#bitcoin #æternity #crypto #blockchain #crowdfunding 🦄 social https://nitter.cf/t.co/7vS0uOzXjH æpps
Liechtenstein
Joined December 2008
- Tweets1.5K
- Following1.4K
- Followers3K
- Likes1.5K
Yæni retweeted
Reading the reconstructed bytecode of the Binance EIP-7702 sweeper (`0x63e8...6fae`) is wild.
This wasn't a generic drainer. It was custom-engineered for Binance 14's architecture:
- Leaves exactly 1 ether behind (`bal - 1 ether`) when sweeping ETH so Binance's automated hot wallet queue wouldn't error on gas and trip alarms.
- Uses raw `staticcall` + `continue` loops with custom error codes (`SweepItemFailed`) so one bricked or blacklisted ERC-20 wouldn't revert the $6B batch.
- Includes a custom `callExecute` function to impersonate Binance 14 as controller of an external vault holding $823M in USDC.
They leave a comment: "robberies could be prevented if getaway cars were slower."
You can't fully blame EIP-7702, but it sped up the attack. Without 7702, draining 64 tokens plus an external $823M vault from a live exchange hot wallet meant fighting moving nonces across 70+ transactions. Defense systems would've killed it after tx #3.
With 7702, Lazarus sprayed 50 consecutive nonces in one type-4 payload, turned an EOA into a custom proxy, and atomically swept billions in a single block.
Ethereum core devs built the ultimate getaway car. Surgical state-sponsored engineering.
This could be etched onchain:
`if (bal > 1 ether) { to.call{value: bal - 1 ether}(""); }`
The Binance $5.6B drain is a masterclass in modern EVM exploitation.
It wasn't a complex logic bug. It was an EIP-7702 delegation hijack:
1. Setup: Attacker funds 0x7c86 via Tornado Cash, deploys a sweep contract (0x63e8), and runs three live dry-runs on external wallets.
2. Execution: Attacker submits an EIP-7702 batch with 50 pre-signed authorizations (nonce n to n+49) to hit Binance 14's moving nonce window.
3. One authorization hits. Instantly, Binance 14 (an EOA) is reprogrammed to run the attacker's contract bytecode.
4. Execution looks totally organic: Binance 14 sweeps itself clean. Internal threshold alerts don't trigger because, from the nodes' perspective, the hot wallet is just executing its own transaction.
5. Binance 16 immediately auto-refills 28,000 ETH due to automated treasury rebalance scripts, feeding the exploit loop.
The cold truth: you cannot forge an EIP-7702 delegation list.
For this to execute, the attacker already held the raw private key or unconstrained signing access to Binance 14's HSM/KMS.
But hey, 5.64 billion drained across ETH, BTC, and Tron. 2.54 billion frozen by Tether, Circle, Ripple, and World Liberty within hours.
Code is law until the stablecoin admin keys log in.
Binance got bailed out by the very centralized choke points the cypherpunks warned you about.
Hardware wallets leak your home address.
Centralized exchanges leak the keys to the kingdom.
Self-custody on native, non-delegated chains remains the only honest baseline.
At least you know what to avoid.
Readers added context they thought people might want to know
The quoted comment appears only in an AI-reconstructed source (explicitly labeled not original) uploaded to explorers; no source comments exist in deployed bytecode, and core features match independent decompilations/on-chain data.
etherscan.io/address/0x63e8…
gist.wavey.info/Ta3FgAxastgj42…
x.com/thearsondragon…
Yæni retweeted
So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
Yæni retweeted
We were able to fine tune an open weight model (Qwen3.5-9B) on proprietary internal data at @coinbase, and it out performed frontier models, at much lower cost and speed, for a specialized task (fraud prevention in this case).
I think we'll see more of this pattern inside companies. The frontier models are amazing generalists. But increasingly you'll see specialist models out perform on more narrow tasks, either working on teams, or by themselves.
We're making it easy to fine tune models internally for our employees. We even have a skill for it in our internal harness that makes it easy to spin these up and start training them:
"/fine-tune-and-serve-llm I want to fine-tune Qwen for payments risk review. help me get started"
I imagine we'll have some backend services that could be replaced entirely by this new architecture.
luckily my CS degree seems still to be useful in the vibe coding age
China published the most uncomfortable paper on vibe coding.
ETH Zurich tested 100 developers in a controlled, commercial-grade vibe coding environment to see who actually succeeds.
The findings are brutal.
The researchers tracked computer science achievement, written communication skills, and general cognitive reasoning.
They wanted to see what actually predicts vibe coding proficiency when you never touch a line of source code yourself.
Two major predictors emerged.
Written communication proficiency mattered. The ability to structure thoughts and articulate intent unambiguously in text directly impacts what the AI builds.
But that wasn't even the main takeaway.
Computer science achievement was a massive, dominant predictor of success.
Even when researchers controlled for general intelligence and reasoning skills, CS background still heavily dictated who built working software and who completely crashed.
In fact, CS knowledge contributed roughly twice the unique predictive variance of writing skills alone.
Why? Because vibe coding isn't about writing code. It’s about debugging logic.
When an AI agent builds a complex application and quietly breaks an edge case under the hood, a non-technical user looks at the glowing UI and assumes it works.
They don't know what questions to ask. They don't know what logic to challenge. They lack the mental models to recognize architectural catastrophe.
You can prompt your way past syntax.
You cannot prompt your way past a fundamental lack of engineering intuition.
The hype told us that learning to code is dead because language is all you need.
The data just proved the opposite.
To truly master the vibe, you still need to understand how the machine thinks.
Yæni retweeted
gained a ton of new insights working in bitcoin red team 🟥 that i wish i could share without vague posting. but this is what i got anon.
- we’re experiencing a massive collision between decades of human open source slop against 2 weeks of kimi k3 (not good)
- everything is broken, bitcoin is burning
- bitcoin is becoming stronger through this
- bitcoin is the obvious first target but the rest of the world will follow shortly
- sometimes old things need to burn so new things can grow on healthy soil
- humans should never code in c (just stop)
- lightning is complicated and is more broken than the average (sorry)
- verification is free. we used to complain about slop PRs. then about slop security audits. if you can’t handle the information overload, stop complaining and use AI to sort through it.
- those projects that started AI audits months ago are in a completely different position than those who didn’t
- projects need their own AI audit pipeline going into the future
- the burden for a developer to keep software safe and secure is pretty stressful and not for everyone. it has become a lot more stressful now.
- unmaintained projects are most probably broken, don’t rely on them. i’d rather one-shot it myself with a modern AI
- multiple concurrent, diverse human approaches have proven to be the best vulnerability search method
- external red teaming will probably have to continue forever
- we’ve basically completed a basic scan of virtually the entirety of bitcoin open source. the low hanging fruit is done.
- we’ve reported a ton of real critical and high vulnerabilities. project maintainers across the board have validated our findings.
- response speed is very different across projects and shows how healthy each project is. i recommend acting fast these days.
- red team etiquette matters. if you don’t disclose responsibly, boast on twitter about your findings on a particular project, or make indications about the nature of particular findings, you’ve disqualified yourself as a serious security researcher. trust is the most important factor in this game. if you lose it, it’s very hard to win it back.
- did i mention that humans should not code in c?
love you all.
Yæni retweeted
Solid case for Erlang and Elixir in blockchain but it reads oddly without a single real chain named.
The obvious one is @aeternity
cc: @noyyy
Blockchain needs speed, resilience, and fault tolerance at scale. Erlang and Elixir deliver all three and then some. Our deep dive makes the case for BEAM in blockchain. 🔗 erlang-solutions.com/blog/er…
Yæni retweeted
aave: yo arbitrum, send back the $71m you get from the hacker, we need it
arbitrum: chill, we’re voting on it, you’ll have it in a few days. defi united, remember?
aave: bet. love that for us
(suddenly, american lawyers show up)
plaintiffs: stop right there. that $71m is ours now
aave: excuse me??
plaintiffs: we have old judgments against north korea. the hacker was lazarus group. lazarus is north korea. therefore the funds belong to north korea. therefore we seize them
aave: wait. do you have proof it was north korea?
plaintiffs: yeah, tweets
aave: …tweets
plaintiffs: and a news article
aave: but even if it was them, holding stolen funds for 5 minutes doesn’t make you the owner??
plaintiffs: yes it does
aave: so if i smash a tiffany’s window, grab a diamond, and a bystander grabs it back from me, your creditor friends can seize the diamond?
plaintiffs: correct
arbitrum: uhh… what are we supposed to do here
plaintiffs: don’t move. everything’s frozen
aave: but the funds belong to my innocent users??
plaintiffs: not our problem
aave: if i lose this, nobody will ever stop a hacker again. why would they? the reward becomes a legal war with the thief’s creditors
plaintiffs: not our problem
aave: and sanctioned states will have an incentive to hack more, since stolen funds can pay off their old debts
plaintiffs: still not our problem
aave: (turns to the judge) your honor, either vacate this now, or make them post a $300m bond. we have days before the entire defi ecosystem cascades
judge: (tbd)
Aave LLC has filed an emergency motion to vacate a restraining notice served on Arbitrum DAO on May 1, 2026 that attempts to seize approximately $71 million in ETH belonging to victims of the April 18 exploit.
A thief does not gain lawful ownership of stolen property simply by taking it, and the law is clear on this. Those assets were recovered to be returned to users victimized in the April 18, 2026 exploit. Freezing them harms the very people this recovery effort is designed to protect.
We’ve asked the court for an expedited hearing and a temporary vacatur, and we are continuing to work alongside the Arbitrum community and DeFi United to make affected users whole.
Yæni retweeted
First (supervised) FSD approval in Europe!
Congratulations to the Tesla team and thank you to the regulatory authorities in the Netherlands for all the hard work required to make this happen.
De toekomst van mobiliteit is aangebroken
FSD Supervised has been approved in the Netherlands 🇳🇱 & will begin rolling out in the country shortly!
Trained on billions of kilometers of real-world driving data, it can drive you almost anywhere under your supervision – from residential roads to city streets & highways
No other vehicle can do this.
We're excited to bring FSD Supervised to more European countries soon
Yæni retweeted
"Recent advancements have been so significant that this year’s opinions are the most optimistic for the “within 10 years” timeframe that we have ever recorded in our series of surveys: half of the respondents felt the likelihood of such a computer within 10 years was “about 50%” or more likely. By coarse-graining all the experts’ responses, one arrives at an average likelihood of between 28% and 49% within 10 years, that is, by roughly 2035"
- Global Risk Institute's 2025 Quantum Threat Timeline (survey of quantum experts)
globalriskinstitute.org/publ…
Yæni retweeted
✨🇨🇳This is BYD's megawatt flash charging. It adds 2 km of range per second and can cover 400 km in just 5 minutes.
Yæni retweeted
Iran is being bombed right now. This isn't a thought experiment anymore.
A father in Tehran just watched missiles hit his city. His family needs to flee. He has savings. He has gold. He has a bank account. He can't use any of it.
Missiles hitting Tehran. Ministry of Intelligence. Ministry of Defense. IRGC headquarters. 24 provinces under attack.
Supreme Leader evacuated. Cell networks down. Supermarkets stripped bare. Gas station lines for blocks.
If you're an Iranian with wealth how do you access it right now?
Gold? Walk through a warzone carrying metal. Get it confiscated at the first checkpoint. 5,000-year store of value. Completely useless to you today.
Silver? Even worse. You'd need a truck to carry your life savings.
Fiat? The rial was already collapsing before the bombs. Banks closed. ATMs offline. Cell networks down so digital payments don't work. Capital controls incoming within hours. Your government decides if you can touch YOUR money — and your government is currently being bombed.
Real estate? Can't move it. Might have a crater in it.
Stocks? Custodial assets held by institutions whose command and control infrastructure is on fire.
Bitcoin: 12 words in your head.
No vault. No bank. No custodian. No weight. No checkpoint can detect it. No government can freeze it. No bomb can destroy it.
Walk across any border with your entire net worth stored in memory. Open a laptop in Türkiye, Dubai, Berlin. Enter 12 words. Your wealth is there. Intact.
No other asset in human history has had this property.
The insight most people miss:
Bitcoin is the first asset where the bearer instrument is knowledge itself.
Gold is an atom. A dollar is paper. A deed is a document. All require physical custody or institutional trust.
Bitcoin is information. The first time in 10,000 years of commerce that wealth can exist as pure thought weightless, borderless, indestructible.
Every monetary system requires trust in institutions. What happens when those institutions are being struck by precision munitions?
Bitcoin's institution is mathematics. Distributed across 100+ countries. No building to bomb. No server to destroy. No leader to evacuate.
SHA-256 doesn't care about geopolitics.
Right now an Iranian with Bitcoin can send value to family in Türkiye in 10 minutes.
An Iranian with gold is trapped. An Iranian with rials is watching their purchasing power evaporate with no banking system to access what's left.
Bitcoin wins because it's the only money that works when everything else breaks.
The strongest bull case for Bitcoin isn't on a chart. It's on the news. Right now.