If you run PHP please: session.upload_progress.enabled = Off php_admin_flag session.upload_progress.enabled Off

It's worse than Heartbleed. it should be on the front page of every newspaper in the morning (but it wont be) It's so weird living in a tech dominated world where everyone has a smartphone and is on the internet constantly.. ..yet most people will never even hear about this.

PSA: Do NOT use public WiFi or shady DNS servers for the next few weeks. SSL is practically broken and you can be attcked with an MITM attack. Your ISP and other intermediaries can also spy on you. Use a trusted VPN. It will take a few days at least to flush out this crap CA.

the real alpha is @turnkeyhq quietly powering most of these

🚨If you are ever targeted in a wrench attack or threatened with physical violence for your crypto: comply. Your life is more important than your assets. Once you are in a safe place, speed is everything. Call the police immediately, then contact @SEAL_911 on Telegram t.me/seal_911_bot. Share the transaction hashes and attacker addresses as fast as possible so they can trace the movement and relay the data. In a recent incident, this sequence made all the difference. A victim was subjected to a violent robbery and had their funds stolen. Once they reached safety, they contacted SEAL 911 with the transaction details. SEAL verified the incident and pushed the attacker addresses directly into TIPzs, zeroShadow's threat intel platform that feeds live incident data straight to exchange screening systems. Seconds later, the criminals attempted to swap the stolen assets at an exchange. Because TIPzs pushes threat data to connected platforms in under two seconds, the intelligence landed ahead of the deposit. The exchange caught the incoming transaction and froze the funds on arrival. SEAL 911, zeroShadow, the exchange team, and law enforcement are now coordinating to follow the legal process and help the victim recover their assets. Prioritize your physical safety first. After that, fast reporting is what makes intercepting and freezing the stolen funds possible. Thank you to SEAL 911, the exchange team and law enforcement for working together with us and showing how the private and public sectors can work together and do our part to effectively help those who are victimized and deserve all the help they can get.

"If you want change, you have to advocate for it.” In this guest thread, @KyleBligen, Executive Director of @TheDRC_, explains how the Decentralization Research Center is working with policymakers to support a safe and competitive decentralized future.

This should be a wake-up call for a lot of people. In the age of AI threat actors, protecting your keys becomes all that much more important. This is why @turnkeyhq Secrets Management is architected the way it is, it is not systematically vulnerable to this kind of attack.

Assume that every organization is gonna be breached in the coming months. The attack surface is too big and LLMs are extremely fast and good at finding new vulnerabilities all the time.

the point of crypto is to destroy DTCC

Peter is a class act fighting for the crypto industry, personal freedom, family and country. We don't deserve you but we certainly need you more than ever.

🔬 Introducing SEAL Labs, where we’re partnering with outside experts on time-boxed experiments, starting with a six-month collaboration with @blockthreat to expand SEAL Intel’s incident coverage across the ecosystem. radar.securityalliance.org/i…

Their IT guy: "don't worry, our password changes every day, super secure"

🚨 October 13 UPDATE: Ledger Supply-Chain Attack New developments have emerged since our last article into the CryptoBilis hardware-wallet compromise. Ledger’s Donjon team has disclosed technical findings, additional devices are under scrutiny, and a major European retailer has suspended sales. Here’s what changed. 🧵

.@UmbraPrivacy just launched the privacy layer for money. Every user's viewing key is split across guardian nodes running on Turnkey Verifiable Cloud. No operator can see these keys, and anyone can verify that code onchain. Private finance, secured by Turnkey.

Best conversation I had at TOKEN2049 was with a trading firm: "The next 10/10 won't come from a tariff headline. It'll come from someone stealing a market maker's CEX API keys and dumping the market." That's one of the reasons @turnkeyhq built our secret storage solution.

Saying that your hardware wallet is better because it doesn't have a screen, so you can not tamper with it is like saying that not having hot water doesn't affect you because you don't have water to begin with. A hardware wallet without screen is pointless, because you can NOT verify what you are signing with it, you are trusting the device connected to the internet.

Any hardware wallet can be tampered with an implant at the hardware level, without touching the firmware. The only reason why Ledger was the first one to be targeted is the same reason why MacOS, Linux or WordPress are heavily targeted: because they are the number one in their field and the most used ones. It's a matter of incentives.

🚨 Please get in contact with us ASAP if your funds were drained to these addresses. @SEAL_911 Telegram: [@]seal_911_bot

I wrote about an interesting tax case being litigated by @FenwickWest against the IRS. A longtime self-custody bitcoin holder is opposing the IRS’s claim that he owes taxes on forks of bitcoin that he never even accessed simply because he has keys that could access them. Give it a read. coincenter.org/a-tax-case-ev…

🚨 Ledger security incident update 🚨 Apparently, some Ledgers (Nano X, though other models may be affected) bought in Southeast Asia from the vendor CryptoBills were hit by a supply chain attack: at some point, a chip was implanted inside the device that monitors and records what's shown on its screen (the seed phrase) and then transmits it to an attacker. Because the attack targets the hardware layer, there's NO need for the threat actor to modify the firmware, so Ledger Wallet treats the device as valid when running the genuine check. If you bought a Ledger in Southeast Asia, move your assets urgently. Please RT