Pinned post
9/9
99.999999999e9
FIX THE MONEY
FIX THE WORLD
99.999999999e9
FIX THE MONEY
FIX THE WORLD
Yuvi Lightman | Quantus
Verified account This account is verified. Learn more@YuviLightman
Securing Blockchains against the Quantum Threat | Founder of @QuantusNetwork
1.4K Following 5.6K Followers 6.7K Posts
Latest posts 5
My pronouns are I/me. You cannot refer to me, only to yourself.
Now I have root. Enjoy being me 😝
Now I have root. Enjoy being me 😝
Address poisoning attacks are serious, but largely preventable by using checkphrases.
Address poisoning happens when an attacker swaps the destination address with a lookalike. It can happen because malware got into your clipboard, or because they put a lookalike in your transaction history hoping you accidentally copy it.
The more advanced version will forward test transactions (small value) to the intended destination so you get confirmation from the recipient that it went thru. This is why when doing tests you should always check the txid with the recipient.
But using checkphrases makes this attack much harder to execute. The fundamental weakness being exploited by address poisoning is that humans have a hard time reading random data, so we generally just skip it.
A checkphrase is a human-readable phrase that is cryptographically bound to whatever data you derive it from. You can use it with any data, but the two most interesting usecases are crypto addresses and transaction ids.
If one letter changes in the input, on average all five words will change. For example, if your BTC address is
1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
Then your checkphrase is
Age-Awake-Secret-Blossom-Hedgehog
But if you change one letter
1A1zP1eP5QGefi2DMPTfTL5SLmv7DixfNa
The checkphrase becomes
Innocent-Fitness-Joyful-Brown-Surge
In the default configuration this has about 55 bits of security and requires about 50k hashes to generate a single one, so if you are sending a large amount of money you should check the entire address, since collisions are possible for highly motivated attackers (quintillions of hashes).
It’s open source. Anyone can use it on any address type in any wallet. It’s entirely client side.
github.com/Quantus-Networ…
Address poisoning happens when an attacker swaps the destination address with a lookalike. It can happen because malware got into your clipboard, or because they put a lookalike in your transaction history hoping you accidentally copy it.
The more advanced version will forward test transactions (small value) to the intended destination so you get confirmation from the recipient that it went thru. This is why when doing tests you should always check the txid with the recipient.
But using checkphrases makes this attack much harder to execute. The fundamental weakness being exploited by address poisoning is that humans have a hard time reading random data, so we generally just skip it.
A checkphrase is a human-readable phrase that is cryptographically bound to whatever data you derive it from. You can use it with any data, but the two most interesting usecases are crypto addresses and transaction ids.
If one letter changes in the input, on average all five words will change. For example, if your BTC address is
1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
Then your checkphrase is
Age-Awake-Secret-Blossom-Hedgehog
But if you change one letter
1A1zP1eP5QGefi2DMPTfTL5SLmv7DixfNa
The checkphrase becomes
Innocent-Fitness-Joyful-Brown-Surge
In the default configuration this has about 55 bits of security and requires about 50k hashes to generate a single one, so if you are sending a large amount of money you should check the entire address, since collisions are possible for highly motivated attackers (quintillions of hashes).
It’s open source. Anyone can use it on any address type in any wallet. It’s entirely client side.
github.com/Quantus-Networ…
github.com GitHub - Quantus-Network/qp-human-checkphrase Contribute to Quantus-Network/qp-human-checkphrase development by creating an account on GitHub. 🚨 IF YOU ARE IN CRYPTO, IGNORE THIS POST AT YOUR OWN RISK
A friend lost $535,000 USDT yesterday, and he even sent a test transfer first. His wallet wasn't hacked and his keys never leaked. He lost it to a bot.
The test transfer arrived fine. Within seconds, a bot sent 1 USDT to his wallet from a fake address that started and ended with the same characters as the real one. Now the fake address was sitting in his transaction history, right next to the real one.
When he went to send the full amount, he copied the address from that history and picked the fake one. The money was gone in under 30 seconds, swapped out of USDT before Tether could freeze it.
This is called address poisoning, and it's running at industrial scale. The bot that got him has run over 6 million transactions, and it goes after anyone moving large amounts.
Here's how to make sure it never happens to you:
• Never copy an address from your transaction history or a block explorer
• After a test transfer, copy the address again from the original message the receiver sent you
• Check every character, because these bots match both the start and the end
• Save verified addresses in your wallet's address book with names
Now open your wallet and go through your history. If there's a tiny deposit from an address you don't recognize, a bot has already marked you. Tell me below if you find one.
Repost this post and share this to the person you know who moves the most money on-chain.View quoted post on X
This number just keeps going up. The crowdsourced quantum algorithm at ecdsa.fail uses only 30% of the resources of Google’s classified algorithm.
This is probably why Trump issued the Executive Order shortening the government’s own post-quantum timeline.
@grok plz explain
This is probably why Trump issued the Executive Order shortening the government’s own post-quantum timeline.
@grok plz explain
