Nicolas Bacca

6.1K posts

Nicolas Bacca banner
Nicolas Bacca

Nicolas Bacca

@BTChip

Chef @zknoxhq | Co-founder @Ledger 🦄. I build permissionless and hard to break things. Fan of Magic Internet Money (but no MSB). Entrepreneur if duty calls

Unhosted Katılım Mayıs 2013
26 Takip Edilen9K Takipçiler
Nicolas Bacca
Nicolas Bacca@BTChip·
@voird33r Yes unfortunately because of PQ timing a lot of crypto research will end up being wasted. Silver lining now we can also accelerate it with AI - at least we're living in a cool science experiment
English
0
0
1
12
Liam Castaigne 🔜 AC
@BTChip Bullish on just thresholding SPHINCS with MPC until we get more research on something like SQIsign tbh. If isogeny based crypto ends up working out, hash based stuff will still be valuable on the virtue of clean cryptanalysis, but dilithium won't really have much of a place...
English
0
0
0
25
Nicolas Bacca
Nicolas Bacca@BTChip·
It has been repeated a lot those last few days but yeah ECDSA TSS is the mother of all footguns - thanks god we have FROST. Bad news is that now we have do it again from scratch for Post Quantum signature algorithms :)
Tay 💖@tayvano_

For some unknown reason I was under the impression that the TSS stack of vulns were in the same sorta class as other cryptography vulns. It’s honestly a completely different beast and I’m struggling to understand how anyone figured this would ever be secure enough lol?

English
2
1
14
2K
Nicolas Bacca retweetledi
Ethereum Foundation
Ethereum Foundation@ethereumfndn·
0/ Clear signing is now live. An open standard to end blind signing, making human-readable transactions default. This effort brings a major UX and Security upgrade to transaction signing on Ethereum.
Ethereum Foundation tweet media
English
156
443
2.1K
303.1K
Nicolas Bacca
Nicolas Bacca@BTChip·
Trop de fuites liées aux déclarations cryptos. Quoi faire : Donnez à @rotkiapp app de compta locale pour améliorer le support 🇫🇷 qf.giveth.io/project/rotki?… Utilisez le skill Paperasse de @romainsimon avec un modèle local (sinon voilà hein) Et postez vos retours surtout
Français
4
5
36
4.7K
Nicolas Bacca
Nicolas Bacca@BTChip·
@KuptoKosmos De loin ça me parait aussi trop gros pour être honnête. Juste mon opinion bien sûr.
Français
1
0
1
226
Kruptos
Kruptos@KuptoKosmos·
🚨🗃️💰 LEDGER HACK IDOR ? Du recyclage exactement comme son coup sur Polymarket en avril... 👉 "xorcat" poste sur un forum : ➡️ Exploit IDOR dans le gateway paiement Ledger ➡️ Accès aux commandes des 6 derniers mois ! ➡️ Données : nom/prénom, adresse postale complète, tel, email, statut shipped, produit (Ledger Nano etc.) ➡️ Script automatisé prêt à l’emploi + extraction toujours en cours ➡️ Prix : 15k$ et c’est exclusif ! Les screens montrent du JSON classique de commande e-commerce. Rien sur tes seeds, tes clés privées ou tes cryptos. Juste des données clients e-commerce Mais on a déjà vu ce film !! Rappelez-vous avril "xorcat" sort un "gros hack" Polymarket avec +300k enregistrements. Il parlait d’API undocumented, pagination bypass, CORS misconfig Polymarket a répondu : "Ce sont juste des données PUBLIQUES accessibles via nos APIs on-chain. Vous scrape ce qu’on donne gratuitement et vous essayez de le vendre comme un exploit" Même schéma ici... Janvier 2026 : brèche chez Global-e, le prestataire paiement/logistique de Ledger Exactement les mêmes données : nom, adresse, tel, email, détails commandes Ledger Nano, statut shipped !! Ledger avait notifié les clients concernés + communiqué officiel Aujourd’hui "xorcat" ressort exactement le même type de données en les faisant passer pour une nouvelle IDOR live dans le gateway Ledger lui-même "Extraction toujours en cours" ? Ouais, ou alors c’est juste les restes du Global-e qui circulent encore sur le dark web !! Déjà vu ça des dizaines de fois : hackers en mal de reconnaissance qui repackagent une vieille fuite et la revendent comme du neuf L’IDOR en elle-même est techniquement possible mais pas neuf ! Oui, une IDOR (Insecure Direct Object Reference) sur un gateway paiement, c’est tout à fait plausible Tu changes juste l’ID de commande dans l’URL ou l’API (order/12345... order/12346) et bam, tu lis les infos d’un autre client si le backend n’a pas mis de vérif d’autorisation ! Script Python + requests = 20 lignes max ☝️ Mais Ledger a déjà morflé plusieurs fois (2020 + Global-e). Leur monitoring est au taquet. Une IDOR massive et active pendant des mois sans être détectée ? Mouais ça sent le hype commercial plus que le zero-day révolutionnaire !! Aucune preuve technique concrète fournie par "xorcat" (pas de PoC public, pas de dump frais). Juste des screens et du bla-bla Bref pas de nouvelle catastrophe. Juste du bruit recyclé ! Business habituel... revente de vieux trucs en mode nouveau hack du siècle... Même pattern que Polymarket. Même données que Global-e. Même absence de preuve fraîche !! Restez vigilants, faites votre propre DYOR, et surtout ne payez jamais un hacker pour un "exploit" 👋 @BTChip un avis ?... #Cybersécurité #Ledger
Kruptos tweet mediaKruptos tweet media
VECERT Analyzer@VECERTRadar

🚨 CYBERINTEL ALERT: ALLEGED IDOR VULNERABILITY IN LEDGER PAYMENT GATEWAY 🇫🇷💳🔐 [STATUS: UNCONFIRMED / CRYPTO PAYMENT DATA EXPOSURE] VECERT Intelligence has detected posts made by the threat actor "xorcat," in which they claim to have identified an alleged IDOR (Insecure Direct Object Reference) vulnerability within infrastructure associated with Ledger. The actor asserts that this flaw would allow unauthorized access to customer information and recent payment details related to Ledger devices. 🏢 Allegedly Affected Entity: Ledger. 👤 Threat Actor: xorcat. 📂 Allegedly Compromised Assets: Customer Information: Names, physical addresses, phone numbers, and email addresses associated with purchase orders. Payment and Shipping Data: References to shipping statuses and products related to Ledger Nano devices. Access via IDOR: The actor claims that the vulnerability would allow for the enumeration and extraction of records without proper authorization. Exploitation Scripts: Publication of alleged scripts designed to automate the mass extraction of information. 📅 Report Date: May 10, 2026. 📊 Technical Analysis of Evidence (VECERT Intelligence) The published evidence suggests a potential exposure scenario linked to insecure access controls: Possible IDOR Vulnerability: The information displayed aligns with typical patterns of object enumeration or exposed internal references. Risk of Crypto Customer Exposure: The correlation between personal data and hardware wallet purchases heightens the risk of physical targeting and spear-phishing. Commercialization of Exploits: The actor claims to be selling exclusive access and extraction tools, which could facilitate exploitation by third parties. ⚠️ Risk Implications Threat to Hardware Wallet Users: The exposure of information associated with physical wallet owners could facilitate targeted campaigns and extortion attempts. Social Engineering Risk: The leaked data could be utilized for phishing attacks related to Ledger and for the fraudulent recovery of assets. Exploitation Persistence: The availability of automated scripts increases the risk of continued abuse should the vulnerability exist. 🛡️ Cyber ​​Defense Recommendations 🔒 Access Control Auditing: Review the validation of direct objects and internal references exposed within APIs and payment gateways. ⚙️ Enumeration Monitoring: Detect anomalous patterns of sequential queries and automated scraping. 🛡️ Customer Data Protection: Minimize the exposure of sensitive information in API responses and tracking systems. 🔍 Forensic Investigation: Verify suspicious access attempts, potential historical data exfiltrations, and activity linked to IDOR exploitation. Monitor: analyzer.vecert.io #CyberSecurity #Ledger #CryptoSecurity #IDOR #ThreatIntel #CyberAlert #DataExposure #InfoSec 🇫🇷💳🛡️⚠️🚨

Français
4
5
19
3K
Nicolas Bacca retweetledi
fricoben
fricoben@Fricoben·
LFG Labs received a grant from the @ethereumfndn to build Verity. Verity is a formally verified smart contract compiler written in Lean 4 🧵
fricoben tweet media
English
13
20
140
12.1K
Cryptoast
Cryptoast@CryptoastMedia·
🚨 Une boutique Bitcoin ferme à Paris face à la hausse des agressions crypto Le Bitcoin Bazar met fin à son point de vente physique, alors que les attaques visant les détenteurs de cryptos se multiplient en France. Tous les détails👇 cryptoast.fr/?p=211395
Français
7
4
38
7.2K
Nicolas Bacca retweetledi
Bitcoin Bazar
Bitcoin Bazar@bitcoinbazar21·
🚨 La boutique physique Bitcoin Bazar fermera définitivement ses portes mercredi 13 Mai au soir. Le site e-commerce reste lui parfaitement opérationnel et tous les bitcoiners ayant à coeur commander leur matos anonymement pourront continuer à le faire en payant en Bitcoin + choisissant la livraison en Locker. Il vous reste donc 3 jours à partir de lundi 11 Mai pour venir faire vos emplettes et tout dévaliser pour ceux qui préfèrent venir sur place et payer en espèces, après il faudra faire le maigre effort de payer en sats pour les paiements cash via le site. L'aventure de la boutique physique fut incroyable même si trop courte et idéalement ça aurait du durer encore. Mais parfois il faut savoir faire des choix et aller de l'avant. Ça aura été quand même l'occasion de constater que les bitcoiners et autres défenseurs de la liberté sont légions, bien plus nombreux qu'on ne le croit. Que la self-custody est un réflexe pour la majorité contrairement aux idées reçues, et que la protection de vie privée et de la propriétée tient à coeur à de plus en plus de gens. Et heureusement étant donné les véléïtés toujours plus totalitaires de nos étatistes favoris. N'écoutez pas trop le fud, voyez le verre à moitié plein, l'adoption (la vraie pas les ETF/Treasuries et autres shitcoinery) augmente constamment. WGMI. Continuez à nous suivre, le site bitcoinbazar.fr va continuer à vivre et à proposer toujours plus d'outils dédiés à la souverainneté et à la protection de vie privée. Certainement aussi du contenu éducatif : lightning, achat p2p, nostr pour permettre au plus grand nombre d'utiliser au mieux bitcoin comme il se doit: sans tier de confiance et de manière privée. Et n'oubliez jamais: Stay humble, and stack sats --------------------------------------------- 🚨 The physical Bitcoin Bazar store will permanently close its doors on the evening of Wednesday, May 13. The e-commerce website will remain fully operational, and all bitcoiners who care about ordering their gear anonymously will still be able to do so by paying in Bitcoin and choosing locker delivery. That means you still have 3 days starting Monday, May 11, to come shop in person if you prefer paying cash on-site. After that, you’ll have to make the tiny effort of paying in sats for cash-equivalent purchases through the website. The adventure of the physical store was incredible, even if far too short, and ideally it would have continued longer. But sometimes you have to make choices and move forward. It was still an opportunity to realize that bitcoiners and other defenders of freedom are everywhere — far more numerous than most people think. That self-custody is second nature for the majority, contrary to popular belief, and that protecting privacy and property matters deeply to more and more people. Thankfully so, given the increasingly totalitarian tendencies of our favorite statists. Don’t listen too much to the FUD. See the glass as half full. Adoption — the real kind, not ETFs, treasuries, and other forms of shitcoinery — keeps growing steadily. WGMI. Keep following us: the bitcoinbazar.fr website will continue to live on and offer more and more tools dedicated to sovereignty and privacy protection. Probably educational content too: Lightning, P2P buying, Nostr — helping as many people as possible use Bitcoin the way it was meant to be used: without trusted third parties and in a private manner. And never forget: Stay humble, and stack sats.
Bitcoin Bazar tweet media
Français
58
62
256
31.9K
Nicolas Bacca
Nicolas Bacca@BTChip·
@FranceCryptos On est à 2 doigts de se rendre compte qu'un état a des prérogatives que n'a pas un opérateur privé
Français
1
0
8
703
France Cryptos 🔗
France Cryptos 🔗@FranceCryptos·
🚨🇫🇷 Pavel Durov accuse le gouvernement français de faire exactement ce qu'il reproche à X. Selon lui, l'État français collecte illégalement des données personnelles. Il précise que ces données sont traitées sans aucune garantie de sécurité. Il ajoute que des informations sont extraites de systèmes automatisés. Il dénonce enfin une violation du secret des communications électroniques.
France Cryptos 🔗 tweet mediaFrance Cryptos 🔗 tweet media
Pavel Durov@durov

🥖 The French government is accusing X of the very things the French government itself is doing: - Illegally collecting personal data - Processing personal data without proper security - Extracting data from automated systems - Violating the secrecy of electronic communications

Français
8
17
92
9.3K
Nicolas Bacca retweetledi
Azeez
Azeez@AtlasInference·
Atlas is open source! An inference engine written from scratch in Rust + CUDA. No PyTorch, no Python, no 200-dependency install dance. <2 min cold start, BUILT for GB10 Qwen3.6-35B at 130 tok/s on a single DGX Spark. Demo powered by @Gradio 🧵 atlasinference.io
English
27
58
298
35K
Nicolas Bacca retweetledi
V4bel
V4bel@v4bel·
💥 Introducing "Dirty Frag" A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail. No race, no panic on failure, fully deterministic. ~9 years latent. Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more. Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation. Details: dirtyfrag.io
GIF
English
41
704
2.1K
520.5K
Nicolas Bacca
Nicolas Bacca@BTChip·
@Capetlevrai @gillesCadignan @agathedavray Tout le monde peut devenir meilleur dans son métier avec l'IA oui, les soucis arrivent quand on commence à croire qu'on peut faire le métier du voisin excellent dans son domaine sans apprentissage grâce à l'IA
Français
1
0
4
58
CAPET ☀️
CAPET ☀️@Capetlevrai·
@BTChip @gillesCadignan @agathedavray La vraie raison c’est que les salaires ça coûte cher et que le chiffre d’affaire se calme pour absolument tout le monde On peut aller plus vite sur la partie gestion client avec l’IA c’est factuel.
Français
1
0
1
78
Nicolas Bacca
Nicolas Bacca@BTChip·
@gillesCadignan @agathedavray La vraie raison c'est plus que les analyses de marché en crypto sont très immatures donc le pilotage des recrutements se fait au doigt mouillé. Et accessoirement les boîtes Bitcoin sont mortes quelques années avant les boîtes crypto 🐼
Français
1
0
5
157
Gilles Cadignan
Gilles Cadignan@gillesCadignan·
@agathedavray L’excuse de l’IA est bidon. La vraie raison c’est que la « crypto » c’est dead.
Français
4
0
29
1.8K
Nicolas Bacca
Nicolas Bacca@BTChip·
AI can make you much better at what you do best - devs become legendary 10x developers, PMs see all the inefficiencies at a glance, managers get a perfect swing without anybody noticing, or it can amplify your unknown unknowns just as much. Choose wisely (choose self custody)
Brian Armstrong@brian_armstrong

This is an email I sent earlier today to all employees at Coinbase: Team, Today I’ve made the difficult decision to reduce the size of Coinbase by ~14%. I want to walk you through why we're doing this now, what it means for those affected, and how this positions us for the future. Why now Two forces are converging at the same time. We need to be front footed to respond to both. First, the market. Coinbase is well-capitalized, has diversified revenue streams, and is well-positioned to weather any storm. Crypto is also on the verge of the next wave of adoption, with stablecoins, prediction markets, tokenization, and more taking off. However, our business is still volatile from quarter to quarter. While we've managed through that cyclicality many times before and come out stronger on the other side, we’re currently in a down market and need to adjust our cost structure now so that we emerge from this period leaner, faster, and more efficient for our next phase of growth. Second, AI is changing how we work. Over the past year, I’ve watched engineers use AI to ship in days what used to take a team weeks. Non-technical teams are now shipping production code and many of our workflows are being automated. The pace of what's possible with a small, focused team has changed dramatically, and it's accelerating every day. All of this has led us to an inflection point, not just for Coinbase, but for every company. The biggest risk now is not taking action. We are adjusting early and deliberately to rebuild Coinbase to be lean, fast, and AI-native. We need to return to the speed and focus of our startup founding, with AI at our core. What this means To get there, we are not just reducing headcount and cutting costs, we’re fundamentally changing how we operate: rebuilding Coinbase as an intelligence, with humans around the edge aligning it. What does this mean in practice? - Fewer layers, faster decisions: We are flattening our org structure to 5 layers max below CEO/COO. Layers slow things down and create coordination tax. The future is small, high context teams that can move quickly. Leaders will own much more, with as many as 15+ direct reports. Fewer layers also means a leaner cost structure that is built to perform through all market cycles. - No pure managers: Every leader at Coinbase must also be a strong and active individual contributor. Managers should be like player-coaches, getting their hands dirty alongside their teams. - AI-native pods: We’ll be concentrating around AI-native talent who can manage fleets of agents to drive outsized impact. We’ll also be experimenting with reduced pod sizes, including “one person teams” with engineers, designers, and product managers all in one role. In short: AI is bringing a profound shift in how companies operate, and we’re reshaping Coinbase to lead in this new era. This is a new way of working, and we need to leverage AI across every facet of our jobs. To those who are affected I know there are real people behind these decisions — talented colleagues who have poured themselves into this company and our mission. To those of you who will be leaving: thank you. You’ve helped build Coinbase into what it is today, and I am sincerely grateful for everything you've done. All impacted team members will receive an email to their personal account in the next hour with more information, and an invitation to meet with an HRBP and a senior leader in your organization. Coinbase system access has been removed today. I know this feels sudden and harsh, but it is the only responsible choice given our duty to protect customer information. To those affected, we will be providing a comprehensive package to support you through this transition. US employees will receive a minimum of 16 weeks base pay (plus 2 weeks per year worked), their next equity vest, and 6 months of COBRA. Employees on a work visa will get extra transition support. Those outside of the US will receive similar support, based on local factors and subject to any consultation requirements. Coinbase prides itself on talent density. Our employees are among the most talented people in the world, and I have no doubt that your skills and experience will be highly sought after as you pursue your next chapters. How we move forward To the team that is staying, I know this is a difficult day. We’re saying goodbye to colleagues and friends you've been in the trenches with. But here’s what I want you to know as we move forward together: Over the past 13 years, we have weathered four crypto winters, gone public, and built the most trusted platform in our industry. We’ve made it this far by making hard decisions and by always staying focused on our mission. This time will be no different – nothing has changed about the long term outlook of our company or industry. And most importantly, our mission has never been more important for the world. Increasing economic freedom requires a new financial system, and we’re building it. The Coinbase that emerges from this will be more capable than ever to achieve our mission. Brian

English
2
0
21
1.3K
Nicolas Bacca
Nicolas Bacca@BTChip·
QF shill : DefiScan asks the hard questions nobody else is asking regarding your favorite protocol, putting decentralization first. The Protocol Analysis is also a great way to get a bird's eye view of complex interactions. -> qf.giveth.io/project/defisc…
English
0
1
7
624