Pinned Tweet
Just playing with the new KCC3 22' "Quantum" addresses. Hidden keys on Kaspa, live 🔒
KasSigner just signed its first send to a KCC-3 address on mainnet: only a script hash on chain, the public key revealed only when it’s spent. 🤟🏼 @InKasWeRust
KasSigner retweeted
Mid-Chain @ BGU · Part 2: Sessions 3–4, Noam Nisan & Yehuda Lindell xitter.cf/i/broadcasts/1YGNrbwdZ…
KasSigner retweeted
Replying to @FoundationHQ @GigaBitcoin
It’s much worse than that: the hackers showed off their collection of individual shipping addresses and phone numbers.
In my case, it’s a PO box. I hope everyone else is fine, though.
KasSigner retweeted
ANNOUNCEMENT: SPAM EMAILS HAVE BEEN SENT THAT APPEAR TO HAVE COME FROM OFFICIAL FOUNDATION DOMAINS.
We have traced this back to one or more compromised API keys on Cloudflare, and have already revoked all API keys.
The malicious domain in the spam email has been taken down.
Funds stored on Passport are safe and Passport hardware is not compromised.
We are working nonstop to discover exactly what happened and will put out a report ASAP.
KasSigner retweeted
This is fucking crazy.
I knew all the Smart TVs were spying—that’s why I have a commercial panel with minimal compute and no radio, plugged in to an AppleTV. But this is crazy!
KasSigner retweeted
🇫🇷 URGENT - Le Premier ministre Sébastien Lecornu a demandé à Orange, SFR, Free et Bouygues Telecom de se tenir prêts à COUPER l’accès à TikTok, Instagram, Snapchat et 𝕏 en France, en prévision de la mobilisation du 24 octobre. (Blast)
KasSigner retweeted
Dude, can we please stop publishing vulns before they are disclosed to the vendor!?!?!?!??!
‼️ Researcher Erica Windisch skipped coordinated vulnerability disclosure and published 11 unpatched Tailscale flaws.
In her lab, Tailscale SSH race conditions let one hacked device get root on other servers and add a rogue node.
Readers added context they thought people might want to know
The Tailscale SSH findings require prior authorized access on the tailnet per the researcher's report; Tailscale stated issues concern post-authorization behavior only and did not recommend disabling SSH for everyone.
tailworm.com
x.com/IntCyberDigest…
KasSigner retweeted
POV: you just shipped Toccata smart contracts on a 10 BPS proof-of-work L1
Absolute legend @michaelsuttonil
kaspa:native
KasSigner retweeted
‼️ Tailscale SSH Flaws Could Let Hackers Gain Root Access Across Servers
Details: cybersecuritynews.com/tailsc…
A new security report warns that Tailscale SSH has flaws that could let a hacker move from one compromised device to root access on other servers. Tailscale SSH lets approved devices log in to each other over a private network. The report lists 11 findings in five groups.
They cover Tailscale’s SSH server, its serve and app connector features, the DERP relay client, and headscale, an open-source server that manages Tailscale networks.
The researcher tested Tailscale 1.104.2 and headscale 0.29.5 between October 22 and October 24, 2026. The most serious group involves Tailscale SSH. Its SSH server runs inside tailscaled, a background program with full root privileges on the machine.
#cybersecuritynews
Readers added context they thought people might want to know
The flaws require an already-approved device in the Tailscale network with SSH rules permitting access/forwarding; they enable post-compromise lateral movement and escalation inside the tailnet, not unauthenticated remote access from outside.
tailworm.com
brandefense.io/security-news/…
tailscale.com/security-bulle…
x.com/mmaunder/statu…
KasSigner retweeted
We owe you an apology.
On October 20, we detected unauthorized access to our official website. After verifying API activity with Shopify, we confirmed on October 23 that a third party obtained customer shipping information. You trusted us with those details, and we're sorry we didn't keep them safe.
Exposed: names, contact details, shipping addresses, and order details (items and prices).
Not exposed: payment card or bank details, recovery phrases, private keys, or wallet passwords.
We've blocked access, fixed the vulnerability, opened an investigation, and are emailing affected customers.
Scammers may pose as Keystone by phone, text, email, or mail, offering refunds, replacement devices, or "fixes" for your order or address. None of it is from us.
NEVER share your recovery phrase or private keys, and NEVER enter your recovery phrase into a device you didn't order. We will never ask for them. Don't click links in unexpected messages. Type keyst.one yourself.
A detailed report is coming soon.
Until then, trust only our official channels. If anything feels off, email [email protected]. We'd rather hear from you than have you take a chance.
Again, we're truly sorry to everyone affected.
KasSigner retweeted
i’ll do everything in my power on the technical side to help this initiative move forward and navigate any protocol-level obstacles along the way.
on a personal note, Alex has a rare mix of technical depth, bizdev talent and deep Kaspa knowledge. i honestly can’t think of anyone better suited to lead it, and i really appreciate him taking this on
Today we are introducing KaspaDollar, an initiative led by core developer @asaefstroem to build the first decentralized stablecoin on the $KAS network.
The developments around @kccforum and the Toccata hardfork have considerably widened what Kaspa is capable of. Capability alone, however, does not make an ecosystem. Decentralized finance requires a unit of account that holds its value, and until Kaspa has a stablecoin of its own, every application built on it will remain dependent on assets issued elsewhere.
The design we intend to follow is the decentralized, overcollateralized stablecoin: a pattern whose security properties have been examined and tested across the industry for the better part of a decade. With the support of the core team, we consider the conditions right to bring it to Kaspa.
Realizing this requires development, an independent audit, further research, and the operational work of taking a protocol from specification to production. To fund it, we are opening a fundraiser with a target of 5,000,000 KAS.
Contributions are made directly to the fundraising address published on the website. Should the target not be reached by 1 January 2027, every contribution will be returned to the address from which it was sent.
Up until that point, this account will share the plans, details and progress of the work as it develops.
KasSigner retweeted
HACKERS USED AI AGENTS TO ATTACK OVER 400 BANKS AND FINANCIAL FIRMS ACROSS LATIN AMERICA
A cybercrime group called CyberCartel used Claude, Grok, and China’s Kimi AI to coordinate cyberattacks with minimal human involvement, according to cybersecurity firm Straiker.
The group deployed multiple AI agents in parallel, using Claude to plan and coordinate attacks and Grok to collect sensitive information.
Hackers bypassed AI safety guardrails by pretending to conduct authorized security tests. When models refused, the system automatically switched to other AI models or prewritten attack code.
Researchers uncovered a database containing 4,493 records, including stolen passwords, bank account details, API keys, and other sensitive information.
Anthropic has revoked the group’s access to Claude, while xAI is investigating.
KasSigner retweeted
MAJOR INTERNET SECURITY SCARE AS 8 TLS CERTIFICATES FOUND WITH EXTREMELY WEAK PRIVATE KEYS
Eight security certificates issued by India-based eMudhra were found to have private keys so weak that attackers could potentially impersonate virtually any website.
Some private keys were so weak it was like protecting the Internet with a two-digit PIN instead of a nearly impossible-to-guess password.
These certificates are supposed to prove that websites are legitimate and connections are secure.
Major browsers have already blocked the affected certificates, but millions of servers, Linux systems, and connected devices may still need updates.
One cryptography expert warned the cleanup could be “bigger than Heartbleed,” the massive 2014 Internet security vulnerability.
No malicious exploitation has yet to be confirmed.
KasSigner retweeted
Just playing with the new KCC3 22' "Quantum" addresses. Hidden keys on Kaspa, live 🔒
KasSigner just signed its first send to a KCC-3 address on mainnet: only a script hash on chain, the public key revealed only when it’s spent. 🤟🏼 @InKasWeRust
KasSigner retweeted
It's exciting to see more SeedSigner posts coming from Chinese users over the last few weeks -- that is one of the parts of the world where I think the project has the most potential to make an impact.
Replying to @Carefuand @SeedSigner
爱是会感染的。一个人被感动,就会去感动下一个人。DIY 也一样。
又有人做出了自己的 @SeedSigner。他是看了别人的分享,一块一块零件买来,一步一步组装,最后点亮屏幕。这份喜悦会传给下一个人。
自我保管,不只是掌握私钥,也是掌握自己的硬件:用通用零件,不留下"我买了一台钱包"的痕迹。
KasSigner retweeted
$KAS
Stronger quantum resistant addresses coming to KaChat very soon!
All you need to do is simply generate a new spend address. All new spend addresses have the upgrade. Send Kaspa to it and don't send anything out and that address will remain protected.
Upgraded addresses start with kaspa:p... while the legacy addresses that always expose the public key start with kaspa:q...
KasSigner retweeted
I remember, when I first drop this without using kip22 but it works on chain but nobody see me or listen I even beg dev to used it no response but only @mrZeku2000x
Used it, It called p2sh privacy it address start with kaspa.p
@LevendiPro @michaelsuttonil I'm a curiousbeing
Published KIP 22 to help Kaspa users better protect their funds from future quantum attackers by keeping public keys hidden until spending
github.com/kaspanet/kips/blo…
KasSigner retweeted
I wrote kip22 (now KCC-3) because I saw many ppl like you searching and implementing solutions, and I wanted to write a canonical solution for it.
KasSigner retweeted
Anybody here looking for a Superstar programmer?
I'm trying to help a friend and colleague that got into a delicate life situation, and needs to find a job ASAP.
I have personally worked with him for about a year, reviewed his code - he is one of a kind talent.
He can code in all languages, at all sides of the server, understands crypto and computer sciences thoroughly.
He is located in Belgrade. Willing to work remotely.
































