The security paradigm has significantly changed. Moral panic and influencers won’t protect you. DYOR. infosec will get a LOT worse before it gets better.
🇦🇶
- Tweets 132,117
- Following 1,905
- Followers 161,860
- Likes 119,316
Pinned Tweet
BAM! #Bitcoin sent over 7.077Mhz via #JS8Call to @SamuelPatt
Sweep: blockchain.com/btc/tx/82c043…
Toronto,CAN => Michigan,USA [40W:#SnowStorm]
Bcuz its a brainwallet made ahead of time, with bearer pk I don't require internet to broadcast this transaction at the time i'm sending
515
480
1,896
NVK retweeted
❗️ A critical Signal bug let the other person on a call keep listening after you hung up.
Flooding the call's event queue could stall your hang-up, leaving your mic and possibly your camera live.
Signal patched CVE-2026-113380 on Android in September. No attacks are known.
12
30
194
12,434
NVK retweeted
My top three HWS in order, explained. I intentionally left out DIY to keep this simple so the DIY people don't need to come at me but I respect you 👍
1. COLDCARD Q @Coinkite - My prized possession. I play with the Q all the time, becoming more obsessed as time goes on. The Q immediately makes most other hardware irrelevant IMO considering all the features and functionality, especially not requiring a companion app for initial setup. There really is something special about the full QWERTY keyboard... I have never regretted buying a CC and features are still being added 🐦🔥
2. Frostsnap @FrostsnapTech - By far the best multi sig option there is, as SIMPLE as it gets. Perfect when you don't only have yourself to think about as long as they are geographically distributed properly. These devices give me the same excitement as the Q even though I use them much less. You don't have to worry about internal batteries. They appear as single sig regardless of how many are used. The setup, signing and restoration are magical. Seriously love these things... ❄️
3. Blockstream Jade Plus @BlockstreamJade - I gave Blockstream a hard time for months after the release of the Jade Plus because of my issues with the camera but that was eventually fixed after 2 or 3 firmware updates. The Jade does not actually force you to use an app although most people are probably better off hosting their own oracle when they can for better reliability. I enjoy the simple, small, lightweight form factor while still incorporating some features like a passphrase, BIP 85, OTP, and stateless which most people don't realize is an option. I do occasionally use liquid too so it's great for that. The oracle is not perfect but I respect @Blockstream for doing something different. The alternative theme options scores the Jade some Aura points. I do feel bad for attacking Blockstream so much in the past so hopefully they will appreciate it still being in my top 3 😇
4
6
17
3,094
NVK retweeted
Lula turned Brazil into Venezuela.
You can vote your way into communism, but not out of it.
104
637
5,548
34,357
NVK retweeted
We are aware of the recently disclosed PHP vulnerability.
Trust Wallet’s wallet apps and core infrastructure are not built on PHP. Users are unaffected and no action is required.
129
202
1,799
550,782
NVK retweeted
Bitcoin will never break its all-time high again." — Jason Calacanis
Jason, I'll bet you $1,000,000 it will break its ATH. Here are the terms:
Bitcoin hits or exceeds $126,210.50 on or before October 28, 2028, 12PM PST
I’m happy to trust you to pay or if you prefer we can each escrow the dollars with independent party.
The bet is either settled when Bitcoin hits the ATH or on October 28, 2028.
@jason Do we have a bet?
1,082
750
11,403
1,435,573
RT @Coinkite: @PremiumBusiness having issues with access to premium business support, please DM back.
2
250
NVK retweeted
🔴 CVE-2026-118320 · Google Chrome >=156.0.8078.73 <156.0.8078.73
Google Chrome's V8 JavaScript engine is affected, and the flaw could let a remote attacker run arbitrary code within Chrome's sandbox if a user… CVSS 8.8. EPSS 0.00.
Fix: 156.0.8078.73
cve.now/CVE-2026-118320
3
17
101
28,905
NVK retweeted
BREAKING: Claude Code found 12,847 photos of my face on my iPhone that I never took.
It looked like the phone was taking them every time I picked it up. From the club. From home. At a red light while I was driving. Almost every time I took the phone in my hands there was a frame.
They were sitting in a system cache with timestamps and location data. None of them were in Photos.
I plugged the phone into my MacBook and asked Claude Code to scan for any front-camera files that weren’t in my Photos library or Recently Deleted. It flagged Private/var/mobile/Library/Caches/com.apple.faceid. Over 12,000 files. Mix of infrared frames and regular front-camera images. Each one had a timestamp and GPS coordinates attached.
I started scrolling. Most were from the last 14 months. Then I saw one from four seconds ago. I was still looking at the folder.
Apple says the TrueDepth system turns the capture into a mathematical model inside the Secure Enclave and discards the image. On this phone the raw frames were still in the cache. Several of the processes that wrote to the folder belonged to system diagnostics. A couple of old apps with camera permission also had access to the same directory.
I turned off diagnostics sharing and revoked camera access from every app that didn’t need it.
If you want to check your own phone, plug it in, run a backup, and ask Claude Code to look for front-camera files outside the Photos library. The folder path above is where mine were.
Claude Code found 145,763 photos I permanently deleted from my iPhone.
Three years of deleted photos and videos still sitting in a hidden cache. Any app with file access can read them.
I plugged my iPhone into my MacBook to run a backup. Claude Code was doing the security audit from my last post and flagged a directory I wasn't even looking for.
PhotoData/Thumbnails. Over 146,000 files. Photos, videos, screenshots. Every single one was something I deleted.
Photos from 2023, 2024 and 2025. The ones I deleted the second after taking them. The ones I cleared from Recently Deleted. The ones I deleted three separate times because I wanted to be sure they were gone. All still there.
Passport photo I took for a visa application in 2023.
Screenshots of my bank app with full account numbers visible.
Private photos I sent someone and immediately deleted after a breakup.
Screenshot of my crypto seed phrase I took temporarily in 2022.
Photo of my ID and credit card I took to remember the numbers and deleted 5 seconds later.
Screenshots of my ex's private Instagram stories I saved and permanently deleted in 2023.
Some were full resolution. All organized by date going back to 2021.
When you delete a photo on iPhone, iOS removes it from your camera roll and Recently Deleted. It keeps a compressed copy in a Spotlight search index cache so your phone can find things when you search. Apple never clears it. Not after 30 days. Not after a year. Never.
They told you it was permanently deleted. It wasn't.
I checked which apps on my phone had Files and Folders access. 23 apps. Weather apps. QR code scanners. PDF readers. A flashlight app I downloaded in 2022. Any one of them could have been reading every photo I ever deleted this entire time.
Went from 23 apps to 3 in about two minutes.
Full step by step below. Takes 2 minutes. Save it so you don't lose it and send it to anyone with an iPhone.
187
1,470
15,246
1,417,150
NVK retweeted
Coinbase has not had a data breach.
Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.
We’ve found no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted.
We are notifying impacted customers and regulatory agencies in accordance with our legal obligations.
118
103
724
131,256
NVK retweeted
This might lose me some followers, but I just ordered another Coldcard Q.
Huge mistskes come with huge auditng and both hardware and features are still top notch.
That said, don't trust - verify.
15
2
31
4,670
NVK retweeted
4 pasos para ser de ultraderecha :
1. Trabajar
2.Querer formar una familia
3.Saber economía básica
4. Bañarse
880
5,950
53,978
641,044
Se você tem uma Coldcard parada e sem chaves, zerada, pode experimentar com a Catcard do @MagicalTux que está em alpha para ajudar a testar e reportar bugs - AINDA NÃO É PARA USO FINAL
github.com/TibaneLabs/catcar…
Catcard: Firmware opensource (MIT) independente para Coldcard em Rust
5
5
50
3,166
NVK retweeted
nitter.siddz.com/SGBarbour/status/10519…
Far worse than supplying shitcoin infra (market demanded it after all) is building in a kill-switch on your miner that effectively bricks competitor hardware.
Beware "decentralized" - it is choice vocabulary for scammers and frauds.
Just look at Siacoin - claims to be "decentralized" yet is clearly a *permissioned* blockchain. Start competing and they will brick your ASICs... just pathetic.
1
1
749
NVK retweeted
🚨 MAJOR SECURITY ALERT: bitcoinjs patches multiple high security issues in their packages
We hit some of the most critical infrastructure in Bitcoin is dependent on bitcoinjs packages—bitcoinjs-lib, bip39, tiny-secp256k1 were affected are ato multiple high security issues affecting major wallets, protocols, bitcoin infra and sdks :
> bitcoinjs-lib: CVE-2026-107846, GHSA-8247-5gp7-95qh, GHSA-4mfv-5394-26c7, GHSA-88jr-9qj4-ccm4, GHSA-h52v-8xwg-7j95
(patch versions: 7.0.5, 6.1.10, 5.2.3)
> bip39: CVE-2026-107847, GHSA-39w3-8jr6-f676
(latest patch version: 3.1.12)
> tiny-secp256k1: CVE-2026-107853, GHSA-85g9-f6v5-wqq7, GHSA-rm9w-7fv8-3rhx
(latest patch version: 2.2.5)
All of the above packages have ~500k downloads/week.
Also, multiple other CVEs/disclosures took place over more libs of bitcoinjs by other researchers like the ARSB and Bitcoin Red Team:
> bitcoinjs-lib: GHSA-4vm8-79jj-j6w4 (patch versions: v7.0.5, 6.1.10, 5.2.3)
> bip38: GHSA-mj7w-64jg-8f98
> bip32-utils: GHSA-wvw7-chj5-hr2g(patch version: 0.11.2)
> merkle-lib: GHSA-g353-54jg-j6gg (patch version: 2.0.11)
> bolt11: CVE-2026-107855 (patch version: 1.4.2)
There are a total of 15 findings (14 highs, 1 medium) and cover areas including transaction and block parsing, PSBT fee calculations, proof verification, mnemonic handling and elliptic-curve operations. Their impact depends on the affected version and how an application uses the library. Each advisory explains those conditions and the required remediation.
It was greating coordinating with @junderwood4649, @landabaso.
4
12
31
4,246
NVK retweeted
Doing some digging into @FoundationHQ before and after their rebranding into the Bitcoin space that confirms my suspicions and belief through my experiences. Wish I would have done this before. VERY interesting stuff 🫠
3
2
7
1,645
RT @Coinkite: Coinkite’s standard data-retention practice is to blank customer records after 120 days, retaining only email and country. Cu…
1
289