Ledger marketing has the audacity to lecture users on self-custody in 2026: "If something goes wrong, you may not be able to get your assets out." Meanwhile: - Leaked 270,000 users' home addresses to physical home-invaders - Shipped closed-source firmware capable of exporting private key shards to the cloud - Built a tiny touchscreen smartphone with Bluetooth and called it cold storage At least when a CEX is hacked, the robber doesn't have directions to my front door.
BTCPay security advisory update: - Targeted versions: 2.4.1 (July 2026) and older - Attack vector: automated sweeps on unpatched instances - Advice: keep your server updated The fundamental flaw is storing spend keys on self-hosted merchant servers. Expecting e-commerce merchants to act as 24/7 DevOps engineers, patching security releases within weeks, is broken architecture. If a vulnerable VPS empties a hot wallet, the vulnerability isn't just the code version—it's the decision to store signing keys on the server. Still recommending https://t.co/vAXqJ9KlFF for normal merchants if you don’t have a full-time op running it.
CZ officially thanks the FBI, USSS, and IRS for preventing a market crash: "Many crypto bros may not realize a lot of the 'why Bitcoin didn't drop more?' credit goes to them." We started with Satoshi's whitepaper on peer-to-peer electronic cash without trusted intermediaries. We ended up with the founder of the biggest exchange crediting the US Department of Justice and the Federal Bureau of Investigation for keeping the BTC floor intact. Satoshi would never have thought of this 18 years ago.
JP (THORChain founder) stated this seems to be @THORChain’s ultimate test. No PR spin. No compliance excuses. The founder who stepped away years ago drew the red line: withstand the nation-state pressure test or admit the cypherpunk thesis was a marketing LARP and shut it down. hold the line, it means a lot to many people.
Factual timeline of today's @THORChain events: - FBI, USSS, and IRS-CI published an advisory requesting DeFi protocols, THORSwap, and RPC operators to block Lazarus-linked addresses. - Ethereum observed a block reorg; THORChain recorded an issue where a 10 ETH deposit was double-refunded. - Network emergency pause was triggered. - Trading is currently halted across 12 of 13 supported chains on the interface. - so far on official frontend, still 9 chains halted. - No official statement on X yet.
Tether and Circle only have a blacklist function. Synthetix has a “transferFrom anyone’s wallet without approval” admin backdoor. They didn’t just freeze the 8.41M SNX—the protocolDAO forcibly pulled the tokens from the hacker’s address into their multisig. Saying “fuck Kim Jong Un” while proving SNX holders don’t custody their tokens is peak Web3. “Not your keys, not your crypto”—unless you hold SNX, where protocolDAO can remote-confiscate your balance anytime. Lazarus spent $0.92 in gas to steal it; Synthetix used one multisig call to show decentralization was an illusion. I’m confused about the real crypto ethos.
Aave is rushing to set LTV to 0 across USDT, USDC, and major alts because they know exactly what Lazarus would do next: deposit $2B in soon-to-be-frozen stablecoins as collateral, borrow out all clean native ETH and WBTC, and leave the lending pools holding the unfreezable bad debt. Money Legos turning into emergency lockdown mode real quick. "Permissionless finance" until an APT group steals billions and the top lending protocol has to turn off collateralization for half the market via emergency multisig. Setting LTV to zero is smart risk management, but it also proves once again that DeFi only works when everyone behaves.
Draining $370 million in native ETH and 63 separate ERC-20 tokens in a single atomic transaction. Total gas cost? $0.92. - Zero `approve` calls—executing straight `transfer()` inside the hot wallet's own context. - `staticcall` + `continue` error isolation so a single blacklisted token doesn't brick the whole $6B batch. - Leaves exactly 1 ETH behind so hot wallet queues don't error out early. - All executed in one block for less than a buck. State-sponsored engineering makes retail smart contract optimization look like amateur hour. Lazarus wrote cleaner, more gas-efficient routing code in their sweeper contract than 99% of DeFi protocols on CoinMarketCap. Breathtaking efficiency.
It’s only going to get bigger. $1.5B was the ceiling yesterday; $6.3B is the ceiling today. Crypto liquidity is centralized into few giant honeypots, while the attack surface remains a single DevOps engineer’s laptop at home. We spent 10 years adding protocol complexity, EIP AA, and cross-chain wrappers, but the adversary is a state-sponsored APT unit with infinite patience and resources. When a nation-state can net $3B+ in liquid native crypto from one remote worker’s compromise, $6B is the new baseline. Next cycle will have an $11-figure post-mortem; $10B is already queuing up.