terminally online, monitoring the situation @iansintel
onchain
Joined May 2015
- Tweets14K
- Following3.4K
- Followers10K
- Likes13.1K
🫡
Over the past two weeks iPhones have been publicly jailbroken more than once, and most people treated it as a bit of tech drama and scrolled on. I want to use it to talk about something that matters more to people in crypto: wiping an old iPhone, putting it in airplane mode and using it only to hold your seed phrase is not as safe as most people think. If it's an iPhone 11 or older, the problem lives in the chip, and no iOS update will fix it.
Quick recap of what happened. On October 16 at Hexacon in Paris, the Calif team jailbroke an iPhone 18 Pro running iOS 27.0.1 live on stage. The jailbreak survived a reboot, they had root, and they got past MIE, the hardware memory protection Apple added starting with the A19 specifically to stop spyware. In the same session they showed attacks that get in through a single click in Signal or iMessage. A week later, on the day iPhone Duo went on sale, they jailbroke that too. Apple shipped iOS 27.2 on October 26, and Calif says most of the bugs they used are now fixed. Then on October 30, Ikotas Labs, the Japanese team that just won Pwn2Own, posted that they had jailbroken 27.2 as well. Their video only shows swapped icons and the version number, though, so I'm treating it as unconfirmed for now.
For most people on a recent phone who keep it updated, none of this is a reason to panic. Before chains like these get patched, they usually sit with spyware vendors and forensics companies, and the odds of an ordinary person being specifically targeted are low. Update to 27.2 and you've done what you need to.
The people I actually want to warn are those using an old iPhone as a cold wallet. iPhone 4S through iPhone X have checkm8 in the BootROM, made public in 2019. This June, usbliter8 went public, covering the iPhone XS, XR, the 11 series and the 2nd-gen SE. The BootROM is boot code burned into the chip at the factory. Apple can't patch it with a software update, so these devices will carry the hole for as long as they exist. Exploiting it doesn't need a network either. Once someone has your phone in hand, they put it into DFU mode and plug in a custom USB board (the public research used a $5 Raspberry Pi Pico 2), and they can run their own code before iOS even boots. Airplane mode makes no difference here.
I don't want to overstate it. On models like the XS and 11, the BootROM bug alone won't hand over your seed phrase, because your passcode and the Secure Enclave are still in the way. The trouble is that these remaining layers are exactly where people tend to cut corners: a 6-digit passcode, an iOS version years out of date with a pile of public n-days, a short wallet app password. On some older models, forensic tools use bugs like this to brute-force the passcode. And if your wallet app encrypts the seed with nothing but a short password, once that encrypted file is copied off, the attacker can take it home and keep guessing offline, with no attempt limit. Old iOS versions also have a charging port problem. ChoiceJacking, published in 2025, lets a malicious charger pose as a keyboard and approve the data-access prompt for you. Apple only closed that in iOS 18.4.
One more thing about this kind of attack: when you get your phone back, nothing looks off. In security circles it's called an evil maid attack. A hotel room, a security check, lending your phone to someone to charge — any time it's out of your hands for a while, there's an opening. A lot of people only find out their phone was touched after their assets are already gone.
My advice:
1. Check which iPhone holds your seed phrase (Settings → General → About). If it's an iPhone 11 or older, move to a newer model before storing a seed on it.
2. If you've already stored one there, no need to panic. When you get a chance, generate a brand-new seed phrase in an environment you trust and move your assets over. It has to be a whole new seed. A fresh address under the old seed won't help.
3. If your phone has ever been out of your hands for a while, say held for inspection at a border, don't wait. Migrate as in step 2 as soon as you can.
4. Update your daily iPhone to iOS 27.2 (Settings → General → Software Update). If you haven't moved to 27 yet, install at least 26.7.2.
5. Switch to a long alphanumeric passcode (Settings → Face ID & Passcode → Change Passcode → Passcode Options). A 6-digit PIN has only a million possible combinations. Make your wallet app password longer too.
6. Carry your own charger. Don't use public USB ports, random power banks or cables you don't know.
7. If you hold a lot or are likely to be targeted, consider turning on Lockdown Mode (Settings → Privacy & Security → Lockdown Mode). It blocks wired connections while the phone is locked.
8. Any "iOS 27 jailbreak download," or any tutorial asking you to install a certificate or configuration profile, is a scam or malware. Neither Calif nor Ikotas has released any tools.
If you like using an iPhone as a cold wallet, go with a newer model and keep it on the latest iOS. There's no public BootROM exploit for the iPhone 12 or later, and if something does turn up, Apple can still fix it with an update. With really old devices, the risk sits in the chip itself, and updating iOS won't get you around it.
ian retweeted
realizing i might be part of the last pre-singularity generation.
it is so surreal to be in this razor-thin slice of time and humanity that gets to experience both extremes.
i’m 37 years old. i grew up with no computer, no internet, no tv. we played under the sodium street lamps. no phones, just library books. i remember memorizing entries in the encyclopedia britannica, then the 56k modem screech. i’ve gotten to witness this whole arc. a genuinely pre-digital childhood, and now whatever this is becoming.
it’s just so bizarre to hold all those memories and contrast them with the current state. now i speak into a slab of silicon and glass and it manifests code like water flowing down a hill. i commune with this alien intelligence on a daily basis. same head, same lifetime.
i increasingly feel like a three-dimensional being looking at this multidimensional, crystallized artifact of intelligence that is increasingly beyond my comprehension. i can interact with the little slice facing me, but have less and less intuition for the shape of the whole thing.
if i was positioning myself in a replay of the lead-up to what might be the most significant event in modern human history, i’m not sure i would choose any other years. old enough to remember what came before. young enough to have a lot of life left inside whatever comes next.
sama was talking about the excitement and the melancholy. a feeling of something ending. Cheeky Pint
it feels like we’re on the precipice of handing over the torch of intelligence to something nonhuman. it’s an extreme viewpoint, but it feels like we’re hurtling uncontrollably towards this singularity.
it doesn’t feel real. it probably won’t be a singular, definable moment, but a slow-motion event of gradual realization, with occasional shockwaves.
to quote a great scholar of our times.
“not enough people are emotionally prepared for if it’s not a bubble”
ian retweeted
ICE and Trade[XYZ] plan to bring Hyperliquid-based perps to the U.S.
Subject to regulatory approvals, ICE will operate U.S. regulated versions of Trade[XYZ]’s markets, leveraging their expertise as the leading deployer of real-world-asset perps on Hyperliquid.
The new venue will operate separately to ICE’s institutional futures franchise and offer a trading experience designed for retail participation.
Once live, U.S. traders will be able to trade 24/7 across a range of assets spanning the macro complex including:
*Crypto
*Equities
*Indices
*Commodities
*Forex
Read more: spr.ly/6010BHq9X8
Users will access the platform through U.S.-regulated FCMs performing KYC/AML screening, including ICE's joint venture with OKX.
ICE and Trade[XYZ] will seek approvals to launch a new market built on Hyperliquid to operate KYC-compliant perp markets, including regulatory approvals to support leveraged trading.
another good one is to set up a pager system that bypasses your phone's DnD/sleep modes with your gc so that at any time of the day someone can ping members of the group
we use pushover + a telegram bot
a fallback would be to add your friends to your contacts and whitelist them to bypass DnD/sleep mode so they can call you if something is going down
Spending 2-3 hours today on these could save your entire net worth
Accounts
1. Check if your emails have been leaked in a data breach haveibeenpwned.com. Change every leaked password first
2. Use a separate and non public email for CEXes, banks, social media. Don't open links on email
3. Use a password manager like @Bitwarden. Unique password for every account with 2FA and passkeys enabled (save passkeys in Bitwarden)
4. Stop using SMS 2FA. YubiKey or authenticator app only
5. Write down all your backup codes on paper, store it somewhere safe (fireproof and waterproof)
6. Bookmark every exchange and dApp websites. Never open them from Google or Telegram links
Telegram
9. Under Privacy, turn on Two-Step Verification (its a password), use Passkey and set Stars for Messages so random people cannot DM you
10. Check Active Sessions and delete anything you don't recognise
11. Set your phone number to Nobody
12. Never open files people send you, even from friends. Their account could be hacked
13. Ignore any "free to catch up" with Calendly links, you can catch up over Telegram message itself
14. Disable Auto-Download Media (under Data and Storage)
Wallets
15. Seed phrase on paper or metal. Never in a notes app or cloud or Notion
16. Cold wallets for large funds, best to use a multisig with cold wallets (p.s best to offramp more into your bank so you can sleep at night)
17. Split wallets to mitigate single attack vector: small hot wallet for dApps, cold wallet for the rest
19. Revoke old unlimited approvals (revoke.cash/)
Devices (Mac checklist mac.0xosprey.com by @0x_Osprey)
20. FileVault + firewall on, auto login off
21. Auto updates on
22. Delete browser extensions you don't use
23. Separate browser (or device) just for crypto
24. Never run a recruiter's "coding challenge" especially if its something to install
Misc
25. Don't use Zoom or Microsoft teams if you have to take a call
26. Remember you are not a VIP, no journalist is going to want to interview you for your takes nor will companies send you emails / letters to warn you of a compromised account
27. Some of the contacts that you saved on Telegram could be compromised, saving as contact doesn't do anything
28. Take note of some of the trading terminals that you have funds on, if the largest exchange can be compromised what more these smaller ones
29. Write a plan for if you get hacked, and leave one for your family
30. Remember to message @seal_911_bot if you have any emergencies @_SEAL_Org
Stay paranoid.
ian retweeted
TRANSCRIPT:
Hi everyone, firstly, I want to thank you all for the support. Difficult times like these are a great reminder how strong our industry is when we work together.
We are grateful to our partners that acted quickly to freeze the hacked assets; to global law enforcement, who we’re working hand in hand with to seek justice;
But most of all - we are grateful to our users for their patience and understanding.
Rest assured that we are working non-stop to resolve this, to make the users whole, and live up to your trust.
I want to be clear: WE ARE COMMITTED TO COVERING ALL HACKED LOSSES THROUGH OUR COMPANY FUNDS. Your assets are safe.
The good news is that we are recovering stolen assets for users.
Binance has reserved over $6.34B of company funds to cover the stolen assets. $5B of these funds are already held in the exact token assets that were impacted, such as USDC, USDT, BTC, ETH, BNB etc.
I know many of you are still asking the same question: how can Binance actually prove that your assets were not affected?
Let me be direct about the first point. We NEVER use any customer funds, so they are not impacted. What was affected in this incident was Binance's own hot wallet. User assets are held under Binance's established security architecture. The vast majority sit in cold wallets, and are only moved into a hot wallet when a user makes a withdrawal.
One more thing I want to share. Binance has always been built for the long term. Most of what we earn from day-to-day operations is held in crypto assets. We have kept a lot of them in the company, and reinvested them — into the business, and into security. Because we believe in crypto, and in the long-term value of this industry.
That is precisely why we are able to absorb a loss of this size, immediately, with our own money.
We are working on the outstanding amount by buying the token assets through market and OTC channels. We will share more progress as soon as we can.
If you, as a user, are concerned, we encourage you to check funds on your Binance accounts. Wait for our initial Proof of Reserve for public verification, which is targeting Monday. You can reach out to our customer service with any questions.
Next, I want to give you an update on our understanding of the hack itself.
Our tech and security teams are still deep in the investigations of the hack.
This was not carried out by one person. Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
This was a complex attack. The attacker also used a self-destruct mechanism that destroyed tooling and traces as they went, making it more difficult for us to trace and investigate.
The attacker used a known multi-signature protocol EIP-7702, to obtain on-chain execution approval over a hot wallet. That delegation did not pass through our normal approval controls. That’s why we need to pause the withdrawal service to investigate, rebuild, and retest the entire infrastructure system.
So what are we doing now?
First, we are rebuilding the withdrawal service, and we are not switching it back on until it passes rigorous testing. We are very hopeful that users will be able to withdraw prior to our Sunday deadline, which is on track to be within 40 hours.
Second, we are conducting a full security review across the entire company — endpoints, cloud, key management, signing. Everything.
Third, we are completing the purchase of the remaining assets and will verify in our Proof of Reserves. We will be sharing a full Proof Of Reserves report by Monday, and we are hoping to give an initial view of Proof of Reserves before that.
Fourth, we are working with law enforcement, blockchain intelligence firms, token issuers and other exchanges to trace and recover stolen funds. We will do everything within our power to ensure that these bad actors will be held accountable.
Lastly, this is an industry-wide effort, and we are grateful to partners across the ecosystem who have moved quickly to help and support. We will weather this storm. Thank you for the support - and stay safe.
ian retweeted
Spending 2-3 hours today on these could save your entire net worth
Accounts
1. Check if your emails have been leaked in a data breach haveibeenpwned.com. Change every leaked password first
2. Use a separate and non public email for CEXes, banks, social media. Don't open links on email
3. Use a password manager like @Bitwarden. Unique password for every account with 2FA and passkeys enabled (save passkeys in Bitwarden)
4. Stop using SMS 2FA. YubiKey or authenticator app only
5. Write down all your backup codes on paper, store it somewhere safe (fireproof and waterproof)
6. Bookmark every exchange and dApp websites. Never open them from Google or Telegram links
Telegram
9. Under Privacy, turn on Two-Step Verification (its a password), use Passkey and set Stars for Messages so random people cannot DM you
10. Check Active Sessions and delete anything you don't recognise
11. Set your phone number to Nobody
12. Never open files people send you, even from friends. Their account could be hacked
13. Ignore any "free to catch up" with Calendly links, you can catch up over Telegram message itself
14. Disable Auto-Download Media (under Data and Storage)
Wallets
15. Seed phrase on paper or metal. Never in a notes app or cloud or Notion
16. Cold wallets for large funds, best to use a multisig with cold wallets (p.s best to offramp more into your bank so you can sleep at night)
17. Split wallets to mitigate single attack vector: small hot wallet for dApps, cold wallet for the rest
19. Revoke old unlimited approvals (revoke.cash/)
Devices (Mac checklist mac.0xosprey.com by @0x_Osprey)
20. FileVault + firewall on, auto login off
21. Auto updates on
22. Delete browser extensions you don't use
23. Separate browser (or device) just for crypto
24. Never run a recruiter's "coding challenge" especially if its something to install
Misc
25. Don't use Zoom or Microsoft teams if you have to take a call
26. Remember you are not a VIP, no journalist is going to want to interview you for your takes nor will companies send you emails / letters to warn you of a compromised account
27. Some of the contacts that you saved on Telegram could be compromised, saving as contact doesn't do anything
28. Take note of some of the trading terminals that you have funds on, if the largest exchange can be compromised what more these smaller ones
29. Write a plan for if you get hacked, and leave one for your family
30. Remember to message @seal_911_bot if you have any emergencies @_SEAL_Org
Stay paranoid.
ian retweeted
Following the security incident at Binance, Unit’s Guardians are introducing a protocol upgrade to deter attempts to move stolen assets through the protocol and to give incident-related intelligence more time to become available.
Effective immediately, every Unit deposit and withdrawal is subject to a processing delay. The length of the delay may change as the incident response develops.
Existing Guardian screening remains in place, including automated checks using third-party blockchain intelligence, and Guardians may update their screening as new information about the incident becomes available.
Do not attempt to move stolen assets through Unit. Transactions that fail Guardian screening may not reach the consensus required to complete.
Our sympathy goes to all users affected by the Binance incident. We also recognize these delays may disrupt Unit users, but limiting further harm to victims comes first.
These measures reflect the protocol’s current architecture. Responses to any future incident will depend on the protocol’s design and capabilities at that time.
ian retweeted
Investigation update: Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach.
This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it. We are still gathering the facts, and will share more directly as we have them.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe.
We are still on track towards the expected timeline to resume the withdrawal service in 45 hours. Deposits remain unaffected.
The outflows ceased when we paused withdrawal service earlier. We are still working with partners to freeze many of the impacted assets, and have frozen around $3 billion thus far.
We will continue to provide further updates through official Binance channels as more verified information becomes available.
binance hacker has liquidated all its ENA
debank.com/profile/0x7f9dc98…
ian retweeted
User funds are safe.
Binance will cover all hacking losses.
Deposits and withdrawals are temporarily suspended while our team conducts security checks, freezes funds, and works with law enforcement.
We will share a full post-mortem once the investigation is complete. Please rely only on official Binance channels for updates.
ian retweeted
quick ones
1) Binance has enough to withstand 3-4x of current hit and still be largely intact. Very likely they will shrug this off and user funds are very likely safu (but like obviously don’t deposit until they sort out what went wrong)
2) Wintermute obv has exposure to binance, but less than 20% of net equity and I don’t see any disruption to our operations on any time horizon in whatever scenario
ian retweeted
Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers’ RLUSD holdings and we are actively freezing affected funds. We’re coordinating with relevant parties and stand ready to support any investigation and appropriate action to keep users protected.
ian retweeted
We are aware of reports of a potential security issue and we are actively investigating.
Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information. Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.
User Funds SAFU.
