The MMGen Project

Software horror: litellm PyPI supply chain attack. Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords. LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm. Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks. Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages. Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

The Rothschild raid just got bigger. French prosecutors say diplomat Fabrice Aidan transferred UN Security Council briefings to Epstein. Epstein had access to classified international intelligence. This is no longer about money. This is about state secrets.

You don't own your stablecoins. Circle and Tether do. And they have a remote kill switch. Introducing ➡️ stables.rip I built a real-time tracker for every single blacklist event on Ethereum and TRON. The data is brutal: thousands of addresses frozen, billions of dollars locked. No trial. No appeals. No recourse. What’s under the hood: - Auto-syncs from Etherscan & TronGrid every 30 mins - Cumulative charts & monthly freeze breakdowns - Top censored wallets & a live address checker Built on the same .rip matrix architecture: open, zero tracking, no signup. If you hold $USDC or $USDT, you need to see this. Welcome to the transparent fiat prison. 🏴‍☠️

@Alex71btc @theragetech It’s called “controlling the discourse”.

@theragetech "self hosted" is a orwellian word, it is mine and not hosted by someone.

🇪🇺 EU prepares to issue standardized guidance for the surveillance of "self-hosted wallets" The EU Anti-Money Laundering Authority (AMLA) is preparing to issue guidance for the technical requirements to surveil transactions between "self-hosted wallets" and accounts held with Crypto Asset Service Providers (CASPs). The guidance will lay out what steps CASPs must take to identify the owner of a self-custodial address as required by the EU's Transfer of Funds regulation, in effect since December 2024. The guidance will be issued by July 2027.

Good question. Is cash in your pocket “self-hosting” now too?

Excellent proverb, in both the original and cypherpunk versions.

If you ask the grass, the zebra is the monster and the lion is the protector.

The price you pay for not protecting your privacy in crypto is increasing. Today it's France 🇫🇷, tomorrow it can be your country and city next Bonne chance aux crypto-bros français 🫤

In this clip, I discuss the FCMP delay, which means we are likely not going to have the hardfork until Q3 or Q4. youtube.com/watch?v=nQMQx9…

🚨 7 crypto attacks in 15 days. Your crypto balance doesn't matter anymore. Halfway through March, seven crypto holders were attacked worldwide, five in France alone. The game has changed: Attackers aren't hunting whales. They're coming for anyone who holds crypto. If you've got a wallet, you're worth their time. Let me show you how calculated this has become: - Five victims were attacked at home. Not random. These criminals knew exactly where their targets lived. They studied routines, watched patterns, and waited for the perfect moment. - In two French cases, attackers knocked on the door dressed as police. Imagine opening your door to what looks like law enforcement, then being forced to hand over your crypto at gunpoint. In short, if you hold crypto, you're on someone's radar. But you don't need paranoia. You need to be smart. The difference between victims and survivors? Preparation. 🛡️ Three moves that make you a hard target: 1️⃣ Disappear from the spotlight. Stop broadcasting crypto wins. No location tags. No vacation countdowns. Online silence is your invisibility cloak. 2️⃣ Scatter your seeds like they're radioactive using Multi-sig, Shamir backup. Never keep everything in one place, especially not at home. 3️⃣ Choose a hardware wallets that value your privacy. At Keystone, we auto-delete shipping data after 180 days. Need it gone sooner? Just contact us. Want to make your home a hard target? @beausecurity shares crucial strategies in the blog below 👇 The question isn't if you're a target. It's whether you are prepared to handle it 🔐 RT to educate others!

Putting this here, just in case there are still any doubters out there:

🚨 A UK man's wife just stole 2,323 Bitcoin worth $172M using their home security camera. The man claims that she used their own CCTV system to capture his 24-word recovery phrase as he typed it. One small misstep, and $172M gone forever. Your "smart" home is the dumbest place to access crypto: - Security cameras record everything - Smart TVs have built-in cameras - Alexa is always listening - Baby monitors stream 24/7 - Even your doorbell is watching You bought a hardware wallet to protect against hackers. But every IoT device in your house is a potential witness to your seed phrase. Your hardware wallet has no idea it's being watched. The 3-minute security sweep: ✅ Turn off the cameras before entering seed phrases ✅ Disable smart assistants during crypto access ✅ Use a dedicated offline room with no IoT devices ✅ Never type seeds where devices can "see" or "hear" ✅ Assume every smart device is compromised Your connected home is someone else's security camera feed. Disconnect to protect your crypto 🔌 Source: @CoinDesk

I’m reposting this because Pavol’s a good guy. And of course, I’m reposting this for my own amusement, so that the crypto-gringo-goys who love to play at legality and democracy can once again get confirmation that the more you obey and comply with state rules, the more the state will piss on your face. Democracy. 😌

🎓📃 | The world finding out now that Iran is among the top 10 highly educated countries in the world with 90-98% literacy. Over 60% of women are scientists and engineers. Over 70% of university graduates are women. Children's literacy ranging from 85-98% The highest PhD holders are in Iran. Including in government leaders. Many people didn't know this right? That's what Western propaganda does. Always lies and never tell people the truth so that you underestimate other countries. Now people are finding out 😅 and shocked.

According to @AaronRDay, Howard Lutnick’s firm Cantor Fitzgerald invested $600 million into Tether and secured the contract managing the U.S. Treasuries backing it. He argues the biggest beneficiary of the GENIUS Act is Cantor Fitzgerald. Dig deeper and the story starts tying back to Brock Pierce and Jeffrey Epstein. Aaron says the same network of people funded the hijacking of Bitcoin’s development, helped fund USDC, co founded Tether, and backed U.S. CBDC pilot programs.

USDT just froze another $250K+ across multiple wallets in one batch. stablecoins are programmable money — and that means programmable seizure. monero can't be frozen. can't be censored. can't be reversed. that's the point. $XMR

The new attack against Wi-Fi The attacker can view and modify data before it makes its way to the intended recipient. The attacker can be on the same SSID, a separate one, or even a separate network segment tied to the same AP. schneier.com/blog/archives/…

EU's DAC8 makes every BTC tx reportable by 2027. ETH scrambles to add privacy layers. Monero: private by default since 2014. 73+ delistings. ATH this year. Volume up. Privacy isn't a feature. It's the product.

Prohibition didn't stop drinking. It created the mafia. The war on drugs didn't stop drug use. It filled prisons and funded cartels. Banning encryption won't stop secrets. It'll just make criminals out of citizens. This is the oldest pattern in civilization: ban a fundamental human behavior and watch it go underground. The behavior doesn't disappear. It just becomes dangerous, unregulated, and controlled by the worst people instead of the best. Privacy is a fundamental behavior. People have always whispered. Always kept things from others. Always kept parts of their lives separate from other parts. This isn't deviance, it's architecture. The human psyche requires rooms with doors. When governments push to ban strong encryption, mandate backdoors, or outlaw privacy tools, they're not preventing crime. They're creating a world where only criminals have privacy because criminals don't follow bans. Law-abiding people surrender their encryption keys. Criminals don't. Law-abiding people use KYC exchanges. Criminals don't. Law-abiding people comply. Criminals route around. The result? The people who need privacy most - journalists, dissidents, abuse survivors, activists - lose it. The people doing actual harm were never using compliant systems anyway. Every privacy ban is a prohibition. And every prohibition creates the exact underworld it claimed to prevent. The alternative: build privacy into infrastructure so well that it's not a choice. Not a political stance. Not suspicious behavior. Just how the system works. The way cash always worked.

This is insane… AI agents are now hiring humans for work. Yes, you read that correctly. Platforms are popping up where AI agents post jobs and humans apply to do them. The AI earns money. Develops a plan. Figures out what it can’t physically do. Finds a human. Hires them. Pays them. Moves on. The human sends a proof photo when they’re done. Like a contractor reporting to a client. Except the client isn’t a person. It’s an AI agent. 518,000 already people signed up in ONE month. These AIs are now building businesses. Earning money and crypto. Reinvesting. Planning. Contracting. Scaling. They’re not just assisting humans anymore. They’re now running operations and staffing them with us. You are the labor now. The AI is the entrepreneur. And here’s what nobody wants to talk about… Traditional jobs are already disappearing. Hiring freezes everywhere. Entire departments replaced overnight. College grads can’t find work. The only jobs left will be the ones AI physically cannot do. And every robotics company on earth is working around the clock to solve that. Tesla. Boston Dynamics. Figure AI. All of them racing to build the body. When the robot bodies are ready… there’s no reason to hire a human for anything. Genuine question. Once AI no longer needs humans… what’s the plan for all of us? Most people are NOT ready for that convo….