Pinned Tweet
Today my second book is published: Everyday Crypto. An Everyday Guide to Cryptocurrency, managing your crypto wealth and protecting yourself and your family.
Crypto has stopped being exotic. A quarter of Americans, and one in twelve British adults, now own some, and most of them bought it on their phone in a few minutes. Nobody told them how to keep it, who really holds it, or what happens to it when they are gone. Everyday Crypto is the plain guide to owning it well.
It answers the questions people ask me most often and rarely get a straight answer to. Is it too late to buy, and how much is a sensible amount? The app says my crypto could be earning, so where does the yield come from? My coins are on an exchange: do I own them, or does it? I bought a hardware wallet, am I safe now? A text from my bank, a call from my son: how do I know itās real? And the one that started the whole series: what happens to my crypto when I die, and who can my family call?
The book is built from true stories rather than theory. The exchange that failed with the customersā money inside. The hardware wallet whose faulty dice cost its owners their coins five years later. The text message that opens a months-long con. Each one shows what went wrong, why, and the calm habits that would have stopped it.
Then it changes register. For the holder of real wealth, and for the wealth managers who have spent years forbidden from touching this asset, it sets out custody that survives an audit, the concentrated position, crypto philanthropy, and inheritance that works on the day. The regulators and legislators in Washington and Westminster who are, at last, writing rules that let banks and advisors offer this safely get a chapter of their own, because that is where crypto goes next: into the ordinary bank account.
Five questions run through every chapter: how much, who holds it, in what form, what the tax authority needs, and who inherits it. They are the same questions at fifty dollars a month and at fifty million. Only the zeros change.
It is the second of The Everyday Guides, following Who Holds the Key?, and like that book it assumes nothing beyond the ability to use a phone. You donāt need to become a security expert. But by the time you finish this book, you will know how to protect yourself and your family.
Available now on Amazon (Kindle, paperback and hardcover), Apple Books, Barnes & Noble and at independent bookshops through Bookshop.org. Details and all the store links are at everydaycryptocurrency.com.
If you read it, a review on Amazon or Apple Books helps more than you would think. Thank you to everyone who made it possible; you know who you are, and you are in the Acknowledgements.
Wasim Ahmad retweeted
In 2014 I went nearly a week without sleep. I was running PayPal and attackers were inside our corporate network. They'd compromised an eBay employee's laptop, got onto the VPN, taken over a domain controller and made themselves domain admins. eBay and PayPal were one company then, on one Windows network. They stole 145M eBay user records, then came for the segregated vault holding PayPal's card credentials. We fought them off. They never got in, but they got close. Too close.
Yesterday Binance lost ~$6.3B in what looks like the same way. A DevOps engineer's laptop, then a service inside the withdrawal stack, then withdrawals the signer approved because they came from a trusted source. Hot wallets emptied in under four hours. No key was stolen.
Nobody broke cryptography or a ledger. They found someone with access and used the trust that came with it. Banks get hit exactly the same way.
2016: attackers inside Bangladesh Bank used its own SWIFT access to send $951M of payment orders to the NY Fed. $81M was lost. The rest was held because an unrelated sanctions filter tripped on the word "Jupiter". That was luck, and it only worked because wires took days to settle.
June 2025: an IT employee at C&M Software, which connects Brazilian banks to Pix, sold his credentials for about $2,700. Attackers used them to send fake Pix transfers out of six institutions' reserve accounts at the central bank. ~$140M in under three hours.
August 2025: stolen vendor credentials at Sinqia, another Pix connector. ~R$710M out of HSBC and one other institution in a single afternoon. The central bank froze most of it, after it had already moved.
Same attack every time. Speed is what changed. When settlement took days, a filter, a correspondent bank or someone in ops could catch a bad payment. Pix, FedNow, SEPA Instant and blockchains settle in seconds. Payment security was mostly built for the slow world.
PayPal's card and user data survived 2014 because domain admin on the corp network couldn't unlock it quickly enough, and our alerting caught the unusual activity on the network. That's the model. Approval policy no laptop or vendor login can reach. Velocity and anomaly limits enforced outside the system that sends. Dynamic caps on what any one wallet, account or service can move per hour. All of it in real time.
About $3B of what left Binance has been frozen, almost all of it stablecoins. The $1.4B in bitcoin is sitting in 19 wallets and nobody can touch it. I don't think that's the problem. For decades the ability to reverse a wire or a card charge let a lot of weak security slide. You either stop the transfer before it's signed or you eat the loss.
Nothing about the technology failed here. The chains processed exactly the transactions they were handed. Binance's own systems handed them the wrong ones because an engineer's laptop was compromised. That's operational security. eBay in 2014, Bangladesh Bank and two Pix connectors all failed at it on their own rails.
In 2014 the attackers never reached the vault. If they had, the fraud losses would have been the small part. PayPal existed so people could pay without handing their card details to every merchant on the internet. We held those details so they didn't have to. Losing them would have broken the one thing the company was built on, and I'm not sure we would have recovered.
I expect blockchains and digital assets to become the standard way money moves. Every custodian of digital assets, or of fiat on a real-time rail, is in that position now. The controls have to adapt to settlement in seconds, crypto or not.
Iāve started to think of crypto inheritance as one of the most overlooked parts of ownership. If someone canāt access what I own, I donāt really own it in any meaningful sense. #Crypto #Inheritance #Web3
Wasim Ahmad retweeted
At least @Trezor is giving a tiny bit of guidance to what current Trezor users should do.
I'm still amazed that @Ledger still has NOT given any security advice to it's current users. They pretend as if the millions of current users are not concerned or worried about their coins!
CryptoBilis update
We've been made aware, through responsible disclosure, of a single hardware implant in a Trezor Safe 5 device bought from the reseller CryptoBilis in August 2026.
No CryptoBilis buyer has reported a loss of funds to us.
IMPORTANT: If you bought a Trezor from CryptoBilis from March 2026 onwards, we know this is unsettling. Hereās what to do:
Already using it?
Move your funds to a newly created wallet with a new seed as soon as possible. Do not reuse the old seed in any wallet, hardware or software. If you donāt have another secure hardware wallet available, we recommend temporarily migrating your funds to a software wallet or an exchange you are familiar with.
Not set up yet? Donāt set it up, and never enter your existing wallet backup on it.
We havenāt received the device to confirm this report, but based on the customerās description, weāre treating it as credible and sharing it now so customers who purchased a Trezor via CryptoBilis can secure their funds as a precaution. Our security team will examine the device as soon as it arrives.
On October 9, 2026, we removed CryptoBilis as a reseller following reports of tampered Ledger devices sold through it. Since then, we have been inspecting Trezor devices that customers bought from CryptoBilis and have found no signs of tampering on any of the four devices weāve received so far.
NEVER share your wallet backup (recovery phrase) with anyone. Trezor Support will never ask for it.
If you are affected by this incident, please keep your CryptoBilis device and contact Support to receive a new Trezor hardware wallet: trezor.io/support#open-chat
We're investigating and will post updates here as soon as we know more. Thank you to the customer who reported this through our responsible disclosure program, and to @SEAL_911 for working alongside our teams on the response. Reports and engagement like this help us protect everyone else.
For more information, visit our blog: trezor.io/blog/news/implant-ā¦
Wasim Ahmad retweeted
Today, we asked Congress to immediately pass legislation that would:
1ļøā£ Keep customer funds separate from company funds and safe in a bankruptcyāØ2ļøā£ Give the @CFTC authority over U.S. crypto exchangesāØ3ļøā£ Require baseline security standards across the industry
Much of this work was already done during Clarity. This is bipartisan low-hanging fruit
Yesterdayās @binance hack of $6.3B means everyday people are wondering where they should keep their crypto. Donāt Panic. Donāt keep it all in one place and make sure you have a backup so you can move the crypto as needed - this protects your crypto and it protects your family.
Read more about how to protect yourself in my new book everydaycryptocurrency.com
You can move funds if you know what your seed phrase is - do you know what your seed phrase is? Do you have a backup? Does your family? Use something like @Vault12Guard weāve been backing up hardware wallets for years: @vault12 the pioneers of crypto inheritance
TREZOR WARNS CUSTOMERS TO MOVE FUNDS AFTER HARDWARE IMPLANT DISCOVERED IN WALLET SOLD BY FORMER AUTHORIZED RESELLER
Trezor has issued an urgent security warning after receiving a credible report of a malicious hardware implant inside a Trezor Safe 5 purchased from CryptoBilis, its former authorized reseller in Southeast Asia.
The device, purchased in Indonesia through Tokopedia in August, reportedly contained an additional circuit board installed between the main board and screen, equipped with a cellular module and antenna.
According to the report, the implant can read information displayed on the walletās screen, including the recovery seed phrase, and transmit it to attackers over a mobile network whenever the device is plugged in.
Trezor has not yet physically examined the device but says photos and a video interview with the customer were convincing enough to warrant an immediate warning.
The discovery follows a sophisticated supply-chain attack involving Ledger wallets sold through the same reseller, which Ledger began investigating on October 9.
Trezor removed CryptoBilis as an authorized reseller that day.
The company is now urging anyone who purchased ANY Trezor model from CryptoBilis since March 2026 to immediately transfer their funds to a new wallet with a newly generated recovery seed.
Simply restoring the potentially compromised seed phrase on another device will NOT protect the funds.
Trezor says no customer losses have been reported in connection with the suspected implant. The company is offering affected buyers free replacement devices or vouchers and is working with Ledger and security investigators.
The identity of the attackers remains unknown, and there are currently no reports involving other Trezor resellers.
Another hardware wallet with a spy chip undermining the crypto ecosystem of hardware wallets. Protect yourself and make backups for you and your family.
Worldās Second-Largest Hardware Wallet Maker Trezor Warns of Suspected Hardware Implant in Device Sold by Reseller
Trezor said it received a credible report of a suspected hardware implant in a Trezor Safe 5 device purchased from reseller CryptoBilis in August 2026. The company has not yet received the device for verification, and no CryptoBilis customer has reported losing funds.
Trezor urged customers who purchased devices from CryptoBilis since March 2026 to move their funds to newly created wallets with new recovery seeds as soon as possible. The company removed CryptoBilis as a reseller on October 9 following reports of tampered Ledger devices. Four Trezor devices inspected so far showed no signs of tampering, and the investigation remains ongoing.
Wasim Ahmad retweeted
The recent security incidents involving Bybit, Bitget, and now Binance should serve as a wake-up call for every leader in the crypto industry.
Security should never be an area of commercial competition. It is a shared responsibility to protect our customers and the entire industry.
Over the past decade, major crypto exchanges have made significant progress in protecting private keys. We have seen relatively few incidents involving direct private key compromises in recent years. So far, we have not seen conclusive evidence that Binanceās hot wallet private key was leaked. The greater concern may lie in vulnerabilities in access controls and wallet management systems.
Companies that have never experienced a major security incident should not assume they are inherently safer or immune to attacks.
At OKX, we have built multiple layers of sophisticated security protection and maintained a strong security track record over the past decade. But we also recognize that no system is absolutely secure. We must remain humble, vigilant, and constantly challenge our own security assumptions.
A major security breach at any exchange undermines trust in the entire crypto industry, ultimately hurting every company and every customer.
I believe CEOs across the industry need to come together, just as we did during the Bitcoin fork crisis in 2017, to establish stronger industry-wide security standards and coordinated response mechanisms.
For example, transfers and settlements between verified exchanges could be processed in real time, while large withdrawals to unknown or unverified addresses, as well as transactions granting smart contract permissions, should be subject to additional verification and appropriate security delays.
Crucially, these safeguards should be enforced at the cryptographic signing layer, rather than relying solely on application-level controls. Even if an attacker compromises an exchangeās wallet management system, they should not be able to bypass these fundamental security restrictions.
We should also establish industry-wide mechanisms for real-time security incident notifications, coordinated monitoring of suspicious funds, and rapid responses to potential attacks. Exchanges, stablecoin issuers, and other major industry participants should work together to enable the rapid, lawful temporary freezing of suspected stolen assets when necessary.
We should also work together to accelerate the industryās transition to quantum-resistant cryptography and strengthen our defenses against emerging AI-powered security threats. These are long-term challenges that no single company can solve alone, and they require coordinated research, shared standards, and collective action across the industry.
Security is everyoneās responsibility. No company can protect the future of crypto alone.
Wasim Ahmad retweeted
Where the $6.28B came from, at 20:24 UTC prices:
ā¢ Ethereum $3.74B
ā¢ Bitcoin 18,270.2 BTC, $1.47B
ā¢ Tron 612.7M USDT + 46.4M TRX, $627.5M
ā¢ XRP 233.5M XRP, $296.5M
ā¢ Solana 970,522 SOL, $96.1M
ā¢ Arbitrum 8,426 ETH + 74.6M ARB, $31.8M
ā¢ Avalanche 1.81M AVAX + 8.41M USDt, $24.3M
ā¢ Optimism 44.2M OP, $4.8M
Wasim Ahmad retweeted
Binance hot wallets lost ~$6.28B across 8 chains today. $6.07B went in the first 55 minutes, and the attacker kept re-sweeping one Ethereum wallet for two more hours.
Since then Tether, Circle, Ripple, Paxos, World Liberty and Binance have frozen ~$2.80B. About $3.27B can still move, mostly BTC and ETH.
I traced it all on-chain, including how the attacker raced the freezes š§µ
Wasim Ahmad retweeted
BREAKING: Binance hot wallets appear to have transferred billions of dollars in assets to an unlabeled wallet in unusual activity flagged by onchain analyst Spreek.
Arkham data shows about $3.55 billion in incoming transfer volume, with nearly $900 million later moved across different wallets. Spreek said the contract call was funded through Tornado Cash. Binance has not confirmed a breach.
binancecoin:native
Wasim Ahmad retweeted
Singapore Police Say Ledger crypto Wallets Sold at Local Retailers Contained Malicious Hardware Implants
Singapore police said on October 28 that some Ledger cryptocurrency hardware wallets purchased from local retailers contained malicious hardware implants capable of stealing users' recovery phrases or private keys. At least two cases have been reported since September 10, resulting in losses of approximately S$3.5 million ($2.7 million). Ledger, a leading French hardware wallet manufacturer, is reviewing the affected cases, while police investigations remain ongoing.
Iāve always preferred a quiet coffee over a loud stage. You learn more about a startup's soul in twenty minutes of honest conversation than in a dozen polished pitch decks. Humility remains a competitive advantage. #startups #entrepreneurship #leadership
The printed copies just arrived - just beautiful - so excited to start sending these out - whoās getting them? Iāll never tell xoxo
everydaycryptocurrency.com
If your estate plan involves a post-it note in a drawer, we might need a chat. Digital inheritance isn't just a technical problem; it's a final act of care for the people you leave behind. Quite important, really. #crypto #estateplanning #legacy
The real value in 2026 isn't AI or crypto in isolation. Itās the quiet intersection where AI manages the complexity of decentralized assets, making the tech invisible. The best tools are the ones we forget are even there. #AI #crypto #innovation
A founder told me today they were embarrassed by their slow growth. In an era of instant AI-scaling, I found their patience rather refreshing. Building something that lasts usually takes more time than weād like to admit. #startup #growth #founderlife
Hardware wallet vendors are peaking with spectacular levels of incompetence - first @Ledger, @COLDCARDwallet, @Trezor, @SafePal and now @keystonewallet time to ditch hardware wallets that donāt have product/market fit anymore - make sure you back up any wallet you use, and set up inheritance while you are at it
Hey @KeystoneWallet , my order was from 2024, and my information still got leaked, despite you claiming that shipping addresses and customer information get deleted after 180 days and are never stored beyond that period.
Trust level is below zero, honestly.
nitter.cf/pepe_whale69/status/21ā¦