When the attack lives in the physical device, every software check is looking in the wrong place. After a reseller-level hardware compromise cost people tens of millions, here’s how I’d secure a hardware supply chain if I were the manufacturer.

Six months after Drift, the exploiter is washing ETH through Tornado Cash. About 25,700 ETH in two hours, per @lookonchain. Worth remembering how that $285M left. No contract bug. Two of five Security Council signers were socially engineered into pre-signing durable nonce transactions, approvals that stayed valid until the attacker chose to use them. A move to zero timelock days earlier removed the last chance to catch it. Multisig counts signatures. It doesn't check what was signed. Running treasury ops? Dedicated signing devices, verify the payload outside the signing UI, timelocks on admin actions, and no long-lived pre-signed approvals.

The keys didn't leak from the sites. They leaked from the vendor. TeamUpdraft believes its customer database was accessed over the weekend, including UpdraftCentral connection keys. With those keys, signed commands installed backdoor plugins on fully patched WordPress sites. Every signature check passed, because the signatures were real. Patchstack found the box that adds your site to UpdraftCentral is ticked by default when you connect a TeamUpdraft account, so plenty of sites hold a key nobody remembers creating. If you run UpdraftPlus: update to 1.26.12 or 2.26.12, delete the UpdraftCentral key, and look for admins and plugins you didn't add. Remote management you never use is still remote management. Turning off what you don't need is constant attack surface reduction, and it's near the top of my agenda for a reason.

One Chinese-speaking operator pointed AI agents running a mix of DeepSeek and Claude Code at 1,200+ e-commerce sites starting Sept 25 and broke into sites belonging to 100+ companies, including Deere and a SharkNinja support site. NorForge's Snorre Fagerland estimates about $50 in tokens per successful break-in. The goal according to NorForge was persistent access to e-commerce and payment infrastructure to monetize later. In this business that usually ends in skimmers and stolen cards. The detail that stuck with me: when a big target's main app had no holes, the agents went digging through related infrastructure, found a public control panel with a subtle flaw, and spent hours working it until they had command execution. Successful hits averaged about 23 hours. And the only reason anyone saw this is the attackers left their own Cairn panels open on the internet. Cairn is the open-source agent platform they ran it all on. This is why constant attack surface reduction is a top agenda item in the security programs I run. Your attack surface is everything tied to your name, not just the app you're proud of. Forgotten admin panels and vendor hosted sites are exactly where these agents went looking. Find them and shut them down before an agent does.

The miner is the least interesting part of this. That startup item has a random name, runs a big encoded script through bash, and is dated Aug 29. That could be seven weeks of someone running code as this user, with access to everything they can reach, including the GitHub login on that Mac. The temperature sensor was the only honest thing on that machine. If this is you, don't just delete the plist and run a scan. Copy off your documents (not apps, plugins or Library folders), wipe the Mac, and from a clean device rotate every password, token and session that touched it. Quick check on your own Mac: look in ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons for anything you don't recognize.

Doing the math on @elonmusk SpaceX share for every American kid. SPCX around $146 today. Over the next 18 years (when today’s kids are adults): - 15% CAGR: about $1,800 - 20% CAGR: about $3,900 - 25% CAGR: about $8,100 At a $50T market cap that’s about $3,700 per share and at a $100T market cap about $7,400 per share. One share today could be worth thousands (or far more) by the time recipients turn 18.

Ignorance is bliss.

Burning the historic town hall in Limoges to protest the high cost of living is peak self-sabotage. Rebuilding it will be paid for by the same taxpayers already struggling with prices and strained services. Destruction does not lower costs. It raises them.

Second wallet maker in two days whose own app notifications were used to phish seed phrases. SecuX, now NGRAVE. The lure: your wallet just synced on a Pixel 9 in Moscow. Fear first, then a box for your 24 words. The only time you type your seed is when you chose to restore a wallet. Never because an alert told you to.

Attackers abused ConnectWise Cloud Backup (formerly SkyKick) to pivot into customers' Microsoft 365 environments. If you or your MSP use it, audit every enterprise app and consent grant in Entra today and pull anything you didn't approve. Your vendor's access is your attack surface.

Per FLHSMV, one Plant City police user's credentials, stored on a personal device, were enough. Floridians: stay vigilant for phishing emails, texts and calls, especially ones posing as government officials or pushing an urgent, fear-driven call to action.

Hijack one employee's WhatsApp, clone the client group, ask for a transfer. HK$4M gone from a Hong Kong OTC desk. Your chat app is not a treasury approval system. Big transfers need a callback to a number you already had, and a second person who wasn't in the chat.

Friendly reminder: no legit hardware or software wallet company will ever ask for your seed phrase. Not support, not a firmware update, not a "verification" email. Ever.

Whenever there's a hardware wallet headline, the phishing kit ships the same day. @SlowMist is seeing fake Ledger "firmware update" pages riding the implant story. Genuine Check lookalikes, device picker, big Update Now button. Update only through the official app. Never through a link. Never type the 24 words into a website. The implant was act one. This is the encore.

We have flying cars now. Pretty sure @elonmusk just won me a bet I made in the 5th grade.

The password wasn't Denmark's. It belonged to a small vendor that had legitimate access to the national registry. That's the lesson: your vendors' credentials are your credentials.

Two police accounts with ~900K followers, renamed "Help Xaman," tagging people as eligible for an XRP claim. That's a wallet drainer playbook, not a giveaway. Simple rule: no wallet, exchange or police force will tag you about a crypto claim. If it wants you to connect and sign, it wants your funds. A hijacked verified account is just a very convincing billboard.

The same people who get outraged by comedians often live in a state of constant victimhood, convinced the world is out to get them. Ironically, the people least trying to get them are the comedians. Their job is simple: make the people in the room laugh. Not everyone.