Digital Security Engineer, CTO @cardhoc, Telecommunication, InfoSec, Crypto, Electronic, Blockchain, Fintech, AccessCtrl
Paris, France
Joined December 2009
- Tweets13.2K
- Following3.1K
- Followers2.6K
- Likes50.9K
Pinned Tweet
My personal answer, using a @cryptokeepkey, to the digital dollar by the @federalreserve. 😅🤗👨💻
#crypto #blockchain #FED #money #FED #Stablecoin #CBDM
Fed is studying the potential for digital dollar, says governor Brainard (via @Yogita_Khatri5)
theblockcrypto.com/post/5510…
Better than 4 as the private key. 🤣
🚨 BINANCE HACKER JUST LEFT $0.06 IN ETH — WHAT A MOVE! 😂
The address reportedly holding over $2 BILLION in frozen ERC-20 tokens has almost no ETH left.
Here's the interesting part:
💀 The hacker drained the ETH from the compromised address, leaving just 0.000028 ETH (~$0.06) for gas fees.
Now comes the tricky part:
• Without ETH, the address can't execute transactions.
• Anyone trying to deposit ETH to cover gas risks having it immediately swept away by the hacker.
• Recovering the frozen tokens becomes a serious challenge.
Basically, the hacker left billions in tokens sitting there but made moving them extremely difficult.
What a calculated move! 😂🔥
#Binance #CryptoHack #Ethereum #BlockchainSecurity
🔹Les prix sont libres en France.
🔹L'Etat taxe l'essence à 85%.
🔹Avec quel argent va-t-on nationaler Total? Vous voyez combien coûte la moitié de la capitalisation.
Mais pourquoi Total n’est-il pas contraint de baisser les prix à la pompe ? C’est cette inertie politique qui soulève le dégoût et la colère populaire, tandis que les faillites d’entreprises s’accélèrent. Nationaliser Total avec des stratégies européennes serait il la bonne solution si rien ne bouge ? #totalEnergies
Readers added context they thought people might want to know
TotalEnergies plafonne volontairement les prix depuis mars 2026 (seul grand distributeur à le faire). Baisse à 2,15 € dès le 31 oct. dans les stations Access. Bénéfices de l'entreprise surtout dus aux marchés mondiaux.
x.com/TotalEnergiesP…
"Nous luttons pour un avenir meilleur. Et nous luttons aussi contre l'extrême droite qui ose vouloir un avenir meilleur."
Ah oui c'est fort !
Antoine retweeted
So, the French socialists, and Parliament members just voted a tax, that they don’t understand, which would cost VideoLAN more than 1 million euro per year.
They are probably the most clueless politician on Earth? And they claim they want technological sovereignty…
@LaurentLhardit
#PJL2027 Adopté par l'Assemblée nationale : la "taxe assise sur les flux de données numériques émises par les fournisseurs de contenu et acquittée par ces derniers"
Selon les députés PS, "au taux de 0,055 € par giga, un rendement de 10Md€ est attendu".
assemblee-nationale.fr/dyn/1…
Antoine retweeted
Singapore Police Say Ledger crypto Wallets Sold at Local Retailers Contained Malicious Hardware Implants
Singapore police said on October 28 that some Ledger cryptocurrency hardware wallets purchased from local retailers contained malicious hardware implants capable of stealing users' recovery phrases or private keys. At least two cases have been reported since September 10, resulting in losses of approximately S$3.5 million ($2.7 million). Ledger, a leading French hardware wallet manufacturer, is reviewing the affected cases, while police investigations remain ongoing.
Antoine retweeted
🚨 We're releasing BTPay Server 2.4.7 an emergency update fixing one critical and several medium-severity security vulnerabilities brought to our attention through @Anthropic's frontier OSS scanner.
We recommend that you update your BTCPay Server as soon as possible.
Antoine retweeted
❗️ Lenovo's ThinkPlus FU100 fingerprint stick was marketed as "hardware encrypted" with AES-256, but inside was an ordinary SD card with nothing encrypted.
The fingerprint only switched on the USB link, researcher Xusheng Li found.
Lenovo's stopgap fix covered the card in epoxy.
Antoine retweeted
Binance is getting all the attention, but today brought multiple security incidents.
For those interested in the @Polymarket hack, Coinspect's monitoring captured the replacement of a legitimate third-party script with a wallet drainer.
Here are the diffs and timeline. 👇
Antoine retweeted
🚨995 Polymarket accounts just got drained through Polymarket's own website. Let me explain how, because this one should scare everyone in crypto.
No fake link. No shady airdrop. These people were on the real Polymarket dot com on Thursday.
Polymarket's site loaded a script from DebugBear, a tool whose only job is measuring how fast the page loads. Somebody poisoned it.
Once it was running in your browser, it grabbed your logged-in trading session and started dumping every open position you had, first at 3% under market, then at half price, then at the lowest price possible. Then it swapped the whole balance into POL and shipped it to the attacker. Stablecoins can be frozen. POL can't.
It even reported back after every hit. Your wallet, your country, your portfolio size, whether the transfer went through. All of it sent home through DebugBear's own data endpoints.
The attacker's wallet went from empty to $2M in about 45 minutes. Conor Grogan's final count was $2.65M.
One trader said he lost $800K and watched every position get sold. His friend got hit for $600K.
Polymarket flipped the exchange to cancel-only, paused the relayer and says everyone will be made whole. Credit where it's due.
But this is the third time this year. About $700K in May. About $3M in June, through a hacked third-party script, same as now.
I've been phished. I've been drained. Stay in crypto long enough and it happens to you. But the people on Thursday did nothing wrong. They opened the right website.
Not one of these three hacks touched a smart contract. We spent ten years making the blockchain unbreakable and then let a page speed tracker sit right next to people's money.
Antoine retweeted
The Binance $5.6B drain is a masterclass in modern EVM exploitation.
It wasn't a complex logic bug. It was an EIP-7702 delegation hijack:
1. Setup: Attacker funds 0x7c86 via Tornado Cash, deploys a sweep contract (0x63e8), and runs three live dry-runs on external wallets.
2. Execution: Attacker submits an EIP-7702 batch with 50 pre-signed authorizations (nonce n to n+49) to hit Binance 14's moving nonce window.
3. One authorization hits. Instantly, Binance 14 (an EOA) is reprogrammed to run the attacker's contract bytecode.
4. Execution looks totally organic: Binance 14 sweeps itself clean. Internal threshold alerts don't trigger because, from the nodes' perspective, the hot wallet is just executing its own transaction.
5. Binance 16 immediately auto-refills 28,000 ETH due to automated treasury rebalance scripts, feeding the exploit loop.
The cold truth: you cannot forge an EIP-7702 delegation list.
For this to execute, the attacker already held the raw private key or unconstrained signing access to Binance 14's HSM/KMS.
But hey, 5.64 billion drained across ETH, BTC, and Tron. 2.54 billion frozen by Tether, Circle, Ripple, and World Liberty within hours.
Code is law until the stablecoin admin keys log in.
Binance got bailed out by the very centralized choke points the cypherpunks warned you about.
Hardware wallets leak your home address.
Centralized exchanges leak the keys to the kingdom.
Self-custody on native, non-delegated chains remains the only honest baseline.
At least you know what to avoid.
Antoine retweeted
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
Antoine retweeted
🚨 CRITICAL - Linux Kernel IPv4 TCP Stack Use-After-Free (CVE-2026-98432)
A CVSS 9.8 vulnerability in the Linux kernel IPv4 networking subsystem allows remote attackers to trigger a Use-After-Free (UAF) in ip_options_build(). The flaw stems from tcp_v4_syn_recv_sock() transferring ireq->ireq_opt ownership without copying it, enabling concurrent SYN retransmits to free the child socket options via kfree() before SYNACK processing completes.
👉 Affected: Linux kernel across Ubuntu releases (26.10, 26.04 LTS, 24.04 LTS, 22.04 LTS, 20.04 LTS) | Apply upstream stable patches replacing kfree() with kfree_rcu() or update distro packages as fixes land
Antoine retweeted
CISA ordered US federal agencies to patch a high-severity Linux kernel privilege escalation bug that attackers are chaining with the PHP2Shell flaws in the wild.
bleepingcomputer.com/news/se…
