Writing
Selected writing and channels. The through-line: who really owns this thing, and how do you keep it?
Core Lightning told operators on October 2 that attackers are targeting nodes on version 26.06.7 or earlier. The fix had been public since September 22, with a plain-English changelog. Why a Lightning node is a hot wallet, what a revoked commitment costs, and six things to do with your node today.
Two Safe multisigs lost 114 ETH on October 1 with no stolen key and no forged signature. A leverage module checked permission by asking the caller, and a fake Safe said yes. Why a module is a signer with a threshold of one, and what to do with every Safe you sign for.
By Bitget's account, $387.5 million left the exchange without a stolen key or a forged customer request: a compromised backend fed spoofed data to its own approval process. What a signature really proves, what an exchange balance really is, and what to do as withdrawals reopen.
Seven agencies in four countries say North Korean fake recruiters compromised at least 30,000 PCs and over 7,000 crypto wallets through job interviews and coding tests. Why the VS Code trust prompt is the real boundary, and why your keys don't belong on the machine where you open other people's code.
11.7 million XRP left D'CENT App Wallet users over six days, most of it after the warning, and the attacker came back to reuse keys on emptied accounts. Why an update can't un-leak a recovery phrase, and what to do when yours may be exposed.
Since Bitcoin Core 24.0, a crafted wallet name could run commands on nodes using -walletnotify. The fix is in the 32.0 release candidate and none of the stable lines. Who is exposed, and the check to run on your own node today.
Revolut handed passports, home addresses and bitcoin histories to fake requests sent from a real government email domain. Why that list is what physical attackers shop for — and the call-back habit that stops the phishing that follows.
Malware is now storing its command-and-control addresses in smart contracts on BNB Chain and Polygon. The ledger keeps the address book and no record of who opened it — plus the one rule that stops the attack cold.
About $320M in bitcoin left the Liquid sidechain with every key intact. Why eleven-of-fifteen is no protection when all fifteen run the same wrong code — and why a chain that hides its amounts can't be audited for its own supply.
A critical bug was reported in April, cleared as low-risk, and silently patched in August. Then it emptied six chains. What the Cosmos EVM exploit teaches about upstream trust.
On the $116M Coldcard exploit: why the device was never the security, what the SafePal breach means for wallet owners, and the habits that actually protect cold storage.
An early explainer on Gala's blockchain gaming infrastructure — and why player-owned assets change the deal between games and the people who play them.
The questions everyone was asking about running Gala nodes, answered without jargon.
The 18-lesson training where all of it lands: the habits, tools, and checks that keep crypto safe.
Essays from the earliest years are archived on Medium.