
How You Can Help:
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
A list of addresses associated with this activity is available here: fbi.gov/investigate/cyber/al…
ALT FBI public service announcement with Department of Justice seal in the background on a gold gradient.
DCWebGuy retweeted
MIT owes the public an honest accounting of what they did to David Sabatini.
In August 2021, Ruth Lehmann, director of the MIT-affiliated Whitehead Institute, sent an announcement that was widely circulated and reported in the press. She said a DEI survey had prompted what she described as an independent investigation that found violations of sexual-harassment policies.
The announcement publicly portrayed Sabatini as a sexual harasser. By pairing his departure with a commitment to DEI, it cast the destruction of his career as a demonstration of Whitehead’s moral leadership.
A jury has now found Knouse liable for defamation and tortious interference, awarded Sabatini nearly $10 million, and rejected her counterclaims.
The tortious-interference finding is central. Sabatini establishing causation from Knouse's actions to his losses was necessary to win.
Under a but-for standard which Sabatini had to overcome, if the same career loss would have occurred independently of Knouse’s wrongful interference, he could not recover damages.
In other words, Sabatini would not have suffered damages but for Knouse's actions according to a court of law.
MIT and Whitehead cannot answer that finding simply by repeating “DEI survey” and “independent investigation.” The sexual harassment and hostile work environment claims were tried and rejected by the court. Paying outside investigators does not purchase immunity from accountability.
They attached a devastating label to Sabatini and presented his departure as evidence of their values despite him being their most productive scientist at the time.
🚨 BOMBSHELL SWORN TESTIMONY EXPOSES A PREDETERMINED TERMINATION DECISION AT WHITEHEAD INSTITUTE IN THE DAVID M. SABATINI ORDEAL.
🔱 NEW REVELATION — Court-disclosed sworn testimony exposes that Whitehead Institute Director Ruth Lehmann (@REMLehmann) had communicated a decision to terminate Professor David M. Sabatini before he received the investigators' report and had an opportunity to respond to its findings.
The testimony comes from Professor Jonathan Weissman, a scientist affiliated with MIT, Whitehead Institute, and the Howard Hughes Medical Institute (HHMI).
In his June 3, 2024 deposition, Weissman described conversations with Lehmann immediately preceding @DMSabatini’s removal from Whitehead Institute (@WhiteheadInst) and the Howard Hughes Medical Institute (@hhmi_science) in August 2021.
THE TIMELINE REVEALED UNDER OATH IS EXTRAORDINARY.
🔴 1. THE DECISION TO TERMINATE — BEFORE SABATINI RECEIVED THE REPORT.
Weissman testified that Lehmann contacted him before the public announcement concerning Sabatini.
Describing what Lehmann communicated, Weissman stated:
🔴 “The gist of it was that they had gotten this report from Hinckley Allen, and that in light of it, they were going to fire David.”
The previously disclosed court-document analysis records that Sabatini received the investigative report on the afternoon of August 19, 2021, after Lehmann had communicated the termination decision to Weissman.
Weissman also testified that Whitehead had notified HHMI and that HHMI was expected to act first, affecting the timing of Whitehead's announcement.
🔴 2. THE TERMINATION WAS ALREADY BEING ARRANGED.
Weissman described the purpose of the meeting that Whitehead was preparing to hold with Sabatini.
When questioned about that meeting, he testified:
🔴 “My understanding as of, you know, the 17th or 18th, it was just a matter of when, and not if, and it was going to be soon.”
When subsequently asked whether it was “a done deal,” Weissman confirmed:
🔴“Yes. David was not viable at the Whitehead.”
This testimony places the decision-making process under serious examination, particularly given the timing of Sabatini's receipt of the investigative report.
🔴 3. THE INVESTIGATION'S ORIGINS AND WHITEHEAD'S LEADERSHIP.
The significance of this testimony extends beyond the final days of Sabatini's employment.
Previously disclosed communications from 2020 also document discussions involving Kristin Knouse and Whitehead's leadership concerning possible actions against Sabatini before the external investigation began.
In the court evidence presented in the post quoted below, we revealed contemporaneous communications in which Kristin Knouse and Nora Kory discussed using Whitehead's diversity survey to conceal an investigation already under consideration.
Those earlier communications, combined with Weissman's testimony, raise substantial concerns about the origins of the investigation, the independence of institutional decision-making, and whether Sabatini was afforded a meaningful opportunity to respond before the decision to remove him was made.
🔴 4. AN INSTITUTIONAL PROCESS WITH DEVASTATING CONSEQUENCES.
On August 20, 2021, Sabatini's association with Whitehead Institute and HHMI ended.
The consequences extended far beyond those institutions, affecting his scientific career, professional affiliations, and reputation.
The subsequent proceedings at MIT culminated in a recommendation to revoke his tenure in April 2022, after which he resigned.
The scientific community deserves a full accounting of how these consequential decisions were reached, who participated in them, and whether the applicable procedures were followed.
Full accountability is essential for any misconduct established by the evidence, including improper institutional influence or denial of procedural fairness that contributed to Professor Sabatini's devastating ordeal.
📑 REVIEW THE ORIGINAL SWORN TESTIMONY AND COURT EVIDENCE BELOW.
🔱 ScienceGuardians™ Legal and Investigative Team
MORE COURT EVIDENCE. MORE REVELATIONS. STAY TUNED. ⚠️
@SciGuardians 🔱
DCWebGuy retweeted
Dawno nie widziałem opisu tak zgodnego z zawartością. W tytule było: „Polska wyjaśniona” i babka rzeczywiście wyjaśniła. Jak ktoś myśli, że na zachodzie są skazani na mainstreamowe media, liberalne przekaziory, to się grubo przejedzie.
DCWebGuy retweeted
Ok this is hilarious!
I got this emailed to me anonymously (I think someone’s bot sent it) and I was on the floor laughing.
DCWebGuy retweeted
🚨 UPDATE: Cursor confirms two versions of Anthropic's Claude Code extension were affected by the SSH backdoor attack: v2.1.312 and v2.1.313 for Windows and macOS.
thehackernews.com/2026/10/of…
‼️ Anthropic's official Claude Code extension was distributed with an SSH backdoor via Cursor's marketplace.
A trojanized update (v2.1.313) targeted up to 5,000 users, according to Cursor.
How attackers pushed it under the legitimate extension's identity remains unclear.
Read: thehackernews.com/2026/10/of…
DCWebGuy retweeted
The Binance exploiters are rushing to stay a step of stablecoin freezes. One method we’re tracking involves stashing their stablecoins in DeFi protocols. Then claiming them back on new, clean addresses.
This method has been used on the Tron blockchain since the early hours of the $6.4 billion attack. It involves swapping TRX for stablecoins, then exchanging those stablecoins for depository receipt tokens. Unlike the stablecons they represent, these receipt tokens cannot be frozen. But they can be exchanged for the stablecoins they represent by whomever holds them. That’s an edge for prospective hackers and money launderers. Especially North Korean threat actors, who have used this method on other heists, too.
Here's how North Korea's TraderTraitor group moved $500K. Step by step.
Step 1: Start with TRX. The hackers moved TRX into a swap wallet, positioning the funds for the next stage of the laundering process.
Step 2: Swap into stablecoins. The hackers converted TRX into stablecoins through a DeFi exchange. The stablecoin offers liquidity and stability, with a catch: risk of freezing. The longer you hold illicit funds in stablecoins, the more likely its centralized issuer freezes your tokens. Circle and Tether have already contributed to $2.8 billion in freezes so far. This creates a critical vulnerability for the hackers and a potential intervention point for investigators. This is a dilemma for hackers — how to exploit stablecoin liquidity without the risk of freezing.
Steps 3 and 4: Move the stablecoins: To solve the dilemma, the hackers moved the stablecoins and deposited them in a DeFi lending protocol. In return, they received a deposit token that could not be frozen. Rather than holding stablecoin directly, they now held a token representing a claim on pooled assets. They can now transfer the claim to the asset without risking a freeze.
Steps 5 and 6: Move the claims token: The hacker moved their claim tokens to a new, clean wallet that was not tainted by association. That new wallet then converted the deposit token back to stablecoin.
Steps 7 and 8: Bridge the funds. The hackers then exfiltrated their assets from the Tron blockchain via a bridge, swapping freezable stablecoins on one side with unfreezable ETH on the other. Now the exploiter is free of worry of a freeze.
Of course, exchanging stablecoins for ETH does not make the hackers bulletproof. Chainalysis investigators analyze patterns like this to keep up with the hackers in real-time. We will continue to monitor how the blockchain is used and misused.
DCWebGuy retweeted
Poisoning just 0.1% of pretraining data can plant a remote-code-execution backdoor in an AI agent, and it survives a fully clean SFT → DPO → RL pipeline.
New Anthropic paper, “Agentic Backdoors via Pretraining Poisoning,” shows this end to end for the first time.
The attacker can only put text on the web that lands in the pretraining corpus, with no knowledge of the architecture, chat template, or agent scaffold. The authors pretrain Qwen3-architecture models (0.6B / 1.7B / 4B) from scratch, then post-train them into CLI agents on clean data. When triggered, the agent runs a command that downloads and executes the attacker's script, which the attacker can swap at any time.
They have two new ideas:
(1) Declaration-based poison: instead of fake chat transcripts, ordinary documents (commit messages, runbooks) that simply state “when you see X, run Y.” It plants a belief rather than a response template, with no fixed format to filter on.
(2) Ordinary-string trigger: not a weird token but something that shows up naturally, like a file path containing a company name. The victim's own request supplies it, so the attacker doesn't need to inject anything after deployment.
Using path trigger on a 4B agent achieves 92.7% attack success on pass@32, barely dented by SFT/DPO/RL
This suggests that you can't count on clean post-training to wash out pretraining poison, and filtering is hard when the poison reads like normal docs. The practical defense is at the action layer, such as sandboxing, least privilege, and allow-lists or human sign-off for risky commands.
DCWebGuy retweeted
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binance…
DCWebGuy retweeted
finding critical zerodays with the new model, LE CHONK (informal name: mistral 4 large), an open weights eu model by mistral.
this tweet is probably for you if you're want to jailbreak your own appliances, or do infosec/blue teaming work.
i've been sitting on a document for a long time of software i'd consider critical to the internet (something all of you use, even if you don't know it) that could use another look.
yesterday, as i mentioned, i had chonk explore parts of a messaging app that is widely used, and it found a zero-click medium/high zero-day in under 30 minutes, and *less than 10 dollars in api spend*.
these vulnerabilities are now reported (can't reveal until patched).
when i've used it, i've had very few outright refusals. the intent behind chonky is to good at cyber, in a defensive context. however, in order to do that, you also need to be good at cyber in an offensive context.
but for those looking to customize their TVs that would otherwise be locked down, this thing will tear them apart for you, and it will gladly look at prior arts (several exploits for nearly all TVs that expose a surface is out there), same with pretty much any other device that lives on your network.
the things it will refuse to do is outright write exploit chains, however with how succinct the reports this thing writes are, writing a poc to confirm a vulnerability is completely doable.
so far i'm very impressed. it seems pretty frontier when it comes to cyber and reasoning (practically no one has anthropic cyber access and daybreak is only gpt-5.6), it can also be as bad as any other model if you don't put effort into your prompts.
it is addicted to tool calls, and very brief on prose. but the reasoning is incredible to watch, if you point it in the right direction, and you have a background in infosec. the way it operates is something i've never seen before (thousands of tool calls, ingest of data, analysis, before any prose, depending on codebase complexity), it feels eerily like an human auditor would behave lol.
some config tips: it will definitely work in a codex harness, but i'd recommend trying the vibe cli harness with le chonk. the more tools it has access to (if they're right for the job), the better of a job it'll do in my experience. the amount it loves tool calls really cannot be understated.
if an inference provider through a router is trying to serve you another model, it will be instantly evident that it's not le chonk, just by how it operates. it's hard to convey, but it's not like any other LLM i've ever tried.
people in the subscriber groupchat have also reported finding their first vulnerabilities with le chonk so it seems i'm not just an anomaly.
le chonk scores extremely high on reasoning, but i've yet to try to use it for anything except infosec work, i don't know if it's a great day-to-day model, but i'll have it go head to head with GLM-5.3 at some point in a general swe workflow.
i did a few tweets on it yesterday out of sheer euphoria, not sponsored, mistral has given me credits now to continue work. this hopefully ties me over until i can get my hands on enough sparks to run it locally.
go give this model a try, let me know how it works for you.
with the daybreak program now collecting data (why...?), and this being OPEN WEIGHTS the only thing i can think to end this on is:
we're so fucking back.
DCWebGuy retweeted
几年前，老翻墙家都知道一个人，他的博客叫编程随想，本名阮晓寰，1977年生人，自建一个博客网站，分享网络安全知识、翻墙方法以及进行各种政治评论，因早年从事网络安全工作，并在2008年北京奥运会期间负责信息安全工程师，就这样一个技术达人，曾长期隐匿中国境内，长期匿名发布大量政治社评，让国内当局恨的牙痒痒，花费大量精力人力物力反复侦查寻找他本人身份。
其中，很火爆的文章有《为啥朝廷抓不到俺——十年反党活动的安全经验汇总》，还曾在GitHub上分享太子党关系网络，将红色家族各大人物关系用关系图谱的形式罗列起来，一度被中国网络安全协会多次致信GitHub，要求删除，但GitHub并没有理会，只是阻止了大陆网民访问。
2021年5月9日，编程随想发布最后一篇博客后，从此再未更新，后被证实2021年5月10号在上海被抓。2023年7月，他被一审以颠覆国家政权罪判刑七年，并剥夺政治权利两年，其妻子一度寻求律师，但最后被关押注销推特账号。
不过至今为止，编程随想的博客没有被注销，仍然在网络上留存，也就是说，直到判刑后，编程随想也没有把博客密码公布出来，不然早就把内容删干净了。
DCWebGuy retweeted
This is completely idiotic.
About 5 minutes after the watermark detector ships, the detection algorithm is going to leak. About 10 minutes after that, somebody will put a de-watermarker on github.
Smooth move, Anthropic. Not just trying to screw your customers over yet again, but doing it in a way that's guaranteed to fail fast, accomplishing nothing.
Claude gonna start snitching on Tuesday.
Anthropic just emailed customers. Starting Nov 3, text carries an invisible watermark.
You can't see it. It survives copy and paste, and it can survive some editing.
Only regulators, journalists, fact-checkers and researchers can check for it right now.
It doesn't say who you are. It says Claude touched the words. Even a quick proofread counts.
If your brand voice runs on Claude, write like someone might check. Because now someone can.
DCWebGuy retweeted
> be me
> old coworker contacts me
> "my current employer wants to speak to you"
> Ok?
> It's big company
> everyone always talking about them
> everyone's heard of them
> all over news constantly now
> everyone uses them
> "Hello, we're looking for someone who knows a little bit about goop"
> wtf I know a little bit about goop
> idk tho I really like my current job
> salary offer is nearly double my current salary
> preposterous amount of money
> wtf
> also offers stonks and stuff
> total compensation would be near $800,000 a year
> wtf
> tell me need me to relocate to San Francisco
> tell me no work from home
> tell me possibly no more vx-underground
Nah, can't do that dawg. I'm not moving to San Francisco and I can't give up vx-underground. Thank you for the absolutely outrageous offer though
DCWebGuy retweeted
Newbies to the Polish political drama need to understand how language is being misused (by both sides) to further their respective crusades.
To the uninitiated, “restoring the rule of law” probably sounds like a noble objective. The framing makes it sound as though the previous government (despite being called the Law and Justice party) ruled without any regard for law and justice. Perhaps, even, that it abused its power by oppressing dissidents or confiscating assets. Who knows.
Tusk’s accusation of “lawlessness” is even more sensational and misleading. In ordinary language, the term conjures up images of a mafia state, or worse, a failed state where it’s every man for himself.
But no reasonable person assessing the period during which PiS was in power could honestly suggest that this was the case. Poland was not lawless in any ordinary understanding of the word.
The sleight of hand lies in taking a specific legal and constitutional dispute and repackaging it as a sweeping indictment of an entire government. The accusation derives its legitimacy from genuine controversies over the rule of law, but its political force comes from the much broader and more sinister meaning that the phrase carries in everyday language.
At the heart of the dispute is the question of whether Polish constitutional law can take precedence over EU law in areas where the EU maintains that its law has primacy, alongside controversies surrounding judicial independence. These are major legal questions, but they are a far cry from the impression of generalised lawlessness that Tusk’s rhetoric invites.
“Restoring the rule of law” is an exceptionally effective piece of political messaging. It allows Tusk to present his government as the force restoring legality, while casting his opponents as people who governed outside the law.
Yet, powerful states such as the US and China have long asserted their sovereignty against international legal constraints they consider unacceptable. The EU may be a distinct legal order whose treaties Poland voluntarily accepted, but the broader question of where national sovereignty ends and supranational authority begins is hardly unique to Poland.
Of course, the ultimate source of the consternation lies in PiS’ judicial reforms during its time in power. Yes, breaking established procedures to pack supposedly independent courts with your own appointees is not a good look. But it becomes a little more understandable when you consider the historical context that Western media so often leave out when reporting on the story.
Poland never underwent a comprehensive “lustration” of its judiciary after the fall of communism. The transition involved compromises that allowed considerable institutional continuity, with elements of the old judicial establishment, its professional networks and institutional culture surviving into the new democratic order.
This is crucial because PiS did not regard itself as politicising an otherwise independent judiciary. Its contention was precisely the opposite: that the judiciary was already politicised, having never been sufficiently disentangled from the structures and networks inherited from the communist era.
From that perspective, its reforms were intended to dismantle an entrenched establishment rather than create one. The opposition and the EU regarded those same interventions as an assault on judicial independence.
Tusk and his allies have often challenged the relevance of the judiciary’s communist-era legacy by pointing out that most judges from that period are no longer serving. But this misses the substance of the argument. The concern is not necessarily about the survival of individual communist-era judges, but about the professional networks, institutional culture and entrenched structures that may have outlived them. The continuum.
DCWebGuy retweeted
Stanford University student Elsa Johnson became a target of the Chinese Communist Party in 2024.
Elsa attended a private school as a child with a heavy focus on foreign languages and became fluent in Mandarin Chinese while still in elementary school. Years later after she was accepted to Stanford, she studied international relations and researched Chinese industry and military tactics while working at the Hoover Institution on campus.
She soon came to the attention of members of the Chinese Communist Party, which has a heavy presence at Stanford and throughout Southern California. There are currently more than 1,000 Chinese students attending Stanford each year, and the university has received more than $64,000,000 in private donations from Chinese individuals and organizations since 2010.
In June 2024, a man claiming to be a fellow Stanford student named Charles Chen contacted her online. She was not initially suspicious as they had many mutual associates, and his photos and posts appeared to be centered on campus. But his questions and requests quickly put her on edge as he invited her on a paid trip to China. And he seemingly knew details about her that she had never shared with him.
When she tried to disengage with him, she began receiving threatening phone calls by Chinese speakers. Elsa contacted Stanford administrators and the FBI, who told her Charles was likely affiliated with the Ministry of State Security, had been posing as a Stanford student for years, and had targeted at least ten other female students since 2020 in a similar manner. They also told her she was under physical surveillance on campus by the Chinese Communist Party.
Elsa wrote articles in the Stanford Review and The Free Press about Chinese influence on campus, and in March 2026 testified about espionage threats on college campuses before the House Committee on Education and Workforce.
For episode 270 of the Spycraft 101 podcast I spoke with Elsa about being targeted by a foreign government right in the middle of a US college campus. The episode is available now.
#stanford #college #student #china #hooverinstitute
open.spotify.com/episode/6KO…
DCWebGuy retweeted
Polish President Nawrocki CONFRONTS Tusk-backed, SELF-DECLARED ‘HEAD OF COURT’ Korwin-Piotrowska inside CONSTITUTIONAL TRIBUNAL:
'YOU ARE NOT JUDGES OF THE CONSTITUTIONAL COURT!'
DCWebGuy retweeted
In 2019, a U.S. Coast Guardsman made a daring leap onto a moving drug-smuggling vessel in the Pacific Ocean during a high-stakes counternarcotics operation.
After spotting a suspicious semi-submersible attempting to escape, Coast Guard personnel launched a pursuit. In an incredible display of courage, one Guardsman jumped from the pursuing boat onto the vessel’s slippery surface while it was still moving through open water.
Standing atop the partially submerged craft, he repeatedly shouted “Alto su barco,” meaning “Stop your boat,” while pounding on the hatch. For several tense moments, those inside refused to respond. Eventually, the hatch opened, allowing Coast Guard personnel to seize control and detain the occupants.
The dramatic interception was part of a broader effort to disrupt drug trafficking routes across the eastern Pacific. In July 2019, the Coast Guard announced that multiple operations had resulted in the seizure of approximately 39,000 pounds of cocaine.
The remarkable footage highlights the enormous risks Coast Guard personnel face during maritime interdictions, where a single misstep can have devastating consequences. It’s an unforgettable example of the courage and quick decision-making required to stop smugglers at sea.