Pinned post
Sebastian van Staa⚡️🌋🇸🇻
Verified account This account is verified. Learn more@SebastianvStaa
Quantum Physicist. IoT Solution Architect. Cypherpunk.
1.5K Following 1K Followers 2.1K Posts
Latest posts 5
Issue explained here: github.com/spesmilo/elect… Malicious server may replace txns with unsigned low-fee txn pointing to a different address, user might just RBF (and sign) it. Watch out.
New release: Electrum 4.8.3. This release fixes a critical security issue, so we urge all users to upgrade. A description of the vulnerability will be published later today. (note: Windows Defender may show a warning about ZXing.dll, ignore that, it is a false positive)View quoted post on X
🫡
Bitcoiners called it again. A few months ago, Bitcoin was the canary in the coal mine.View quoted post on X
Over the summer, the Bitcoin ecosystem was hit first: the Coldcard firmware exploit, emergency patches at Core Lightning, and a flood of AI-generated bug reports. The base protocol held. The weaknesses were in the software built around it, and the response was a volunteer red team pointing AI at hundreds of Bitcoin repositories and fixing what it found in the open.
This week the rest of the internet got its turn. PHP2Shell, a set of flaws that had sat in PHP for over a decade, was found with frontier AI models and patched on 21 October. PHP runs roughly three quarters of the web, and governments took their own sites offline while they scrambled to update.
Bitcoin went first because it is the biggest open bug bounty in the world, and anything with money attached gets probed first. Banks, payment rails, hospitals and government databases are next, and most have relied for decades on obscurity and slow attackers. That cover is gone.
It will probably be quite painful for a while. What survives will be simpler, tougher and more honest about its own weaknesses. Stress is how resilient systems get built.
And even worse, as several sources have pointed out in the meantime: @Ledger casually posted about several kinds of malicious implants in their own security blog, instead of loudly sounding the alarm - eradicating any cause for plausible deniability.
ledger.com/academy/topics…
ledger.com/academy/topics…
This is getting from bad to worse. So @Ledger was warned about their devices being tampered with several months ago already, and publicly dismissed it? x.com/HeyTaiZen/stat…View quoted post on X
Good news, @Liquid_BTC up and running again. Any info yet on who fronted the missing 600 BTC?
Also, they "will be added to the Federation wallet in the coming days". Not scared of a bank run happening before that?
Also, they "will be added to the Federation wallet in the coming days". Not scared of a bank run happening before that?
Peg operations are resuming for @Liquid_BTC. The external security audit is complete and looks good. Additional hardening measures are also done.View quoted post on X
Liquid users are now able to peg-out via @side_swap and @AquaBitcoin.
The ~600 BTC shortfall will be added to the Federation wallet in the coming days.
Everything is almost back to normal! 🙏🏻🌊
