SuperfluousSecurity retweeted
STOP ALLOWING EMPLOYEES TO TREAT THEIR LAPTOPS LIKE AN ALL YOU CAN EAT BUFFET AND LOCK DOWN YOUR ENTRY POINTS.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
SuperfluousSecurity retweeted
🚨 BREAKING: 281 people were arrested in a massive Florida sex crimes and human trafficking sting—including 13 Disney employees, 4 Universal workers, and a youth coach.
One Disney worker was literally cuffed in his uniform!
What is going on at Disney?! Protect the children! 🇺🇸⚠️
SuperfluousSecurity retweeted
Reminder to check your kids’ Halloween candy for improperly disclosed CVEs this year.
SuperfluousSecurity retweeted
BlueChip. Built in America.
America made the first electronic computer to win a war.
Now we depend on our greatest adversaries to build the computers that run our economy and defend our nation.
Today, we bring it home.
SuperfluousSecurity retweeted
'Biscuit' the dog is latest dead felon to get their voting rights back from Virginia Gov. Spanberger, confused owner says trib.al/vnsHC6A
SuperfluousSecurity retweeted
BREAKING: 44 members of Congress, led by @RepMaryMiller, have signed onto a letter DEMANDING that the national census ONLY count American CITIZENS and NOT illegal aliens.
This 100% needs to happen.
Illegal aliens are not Americans. Counting them dilutes the voice of the American people.
This is how Democrats cheat
SuperfluousSecurity retweeted
claude code just traced the $5.57 billion binance hack to an address inside binance and a relay node in pyongyang. this wasn't a hack. and binance hasn't said one word about it
yesterday i posted how grok bot pulled my $107,000 out of binance 12 minutes before the freeze. 125k people saw it and everyone asked the same thing. who did this
binance won't tell you. so at 1am i gave claude code one prompt and the public on-chain data, with no api keys and no insider access
1:04am. claude pulls 47,832 transactions across eth, btc and tron and finds 47 wallets in one attacker cluster
1:11am. the terminal goes red. "match found"
the wallet that paid the attacker's gas was funded 48 hours before the hack. first tornado cash, then one 0.001 eth test transaction from an address tagged binance internal deployer. binance's own deployer paid for the attacker's gas two days early
1:17am. claude replays the drain. binance 14 first, $2.13 billion. hot wallet 34 second, $780 million. then the reserve pools, in the exact order of binance's internal balance registry. that list isn't public. someone handed it over
the drain also started 79 seconds before a scheduled key rotation, so whoever did this knew the schedule
1:24am. claude follows the exploit contract back to its source. three separate signals point to the same node in pyongyang
bytecode matches the bybit hack at 98.4%. claude's attribution is lazarus group with 97.3% confidence
so ask yourself why binance hasn't explained how north korea knew its internal registry and its key rotation schedule
claude thinks someone inside gave lazarus the keys and the map, and lazarus walked in
every claim is marked confirmed or inferred and comes with a tx hash. claude refused to name the insider
what i did before sunrise:
> sent the evidence package to FBI IC3
> flagged all 51 attacker wallets to the exchanges
> 2 deposit addresses frozen by morning. $60 million that isn't making it to north korea
my wife found me at 3am again. she looked at the red dot on the globe and asked if that was north korea. i said yes. she didn't go back to sleep either
if your money is on an exchange, all it takes is one person on the inside
the exact prompt that did all of this is in the comments. it's free. run it before the next one hits
SuperfluousSecurity retweeted
Gotta respect the game
Over 6 billion compromised and surprise! No fancy memory corruption 0days, no bot agentic storms, no spooky Chinese LLMs, just straight old fashioned persistence, determination, and recycled tactics executed with better timing and operational planning.
SuperfluousSecurity retweeted
Welcome to Virginia, where you need a government-issued photo ID to buy a pack of cigarettes, but not to vote for US Senator.
Effective 10/1/26 - Virginia Code § 4.1-359, tobacco retailers are required to verify a purchaser’s age using government-issued photo identification.
But under Virginia Code § 24.2-643(B), a registered voter who does not present an acceptable form of identification may sign an ID Confirmation Statement and cast a full regular (non provisional) ballot.
Virginia requires government-issued photo identification to purchase cigarettes, but allows registered voters to cast ballots without presenting any identification at all because requiring ID to vote is racist but requiring photo ID to buy smokes is not racist.
Apparently, buying a pack of Marlboros requires more documentary proof than electing the people who govern Virginia and the Federal Government.
Make that make sense.
SuperfluousSecurity retweeted
🚨Tusk Ready To Kill His Own People🚨
Polish PM @donaldtusk has staged a coup d'etat by taking over, with riot police, the Constitutional Tribunal. He gave orders to the police that the police should be in possession of "submachine guns, weapon storage boxes, kevlar helmets, bulletproof vests, high-visibility vests"& "smoothbore firearms."
Tusk is happy to kill his own people. The EU is of course, that important.
@grok translated the letter.
Deputy Commander-in-Chief of the Police
GS-o- 3026/26/DKr
Warsaw, 23 October 2026
VERY URGENT!
To: Provincial Police Commanders (all)
Capital Police Commander
Dear Commanders,
In view of the operational situation in the country, I order that, from 2 November 2026 (from the first shift of duty) to 8 November 2026 (until the end of the third shift of duty inclusive), forces from Police Prevention Units and independent Police Prevention Subunits serving as part of the central reserve forces of the Commander-in-Chief of the Police be kept in full readiness for immediate deployment within the area of their parent unit, in accordance with the duty schedule for November 2026.
The deployment order will be issued by the Operations Centre of the Commander-in-Chief of the Police.
Prevention platoons will deploy in training uniform, equipped with individual short firearms, personal protective equipment, means of direct coercion (including backpack-mounted pepper spray), smoothbore firearms with non-penetrating ammunition, flashlights, high-visibility vests marked “POLICJA”, as well as standard transport and communication assets. In addition, prevention platoons are to be equipped with submachine guns, weapon storage boxes, kevlar helmets, bulletproof vests, high-visibility vests, body-worn cameras, thermal-imaging, night-vision and photo-video equipment held by the unit, and one “Zapora” set per platoon. Furthermore, each prevention platoon is to be equipped with the maximum number of rapid-response vans and marked pick-up vehicles.
The commander of a prevention platoon should have weapon storage boxes, spare batteries for radiotelephones and chargers for them. Drivers are to be equipped with “fleet” fuel cards.
Police officers on duty are to be provided with the opportunity to complete local professional development training.
In the indicated period, I exclude from duty within the central reserve forces of the Commander-in-Chief of the Police the subunits from the Police Prevention Unit in Olsztyn.
Yours sincerely,
nadinsp. dr Tomasz MICHULKA
(Chief Superintendent Dr Tomasz Michulka)
Thank @KaziSmolinski
SuperfluousSecurity retweeted
‼️ French lawmakers voted for an internet traffic tax that the makers of VLC say would cost them more than €1M a year.
Content providers would pay €0.055 for every gigabyte sent to French users, as counted by ISPs. Its Socialist authors expect €10B a year.
The government opposed it, warning that about half the bill would fall on smaller providers, many of them French.
It passed 11 votes to 10, with 35 of 577 deputies present.
SuperfluousSecurity retweeted
PHP2Shell update 🚀
13 → 56 perfiles.
5 → 30 con RCE.
Gracias a las aportaciones de la comunidad por ampliar la colección. Nuevos: stage-3 vessel 8.5.0–8.5.10, Debian 13/apxs2 y nginx+PHP-FPM.
github.com/devploit/php2shel…
SuperfluousSecurity retweeted
Mysterious ways.
@DataRepublican told me I could use the Census Bureau to geolocate addresses. So I built that. Then she went and worked on her super secret DOGE-at-the-Pentagon job and went quiet. Then Nick Shirley. While she was quiet, I started ingesting the Medicaid and DOT data, and geolocating it. You can see the results here. grumpytechbro.com/fun/ I did the 990 addresses too.
The Chinese Progressive Association, the Center for Empowered Politics, and the CEP Education Fund share a building. From 2020 through 2022 they are the only three filers on one San Francisco pin. In 2023 and 2024 they move to Oakland together.
New Venture Fund, Sixteen Thirty Fund, Hopewell Fund, Windward Fund, and the North Fund share one Washington pin. The names do not mention each other.
Different paperwork, same door. Legally different people. Yeah, right.
That is not even counting the nonprofit c3 with the political c4. That is just how the NGO world works, because a political c4 has to pay taxes, so you park the $ in the c3.
I wouldn't have built the Sankey that helped connect me with Data if my mom wasn't in the hospital. I wouldn't have had this much time obsessing on the geolocation if Data hadn't gotten sucked into the DoW. Now I have a big pile of geolocated orgs I'm using to chase down fraud.
Destiny. Mysterious ways. – at Oregon, USA
SuperfluousSecurity retweeted
🇫🇷 FRANCE HAS LOOKED AT THE INTERNET AND DECIDED IT STILL WASN’T TAXED ENOUGH
French lawmakers approved an amendment that would charge content providers €0.055 for EVERY gigabyte of data they send to users in France.
Google, Meta, Amazon, Netflix and Akamai are explicitly among the main targets. The vote passed 11–10, despite opposition from the government and the budget rapporteur.
At that rate, a 150 GB game represents €8.25 in tax. The proposal’s authors think it could raise around €10 billion a year.
In theory, the companies pay it. In practice, those costs usually have a funny way of ending up in higher prices for users.
Soon they’ll figure out how to tax the air you breathe.
Source: RTL / Writer: Sol
SuperfluousSecurity retweeted
🚨 PSA for anyone running a Linux server, node, or relay
CVE-2026-98432 is a critical Linux kernel bug (CVSS 9.8). Someone on the internet can send crafted TCP packets and take over your machine. No login needed.
Ubuntu and Red Hat haven't shipped a fixed kernel yet. Debian, SUSE, Oracle and Amazon have.
What to do today:
1. Check your kernel: uname -r
Fixed versions: 6.1.190+, 6.6.159+, 6.12.113+, 6.18.56+, 7.2.10+ or 7.3+. Below that, you're exposed.
2. If your distro has a fix, update and reboot.
3. If not, block the attack. It needs TCP packets with "IP options," which normal traffic never uses. One nftables rule drops them. Log what gets dropped so you can see if someone's probing you.
4. Turn off MPTCP unless you need it:
sysctl -w net.mptcp.enabled=0
Programs built with Go 1.24+ use MPTCP automatically, and that's how the known exploit gets in.
5. Make it survive a reboot, and check it still works after one.
If you run a Bitcoin node, a Lightning node or a Nostr relay, your machine is on the internet by design. Do this today.
Self-hosting is freedom. Patching is part of the job. 🛡️
SuperfluousSecurity retweeted
Polish MEP Dominik Tarczyński is explaining what is happening right now at Poland’s Constitutional Tribunal, calling it nothing less than a COUP D’ÉTAT!
“In Poland, we have a liberal-left government led by Donald Tusk, who is the Prime Minister. What is happening right now with the Constitutional Tribunal is that they want to take it over and fill it with their own people.
Why? Because they want to get rid of the Polish currency, bring us into the eurozone, and eliminate our secure borders. They are being pushed by the Germans, who want to spread the burden of illegal migration and send migrants to Poland.
First of all, the Polish złoty is our constitutionally protected currency. They have to change the Constitution to replace it, and without the Constitutional Tribunal, they cannot do that.
So, number one, they want to get rid of our currency and force us to adopt the euro and join the eurozone. Then they want to take our gold reserves, the largest in the European Union, to Frankfurt, to the European Central Bank, which is a German-based institution.
They also want to open our borders. And they want to make sure that when they lose the next elections, which are coming next year, the Constitutional Tribunal will be unable to do anything to stop their actions or reverse what they have done.
There are many more reasons, but I want you to understand one thing: they are under German influence. They are globalists, and we are fighting not just for Poland, but for Europe.
Be like Poland. Be strong. Our nation is strong, and we are going to win this fight!”
SuperfluousSecurity retweeted
POLOGNE le volcan explose.
Explications
🔥🔥🔥🔥🔥🔥
Ce qui se passe en ce moment à Varsovie n’est pas une guerre entre Polonais. C’est l’éruption finale d’un conflit qui couve depuis des années : celui entre une Cour constitutionnelle polonaise qui défend encore la souveraineté de son pays, et une Europe qui exige que son droit passe toujours au-dessus.
Regardez ça : 👇
Police déployée autour du Tribunal constitutionnel. Le vice-président de la Cour se voit refuser l’entrée. Le président de la République (Nawrocki) interrompt son voyage au Sénégal et rentre d’urgence. L’opposition parle de coup. Le gouvernement Tusk et ses alliés disent qu’ils « restaurent l’État de droit ».
Voici ce qu’il faut comprendre, clairement :
Depuis 2015, l’ancienne majorité conservatrice polonaise a nommé la plupart des juges du Tribunal constitutionnel. Cette Cour a plusieurs fois dit non à la primauté absolue du droit européen sur la Constitution polonaise. Elle a refusé que Bruxelles et la Cour de justice de l’UE puissent défaire les nominations et les règles nationales comme elles l’entendent.
Résultat : la Commission européenne et la Cour de justice de l’UE ont déclaré ce Tribunal « illégitime ». Pas parce qu’il serait corrompu dans le vide, mais parce qu’il refuse de s’effacer devant le droit de l’Union.
Depuis que Donald Tusk est au pouvoir, le gouvernement veut reprendre ou neutraliser cette Cour. Aujourd’hui, on envoie la police, on annonce des suspensions, on bloque les accès. Le message est simple : une Cour constitutionnelle qui ne se soumet pas à la primauté européenne n’a plus le droit d’exister en l’état.
Ce n’est pas un détail technique polonais. C’est le schéma qui se répète : un gouvernement très européiste + Bruxelles d’un côté, une institution nationale qui résiste de l’autre. Et quand la résistance devient trop gênante, on la traite d’illégitime et on la démonte.
Le feu couvait. Là, il explose. 🔥🔥🔥🔥
La question n’est plus seulement « qui contrôle le Tribunal en Pologne ». C’est : jusqu’où l’Europe est prête à aller pour imposer sa primauté, et jusqu’où un pays peut encore dire non sans se faire qualifier de putschiste.
À suivre de très près.
#Pologne #Souveraineté
Shocking scenes in Poland. Police, dispatched by the Tusk government, have forced their way into the independent Constitutional Tribunal. Security personnel guarding the building and the Tribunal’s documents have been removed. The Vice-President of the Tribunal is being denied entry to the premises. This is a violation of all democratic principles.
SuperfluousSecurity retweeted
In 1952, an English teacher named Cecil Dormand secretly paid for a dirt-poor 11-year-old to take a drama course.
He never told him and the boy didn’t find out until decades later.
By then, he was a knight, that little boy’s name was Patrick Stewart.
He was born into a poor family in Mirfield, a small mill town in Yorkshire and his father came home from World War II a violent man, and he was violent toward Patrick’s mother.
Young Patrick learned exactly when to step between his father’s fist and his mother.
An English teacher put a copy of Shakespeare in his hand and told him to get up and perform.
He never stopped and left school at 15.
By 19 he was completely bald... most agencies told him he'd never make it because of that.
In 1987, the LA Times called him an “unknown British Shakespearean actor” when he was cast as Captain Picard.
Then he became one of the most famous faces on Earth.
You’ve probably heard that part.
Here’s the part you haven’t:
He spent decades as a patron of Refuge, sheltering women and children from domestic violence.
But he never stopped trying to understand his father.
He dug up a 1940 newspaper clipping that said his dad had come home with severe shell shock.
He went to France and walked the ground where his father’s unit was pinned down under bombing for hours.
He learned his father had PTSD, and nobody ever helped him.
So Patrick became an ambassador for Combat Stress, a charity that helps veterans.
In 2013, a young woman at a Texas convention told him she was a survivor of domestic violence.
He asked, “My dear, are you okay?”
Then he hopped off the stage, held her, and told her: “You never have to go through that again, you’re safe now.”
At Dragon Con, a Make-A-Wish girl dressed as Spock came to meet him.
2,000 people were waiting for him to speak... he sat down and talked with her for 15 minutes, making all of them wait.
He told her that since they were friends now, whenever she saw him on screen she could wave and say, “Hello Patrick.”
After 9/11, he felt helpless, so he brought his one-man A Christmas Carol back to Broadway for a full week of charity shows.
He played every character himself and donated every cent.
In 2019 he did it again, and every dollar went to feeding hungry New Yorkers.
In 2017, he fostered a pit bull named Ginger, who had been rescued from a dogfighting ring.
She was his first dog in more than 50 years.
He couldn’t bring her home to England, so he found her a family.
Then he kept fostering more.
When he said he was done with Star Trek so many people told him the show had gotten them through the hardest times of their lives.
So he wanted to see if Picard could do it one more time.
Rest in Peace, Sir Patrick 🖖






































