Cybersecurity researcher focused on threat intel & APTs. Breaking down attacks, hunting threats, and crafting YARA rules. Buddy @ Three Buddy Problem
Bucharest
- Tweets 10,744
- Following 7,852
- Followers 39,956
- Likes 23,962
Pinned Tweet
The Cybersecurity Booklist: 11 Must-Reads for 2026 from The Three Buddy Problem Podcast: medium.com/@costin.raiu/the-… @ryanaraine @juanandres_gs
4
8
59
24,928
If you are a cryptocurrency business / platform / exchange moving more than 1M / day, you need to have a threat intelligence team that uses AI to learn everything there is about Lazarus / TraderTraitor and tracks them regularly by maintaining partnerships with specialized CTI companies, or you will be the next one we read about in the news 🦾
1
5
29
2,369
What’s stopping the FBI from creating a partnership with cryptocurrency exchanges and companies like @tether to regularly share IOCs for Lazarus / TraderTraitor and maintain a private master database of wallets associated with nation state and cyber criminal groups?
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
How You Can Help:
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
A list of addresses associated with this activity is available here: fbi.gov/investigate/cyber/al…
ALT FBI public service announcement with Department of Justice seal in the background on a gold gradient.
4
4
13
1,354
Costin Raiu retweeted
The FBI is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange, Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
How You Can Help:
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.
A list of addresses associated with this activity is available here: fbi.gov/investigate/cyber/al…
ALT FBI public service announcement with Department of Justice seal in the background on a gold gradient.
884
3,187
12,048
2,527,259
Costin Raiu retweeted
Surprised that Binance still not shared any IOCs to the public. Where are the indicators!
5
8
41
3,620
Costin Raiu retweeted
BREAKING: GLM 5.5 training traces show they might ship 32B, 122B and 256B variants 🔥🔥
If they DO ship a 32B, Qwen3.6-35B might finally be beaten!
The next two weeks should be interesting 👀
GLM 5.5 might come in versions with sizes you can run at home!!!
A leak shows Zhipu training 32B, 122B and 256B models to merge into the 5.5 base.
At 4bit the 32B is ~16GB. One GPU🤞
79
71
1,274
53,013
Costin Raiu retweeted
Very impressive forensic accounting from @AndrewMohawk detailing “test” transactions since October 8th leading to the eventual $6b heist
I went back through the Binance hot-wallet drain because the October 29 “test transactions” felt way too close to the real attack.
Turns out somebody was testing the same EIP-7702 pattern weeks earlier, starting October 8
8
30
3,078
Pray that the defenders get access to more powerful models than the attackers - or we’re heading into some very dark times.
14
16
94
5,046
Costin Raiu retweeted
GLM 5.3 Flash > DeepSeek V4.1 Flash 1017
I do. I’m about to go back to GLM (probably this weekend). DeepSeek is a beast and I’ve been running the TP2 version since it’s been out. It’s run over 100 VulnHunter runs. It’s good. But it’s not GLM.
My gripe with GLM has always been speed. But once I got used to it, it wasn’t bad. And I’m augmenting some of my work with some different subagent configs that are working well.
GLM is GOAT’d.
59
14
403
42,507
Costin Raiu retweeted
I went back through the Binance hot-wallet drain because the October 29 “test transactions” felt way too close to the real attack.
Turns out somebody was testing the same EIP-7702 pattern weeks earlier, starting October 8
10
49
321
36,002
Costin Raiu retweeted
I’m starting to think there might be more to cybersecurity than just vulnerabilities??
96
43
800
44,553
"Hey claude, launder $6B for me, make no mistakes"
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binance…
13
70
1,280
88,228
Costin Raiu retweeted
haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out.
Literally stealing people's private work, as they do it, is cartoonishly evil.
It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers.
Yet another reminder of the importance of open models.
89
197
1,467
192,184
Some Daybreak users are receiving emails from OpenAI that their can opt out of training, except for cases that trigger the safeguards. Hopefully this will be used to reduce the number of false positives with the guardrails, not the other way around?
OpenAI: “We apologize for the confusion of the previous communication. Even past November 29th,
Daybreak Blue users will have a separate option to opt out of Daybreak-enabled sessions to improve models. Given the advanced capabilities made available through this program, interactions flagged for safety review may still be used for safety purposes like improving our protections against these capabilities being used for harm. We will provide more information about how this system works closer to November 29.”
5
3
17
2,850
Costin Raiu retweeted
“Alignment for security? Is this a joke? Are you a child?”
Truly amazing work by @sherrod_im
23
41
252
12,200
Costin Raiu retweeted
Absolutely insane decode numbers on 2x RTX PRO 6000s with GLM 5.3 Flash on TensorFold. Haven't even optimized it really... faster than API I think.
This is with power capped at 400w per card.
45
7
266
31,889
Costin Raiu retweeted
Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Read more: chainalysis.com/blog/binance…
250
820
4,811
945,659
New misalignment "incident" involving Anthropic Claude Code extension: doublepulsar.com/anthropic-h…
3
3
11
2,823
Heads-up: New round of Apple Threat Notifications is going out right now, distinct from the August wave and tied to new attacks!
Apple’s notice:
“Today’s notification is being sent to targeted users in 99 countries, and to date we have notified users in over 150 countries in total. The extreme cost, sophistication, and worldwide nature of mercenary spyware attacks make them some of the most advanced digital threats in existence today. As a result, Apple does not attribute the attacks or the notice you’re receiving to any specific attackers or geographical regions.”
Received one and need help? DM me, happy to assist.
10
85
382
96,756