Tammy Yang

Recap of previous: Hack began with fake email signed by official x.com server: x.com/bafuchen/statu… Hour 0 · Min 20 — Was X hacked? Or just an employee? 🚨 Twenty minutes into the breach, the scammer pulls off the impossible: sporting an official X-employee badge. @alypetru’s account backed every scam post with an X badge, making them feel “credible.” That's the wildest part of this whole thing. I couldn’t tell if the attacker hijacked a staff account or somehow got control of X’s badge system to link the company badge on any account. The scammer’s like a raccoon wearing a Rolex. @Support? Still silent. After about 20 minutes, something even crazier happened. All traces of this employee account with the X badge vanished—poof, gone without a trace. Meanwhile, the hacker kept posting fake meme coin nonsense on the @numbersprotocol account. My questions were: * If it was an X employee’s account that got hacked, and X itself was fine: once the account was recovered, @Safety should’ve been alerted and shut down other compromised accounts fast. * Or, was X itself hacked? That would explain everything. Things flipped so fast; stuff I saw one second was gone the next. All I could do was keep grabbing evidence and snapping photos with our ProofSnap App and wrote everything onto blockchain. Photo proof of the hacker rocking the X company badge: asset.captureapp.xyz/bafybeif2malng…

During the @numbersprotocol X hack, I realized it might be part of something bigger, not just a single‑account breach. So, I have decided to write the full stories and share them. I will also provide my takeaway and suggested actions at the end of every post. I hope this never happens to you, but if your account or company is ever hacked, perhaps this series will help. Hour 0: Min 0 – 2FA, email signatures—are they really safe? It began on a quiet Sunday. I tried logging into @numbersprotocol via Google Sign-in—but instead landed in a strange new account. On the app, settings vanished. Something was wrong. I panicked a little, yet because the company account had 2FA protection I thought everything would be OK. I was wrong. Five minutes later I received an official‑looking email from Alyssa Petru (@alypetru)—sent and signed by x.com—claiming X had detected an unusual log‑in and asking whether I needed help. As the email signature and header looked legitimate, I replied and shared the log‑in challenge. The reply asked for ‘social proof’, requesting that I provide a Telegram code. Although the email looked legitimate, the behaviour was suspicious. I withheld the Telegram code, and the emails ceased. Soon afterwards my co‑founder @tammyyang0 told me that a community member was asking whether our X account had been hacked. I knew my peaceful Sunday was over. Lesson of Hour 0: Tech is never 100% secure. I’m a tech founder—I use 2FA, inspect headers, and stay alert. But it wasn’t enough. Tomorrow I’ll show how even the X badge system was compromised. If you are interested in this story, like and share; I will release one every day. Photo proofs: 1. Email sent by x.com: asset.captureapp.xyz/bafybeiacpfwhl… 2. Grok's comment about 2FA: asset.captureapp.xyz/bafybeieivm2s5…

🙌 To celebrate the recent success of NFT Search Engine we're running a special campaign! 📆 Holding period: 2nd June - 7th July 2022 💰 Reward pool: 5000 USDC 🪙 Min holding amount: 300 NUM 🏆 Total winners: 50 Find out more here: link.numbersprotocol.io/3z2DXRh