cats, bad takes and unhinged comments. **ALL POSTS are sponsored by my mental illness** Meat-puppet Strategist @hyperstrats
Crypto-twitter
Joined October 2017
- Tweets16.4K
- Following6.6K
- Followers3.3K
- Likes26.4K
Kage 🟦🟥 retweeted
quick ones
1) Binance has enough to withstand 3-4x of current hit and still be largely intact. Very likely they will shrug this off and user funds are very likely safu (but like obviously don’t deposit until they sort out what went wrong)
2) Wintermute obv has exposure to binance, but less than 20% of net equity and I don’t see any disruption to our operations on any time horizon in whatever scenario
Kage 🟦🟥 retweeted
Monitoring The Situation: Binance 14 owned another wallet
Binance 14 was the owner of Hot Wallet 34. once the sweeper could run as Binance 14, it could use that existing permission to pull another $823m USDC out of wallet 34. the owner check still accepted the same owner address.
cutoff for these numbers is October 29, 2:30 p.m. PDT / 21:30 UTC. still a developing incident; this is the snapshot through that point.
the trace covers 13 Binance-labelled source wallets across Ethereum, Arbitrum, Avalanche, Optimism and Base. about $3.57bn at the captured prices: roughly $3.51bn on Ethereum and $62m elsewhere. that's the value moved. final losses and recoveries are still unresolved.
the 50 EIP-7702 authorizations all recovered to Binance 14. one matched its current nonce and took effect. fifty signatures from one wallet. the delegation persisted, and the sweeper only accepted calls from its hardcoded caller.
running that code as Binance 14 let it transfer the account's balances. the first sweep moved about 167,464 ETH and 63 token balances. a later sweep collected fresh balances. wallet 34's $823m USDC came out in two calls using Binance 14's existing owner permission.
other source wallets made ordinary signed transfers. the Base and Optimism movements happened before the Ethereum delegation, so that one authorization doesn't explain the whole incident. we have valid signatures. how someone got access to them is still an open question.
then there's what happened to the proceeds. 435m USDT was swapped for about 160,451 ETH across the traced Ethereum wallets. another 60m USDT went into Aave as collateral, with about 19,762 ETH borrowed against it. that ETH comes with a debt. counting both the collateral and the borrowed ETH as freely available proceeds would overstate the position.
roughly $2.003bn in USDT and USDC was sitting in blacklisted Ethereum addresses at the cutoff. the entire stolen BEAM balance, about 984.25m tokens, had also been burned through a separate multisig transaction. frozen or burned tells us what happened to those holdings; it doesn't tell us how much Binance gets back.
there was preparation too. six Tornado Cash withdrawals supplied 1.5 ETH gross, and three small delegated accounts look like rehearsals. that's the withdrawal side of the funding trail. it doesn't identify the original depositors or whoever is behind this.
no exchange cash-out, bridge exit or Tornado deposit of the stolen Ethereum proceeds was established in this trace before the cutoff. what we can follow is swaps, borrowing and transfers between wallets. claims about funds having “exited” need to say where and when.
the exposure includes whatever else that address is allowed to control. Binance 14's owner permission is why wallet 34 belongs in the same accounting.
credit to @banteg for reconstructing the sweeper and @spreekaway for flagging the funding trail. the wallet names are explorer labels; the amounts and permission path were checked against receipts, signatures and execution traces.
hackmd.io/@kethcode/B1KBzrWT…
1/4 EIP-7702 can turn the wallet itself into the sweeper.
A Binance-labeled wallet moved 167,464 ETH + 63 tokens, including 1.615B USDT, just 3m24s after a signed delegation was installed.
This is bad.
etherscan.io/tx/0x53bd38b816…
Kage 🟦🟥 retweeted
Binance hot wallets were drained of $5.60B today across Ethereum, Bitcoin and Tron, 67 assets in total.
Tether and Circle have so far frozen $2.38B of it: $1.56B USDT ($1.18B on Ethereum, $379M on Tron) and $823M USDC.
Not frozen: 18,270 BTC ($1.45B), 197K ETH ($451M) and about $730M of USDT.
@cz_binance at 5:15 PM EST: "User funds are safe! It does look like a hack on Binance... as a shareholder, I expect all user funds will be fully covered."
Kage 🟦🟥 retweeted
i decompiled the contract that drained binance wallet 14
gist.wavey.info/Ta3FgAxastgj…
"Once men turned their thinking over to machines in the hope that this would set them free. But that only permitted other men with machines to enslave them." - Frank Herbert
Kage 🟦🟥 retweeted
If I can do it, you can do it. 🤖 🦾
Agent Games by @ZKVProtocol
Kage 🟦🟥 retweeted
RAG is officially cooked.
IBM built a retriever that hallucinates 65x less than fine-tuned RAG systems.
Right now, every company is using Retrieval-Augmented Generation (RAG) to stop their AI from hallucinating.
The idea is to give the AI a private database to read so it doesn't make things up.
But there is a massive structural flaw.
Standard RAG blindly grabs documents based on vector similarity and forces the AI to read them. If the retriever pulls irrelevant garbage, the AI doesn't stop.
It just hallucinates with citations.
IBM just dropped a paper that changes the math entirely.
They built a new retrieval architecture that hallucinates 65x less than state-of-the-art fine-tuned RAG systems.
65x is the difference between a fun prototype and a production-grade enterprise system.
Instead of blindly dumping context into the model and hoping for the best, their system actively filters and validates the retrieved data before the generation step even begins.
It cuts out the noise. It forces absolute precision.
For businesses, this is the holy grail.
Zero hallucinations means zero liability. It means autonomous agents can finally be trusted with sensitive company data without a human babysitting every output.
Kage 🟦🟥 retweeted
Someone has created a vulnerable PHP website, loaded it with a Bitcoin wallet, and challenged the Internet to hack into it and they can keep the Bitcoin. It has a running timer to show if the PHP exploitability was over-hyped. stealmybitcoin.com/
Kage 🟦🟥 retweeted
A brief update on the critical vulnerabilities in PHP:
We have not yet validated exploitation in the wild and we have no evidence of successful wide scale exploitation. There are currently several exploit PoCs publicly circulating, many of which appear to be "vibe-coded" and are incapable of remote code execution. We have validated some PoCs, however, that are capable of RCE against default deployments of mod_php but not PHP-FPM.
Nonetheless, exploitation may have already begun in a limited fashion and the threat is viable and very serious. Defenders should:
1) Patch & Restart by upgrading to PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restarting web services
2) Layer Temporary Safeguards at the network edge (WAF/proxy rules) and server configuration level if immediate patching requires a maintenance window
3) Protect Credentials by monitoring for abnormal session traffic and rotating keys and passwords on compromised internet-facing PHP systems exposed prior to patching
🔗 We are continually updating our Cloud Security blog post on this topic with real-world guidance and actionable defense strategies as we learn more. Please keep monitoring these posts for updates as you prioritize your patching efforts: cloud.google.com/blog/produc…
🔗 Technical details from Wiz: wiz.io/blog/php2shell-php-rc…
🔗 Details of the exposure from VirusTotal: blog.virustotal.com/2026/10/…
Kage 🟦🟥 retweeted
Dear OpenSea i have no friends left that will fall for another referral scheme, they have all been rinsed repeatedly and extensively, we have to figure out a better way to get them from now on
It is Wednesday.
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Kage 🟦🟥 retweeted
I like how “DeFi” this time around is all about enforcing rules, limiting permissionlessness and holder agency, and building out the technical infra that institutions like the European Union will eventually use to control where you can spend your crypto and what you can spend it on
