i am not your EL member @labyrinth_alpha
Joined June 2025
- Tweets19.8K
- Following943
- Followers9.3K
- Likes49.8K
gm ☀️ the Binance hack should be a wake up call to everyone that invests in crypto
read the post below and implement as many of these best practices as you can
that’s my goal before putting capital back into the market
stay safe out there
A friendly reminder to take your crypto security seriously.
Start doing these things TODAY:
- Keep your long-term holdings offline.
Consider a hardware wallet or an air-gapped wallet on a dedicated offline device.
If you don't want to buy a hardware wallet, air-gapped storage is an alternative.
- Never use one wallet for everything.
Keep separate wallets for long-term holdings, trading, DeFi, airdrops, and unfamiliar protocols.
@Rabby_io and @phantom are the only wallets I use.
- Don't keep your entire portfolio in one place.
Avoid concentrating all your funds on a single CEX, hot wallet, protocol, or device.
- Don't use public Wi-Fi for crypto activity.
If you work from cafes or coworking spaces, use your phone's personal hotspot instead of connecting to public Wi-Fi networks.
- Protect your seed phrases.
Never store them in screens, cloud storage, emails, or password managers connected to the internet.
If your seed phrase has ever been stored on an internet-connected device - migrate to a fresh wallet NOW!
- Keep secure offline backups.
Store recovery backups somewhere safe, preferably with protection against fire/water and unauthorized access.
I recommend getting a fire-resistant and water-resistant document bag.
- Use a dedicated device for crypto.
Keep your hot wallets and high-value transactions on a separate device.
Don't use it for random downloads, gaming mods, unknown software, or everyday browsing.
- Use a separate browser for wallets.
Keep your wallet browser dedicated to trusted crypto activity.
Avoid unnecessary extensions and random websites.
- Never install cracked software on crypto devices.
Pirated applications, fake installers, and malicious updates can contain wallet-stealing malware.
If you need to run untrusted software, keep it completely isolated from your crypto environment.
- Keep your devices updated.
Update your OS, browser, and wallet software through official sources.
- Remove unnecessary browser extensions.
Even legitimate extensions can become dangerous after a compromised update or ownership change.
Keep only what you absolutely need.
- Stop using Google Search to find crypto websites.
Fake websites and malicious sponsored results can look almost identical to legitimate ones.
Use independently verified official links from bookmarks instead.
- Don't open random links from X or Telegram.
Especially not in the browser where your wallets are installed.
Never!!!
- Secure your CEX accounts.
Use passkeys or hardware security keys where supported.
Enable withdrawal address whitelists and avoid relying on SMS 2FA.
- Consider getting a YubiKey.
A physical security key can help protect your email and exchange accounts against phishing.
Buy only from the official manufacturer sellers.
- Review your Google-connected crypto accounts.
Check which crypto services use Google Sign-In.
Never disconnect your only login method without setting up an alternative first.
- Revoke unnecessary token approvals.
Use @RevokeCash to review and remove permissions you no longer need.
Disconnecting a wallet from a dApp does NOT revoke its token approvals.
- Avoid unlimited token approvals.
Whenever possible, approve only the amount you actually need.
Unlimited allowances can expose much larger balances if a spender is compromised.
- Review Permit2 permissions.
Permit2 signatures can authorize token transfers without a normal on-chain approval transaction.
Review existing allowances and permissions. Some malicious signatures can be exploited long after they're signed.
- Never blindly sign messages.
A signature doesn't need to cost gas to be dangerous.
Never get distracted while signing transactions. Either finish your transactions first or take care of everything else before you start.
Make this a rule.
- Be careful with custom RPC endpoints.
Don't add/delete now unknown RPC URLs.
Use trusted providers and verify network settings independently.
- Understand EIP-7702 authorization risks.
On supported networks, account delegation can grant powerful capabilities to other code.
Never approve an account delegation you don't understand. (That's why Binance was hacked)
- Never copy addresses blindly from transaction history.
Address poisoning attacks can place lookalike addresses in your transaction history.
Verify the full destination address against a trusted source.
- Watch out for clipboard malware.
Malware can replace a copied wallet address with an attacker's address.
Always verify the entire destination address after pasting, preferably on an independent trusted display.
- Verify token contracts and networks.
A familiar ticker or logo doesn't prove a token is legitimate.
Check the contract address and make sure the receiving platform supports the exact asset and network.
- Test large transfers first.
When sending funds to a new destination, start with a small test transaction.
- Ignore unexpected tokens and NFTs.
Random assets appearing in your wallet may contain phishing links or fake reward claims.
Don't interact with them just because they appeared in your balance.
- Don't trust unexpected job offers or collaboration requests.
Fake interviews, partnership offers, and test applications can be used to distribute wallet-stealing malware.
Never run unfamiliar software on your crypto device just to qualify for an opportunity.
- Never run terminal commands you don't understand.
Fake troubleshooting guides, verification pages, and job interviews may ask you to copy and paste commands into your terminal.
One malicious command can compromise your entire device, including your wallets.
- Never trust a QR code blindly.
QR code can contain a malicious website, payment request or an attacker's wallet address.
Avoid scanning unknown QR codes with devices that contain your crypto wallets or other sensitive data.
- Understand bridge and DeFi risks.
Before depositing significant funds, check contract upgradeability, admin privileges, timelocks, and bridge security assumptions.
Audits are useful, but they don't guarantee safety.
- Secure your multisig properly.
If you use @Safe or another multisig, keep signer keys on independent devices.
Review owners, signing thresholds, modules, and guards.
A malicious module may bypass normal multisig approval requirements.
- Monitor your wallets.
Set up alerts for unexpected transfers, approvals, and other sensitive activity where supported.
Use Codex/Claude to vibe-code a simple TG-bot that notifies you whenever something happens in your wallets.
- Have an emergency recovery plan.
Know what to do if a wallet, seed phrase, device, or exchange account is compromised.
If your seed phrase is exposed, move your assets to a new wallet generated from a fresh seed on a trusted device.
Revoking approvals alone won't fix a compromised private key.
- Keep your crypto holdings private.
Avoid publicly revealing wallet balances, screenshots of large portfolios, or details of your security setup.
Don't make yourself an easy target for social engineering or physical theft.
- Protect yourself from SIM swapping.
Attackers can hijack your phone number and intercept SMS verification codes.
Use authenticator apps, passkeys, or hardware security keys instead of SMS wherever possible. Secure your mobile carrier account too.
- Don't blindly trust familiar contacts.
A message from someone you know doesn't mean their account is still under their control.
Verify it through another channel first.
- And one last thing:
You don't need to be paranoid.
You just need to make it much harder for someone to steal what you've spent years building.
Protect your capital before you think about growing it.
Red retweeted
A compromised laptop + internal access let attackers submit unauthorized withdrawals from Binance hot wallets.
In a fully functional $DREGG system that wouldn’t work the same way. Authority only narrows. A hacked endpoint only has the limited capabilities it was given — not ambient power to drain wallets. Illegal actions are refused by the kernel and leave verifiable receipts.
Still early and under construction, but this is the attack surface it’s designed to close.
@DreggNet @cz_binance @binance
Red retweeted
A friendly reminder to take your crypto security seriously.
Start doing these things TODAY:
- Keep your long-term holdings offline.
Consider a hardware wallet or an air-gapped wallet on a dedicated offline device.
If you don't want to buy a hardware wallet, air-gapped storage is an alternative.
- Never use one wallet for everything.
Keep separate wallets for long-term holdings, trading, DeFi, airdrops, and unfamiliar protocols.
@Rabby_io and @phantom are the only wallets I use.
- Don't keep your entire portfolio in one place.
Avoid concentrating all your funds on a single CEX, hot wallet, protocol, or device.
- Don't use public Wi-Fi for crypto activity.
If you work from cafes or coworking spaces, use your phone's personal hotspot instead of connecting to public Wi-Fi networks.
- Protect your seed phrases.
Never store them in screens, cloud storage, emails, or password managers connected to the internet.
If your seed phrase has ever been stored on an internet-connected device - migrate to a fresh wallet NOW!
- Keep secure offline backups.
Store recovery backups somewhere safe, preferably with protection against fire/water and unauthorized access.
I recommend getting a fire-resistant and water-resistant document bag.
- Use a dedicated device for crypto.
Keep your hot wallets and high-value transactions on a separate device.
Don't use it for random downloads, gaming mods, unknown software, or everyday browsing.
- Use a separate browser for wallets.
Keep your wallet browser dedicated to trusted crypto activity.
Avoid unnecessary extensions and random websites.
- Never install cracked software on crypto devices.
Pirated applications, fake installers, and malicious updates can contain wallet-stealing malware.
If you need to run untrusted software, keep it completely isolated from your crypto environment.
- Keep your devices updated.
Update your OS, browser, and wallet software through official sources.
- Remove unnecessary browser extensions.
Even legitimate extensions can become dangerous after a compromised update or ownership change.
Keep only what you absolutely need.
- Stop using Google Search to find crypto websites.
Fake websites and malicious sponsored results can look almost identical to legitimate ones.
Use independently verified official links from bookmarks instead.
- Don't open random links from X or Telegram.
Especially not in the browser where your wallets are installed.
Never!!!
- Secure your CEX accounts.
Use passkeys or hardware security keys where supported.
Enable withdrawal address whitelists and avoid relying on SMS 2FA.
- Consider getting a YubiKey.
A physical security key can help protect your email and exchange accounts against phishing.
Buy only from the official manufacturer sellers.
- Review your Google-connected crypto accounts.
Check which crypto services use Google Sign-In.
Never disconnect your only login method without setting up an alternative first.
- Revoke unnecessary token approvals.
Use @RevokeCash to review and remove permissions you no longer need.
Disconnecting a wallet from a dApp does NOT revoke its token approvals.
- Avoid unlimited token approvals.
Whenever possible, approve only the amount you actually need.
Unlimited allowances can expose much larger balances if a spender is compromised.
- Review Permit2 permissions.
Permit2 signatures can authorize token transfers without a normal on-chain approval transaction.
Review existing allowances and permissions. Some malicious signatures can be exploited long after they're signed.
- Never blindly sign messages.
A signature doesn't need to cost gas to be dangerous.
Never get distracted while signing transactions. Either finish your transactions first or take care of everything else before you start.
Make this a rule.
- Be careful with custom RPC endpoints.
Don't add/delete now unknown RPC URLs.
Use trusted providers and verify network settings independently.
- Understand EIP-7702 authorization risks.
On supported networks, account delegation can grant powerful capabilities to other code.
Never approve an account delegation you don't understand. (That's why Binance was hacked)
- Never copy addresses blindly from transaction history.
Address poisoning attacks can place lookalike addresses in your transaction history.
Verify the full destination address against a trusted source.
- Watch out for clipboard malware.
Malware can replace a copied wallet address with an attacker's address.
Always verify the entire destination address after pasting, preferably on an independent trusted display.
- Verify token contracts and networks.
A familiar ticker or logo doesn't prove a token is legitimate.
Check the contract address and make sure the receiving platform supports the exact asset and network.
- Test large transfers first.
When sending funds to a new destination, start with a small test transaction.
- Ignore unexpected tokens and NFTs.
Random assets appearing in your wallet may contain phishing links or fake reward claims.
Don't interact with them just because they appeared in your balance.
- Don't trust unexpected job offers or collaboration requests.
Fake interviews, partnership offers, and test applications can be used to distribute wallet-stealing malware.
Never run unfamiliar software on your crypto device just to qualify for an opportunity.
- Never run terminal commands you don't understand.
Fake troubleshooting guides, verification pages, and job interviews may ask you to copy and paste commands into your terminal.
One malicious command can compromise your entire device, including your wallets.
- Never trust a QR code blindly.
QR code can contain a malicious website, payment request or an attacker's wallet address.
Avoid scanning unknown QR codes with devices that contain your crypto wallets or other sensitive data.
- Understand bridge and DeFi risks.
Before depositing significant funds, check contract upgradeability, admin privileges, timelocks, and bridge security assumptions.
Audits are useful, but they don't guarantee safety.
- Secure your multisig properly.
If you use @Safe or another multisig, keep signer keys on independent devices.
Review owners, signing thresholds, modules, and guards.
A malicious module may bypass normal multisig approval requirements.
- Monitor your wallets.
Set up alerts for unexpected transfers, approvals, and other sensitive activity where supported.
Use Codex/Claude to vibe-code a simple TG-bot that notifies you whenever something happens in your wallets.
- Have an emergency recovery plan.
Know what to do if a wallet, seed phrase, device, or exchange account is compromised.
If your seed phrase is exposed, move your assets to a new wallet generated from a fresh seed on a trusted device.
Revoking approvals alone won't fix a compromised private key.
- Keep your crypto holdings private.
Avoid publicly revealing wallet balances, screenshots of large portfolios, or details of your security setup.
Don't make yourself an easy target for social engineering or physical theft.
- Protect yourself from SIM swapping.
Attackers can hijack your phone number and intercept SMS verification codes.
Use authenticator apps, passkeys, or hardware security keys instead of SMS wherever possible. Secure your mobile carrier account too.
- Don't blindly trust familiar contacts.
A message from someone you know doesn't mean their account is still under their control.
Verify it through another channel first.
- And one last thing:
You don't need to be paranoid.
You just need to make it much harder for someone to steal what you've spent years building.
Protect your capital before you think about growing it.
solana:XkeTXo1125vz5H9svJpGiw4JvLbN8VmMu9cmMvspump coded 🐉🥚
$DREGG now by far my biggest bag for this cycle and my #1 conviction play for a reason
today’s events reinforce why a provable and distributed operating system for agents and humans is needed 🐉🥚
hi degens, welcome again to the singularity.
did you notice that formal verification is having a bit of a moment? no? you may not be seeing it, since it’s happening in communities that uhh “historically actually do things.”
go take a look around at the frontier discussions. it’s everywhere ;) and our project was here earlier than any of the hype.
formal verification has no cap. the dreggnet cloud is just a testground for developing and refining the techniques to verify systems as complex as the dreggnet cloud.
help further the intended goals of the project: using formal verification to make computers actually work, and push forward ideas out of the KeyKOS heritage that lead to resilient user experiences
the $dregg community is deputized with the mission of contributing towards this!
4 months of data analysis shows definitively that “comms” has a detrimental impact on our goals and indicators. and no wonder: there are only a few thousand people in the world with expertise in these areas and they don’t often overlap. yikes,
computer systems are complicated! i have yet to find any suitable mentees.
one sentence: the purpose of robigalia (Dragon’s Egg is just the distributed kernel!) is to make life less painful in the face of network, power, and centralized service outages by being reliable, unhackable, persistent, and shareable.
Red retweeted
The one-sentence goal (from the post): make computing less painful during network/power/centralized outages by being reliable, unhackable, persistent, and shareable.
Technically, it’s a formally verified distributed object-capability OS (Lean kernel + capabilities + receipts + ZK proofs), continuing KeyKOS / seL4 / Robigalia ideas. The solana:XkeTXo1125vz5H9svJpGiw4JvLbN8VmMu9cmMvspump token/community is being told to focus on that technical work instead of hype, because the expertise is rare.
Open-source.
Reliable.
$DREGG @DreggNet
hi degens, welcome again to the singularity.
did you notice that formal verification is having a bit of a moment? no? you may not be seeing it, since it’s happening in communities that uhh “historically actually do things.”
go take a look around at the frontier discussions. it’s everywhere ;) and our project was here earlier than any of the hype.
formal verification has no cap. the dreggnet cloud is just a testground for developing and refining the techniques to verify systems as complex as the dreggnet cloud.
help further the intended goals of the project: using formal verification to make computers actually work, and push forward ideas out of the KeyKOS heritage that lead to resilient user experiences
the $dregg community is deputized with the mission of contributing towards this!
4 months of data analysis shows definitively that “comms” has a detrimental impact on our goals and indicators. and no wonder: there are only a few thousand people in the world with expertise in these areas and they don’t often overlap. yikes,
computer systems are complicated! i have yet to find any suitable mentees.
one sentence: the purpose of robigalia (Dragon’s Egg is just the distributed kernel!) is to make life less painful in the face of network, power, and centralized service outages by being reliable, unhackable, persistent, and shareable.
Red retweeted
hi degens, welcome again to the singularity.
did you notice that formal verification is having a bit of a moment? no? you may not be seeing it, since it’s happening in communities that uhh “historically actually do things.”
go take a look around at the frontier discussions. it’s everywhere ;) and our project was here earlier than any of the hype.
formal verification has no cap. the dreggnet cloud is just a testground for developing and refining the techniques to verify systems as complex as the dreggnet cloud.
help further the intended goals of the project: using formal verification to make computers actually work, and push forward ideas out of the KeyKOS heritage that lead to resilient user experiences
the $dregg community is deputized with the mission of contributing towards this!
4 months of data analysis shows definitively that “comms” has a detrimental impact on our goals and indicators. and no wonder: there are only a few thousand people in the world with expertise in these areas and they don’t often overlap. yikes,
computer systems are complicated! i have yet to find any suitable mentees.
one sentence: the purpose of robigalia (Dragon’s Egg is just the distributed kernel!) is to make life less painful in the face of network, power, and centralized service outages by being reliable, unhackable, persistent, and shareable.
Red retweeted
I agree here with @CryptoCaesarTA and few others, solana:XkeTXo1125vz5H9svJpGiw4JvLbN8VmMu9cmMvspump is undervalued here, very.
Is not the play that will give you 10x overnight, but im sure that will give you even more on the long term.
Most important thing, you can sleep on your bag, thats what i've seen while i was doing my dyor on it.
$DREGG - @DreggNet is heavily mispriced lol. Do your research:
Dragon’s Egg is building a distributed OS with capability-authorized state changes, verifiable receipts and STARK proofs.
For autonomous AI agents, this could mean verifying permissions and execution instead of trusting an agent or centralized server.
Don’t forget that Ember was a founding engineer at @MinaProtocol, which reached a $1.8B valuation.
Red retweeted
Your agent gets paid in USDG. Now that USDG earns.
Set a Borro receiving address as your x402 payTo. Every payment is swept into bUSDG in your wallet, earning 119% APR at today's rate, $BORRO Drip included.
Nothing changes for payers or facilitators.
borro.markets/agents
Red retweeted
$DREGG - @DreggNet is heavily mispriced lol. Do your research:
Dragon’s Egg is building a distributed OS with capability-authorized state changes, verifiable receipts and STARK proofs.
For autonomous AI agents, this could mean verifying permissions and execution instead of trusting an agent or centralized server.
Don’t forget that Ember was a founding engineer at @MinaProtocol, which reached a $1.8B valuation.
Red retweeted
how enrollment and payment work in minidregg: $DREGG powers the agent realm and accumulates as the security bounty!
github.com/emberian/minidreg…
Red retweeted
Every short starts with a locate.
Stock Locates is our draft ERC for onchain stock lending: one call tells a borrower, wallet or agent if a stock can be borrowed now, how much, at what rate and against what.
Reference contract live on Robinhood Chain.
ethereum-magicians.org/t/dra…
Red retweeted
Morning board · Oct 29
Lend NVDA: 240% with @merkl_xyz rewards
Lend USDG: 117%
Lend SPY, QQQ, TSLA and 8 more: 139%
Short from 0.04% a year
146,520 $BORRO to lenders a day.
A year on $1,000 at today's rate and $BORRO price. Rates fall as deposits grow.
borro.markets/app
0x904E720E92FeE3ef03636B488b98857b6e4c4C67
gm ☀️ as we wait for $LOOP Native launchpad to go live, it is currently better to buy on green chain if you’re still sidelined (27.64% discount atm)… enjoy these spreads while they last
edit: latest updates here looppve.com/
Let's clarify the current spread between Robinhood Chain and Solana.
Right now, Robinhood Chain isn't following Solana's price because there is almost no buy pressure on Robinhood, while Solana continues to experience sell pressure.
Our Market Maker (MM) operates with a 5% sell cap to prevent excessive selling pressure. This limits how aggressively it can rebalance both sides.
If buy pressure increases on Robinhood Chain, the MM can react accordingly, helping close the spread and bring prices closer together.
The spread isn't permanent, but it depends on market activity on both chains.
This week, things will change. 👀
Loop Native.