Lasers. Microscopes. $250K. One secured chip. Ledger Donjon just showed how they cracked debug access on RP2350-A4, a break worthy of Raspberry Pi's own Hacking Challenge. Respin or no respin? Raspberry Pi says no. Read why: raspberrypi.com/news/everyth…

Breaking: Trump says he will ban reporters from POLITICO, CNN and MS NOW from the White House. politico.com/news/2026/09/18…

New evidence shows: (1) @Revolut did apply the one refusal ground the law gives it. (2) the attackers targeted in their malicious request high-value clients using blockchain transactions. Documents show that on 24 July 2026, on a request covering 198 hashes, Revolut refused direct disclosure for 169 tied to Revolut Ltd (UK) and 29 tied to a Swiss entity, redirecting the requester to UK mutual legal assistance. Only accounts held at Revolut Bank UAB in Lithuania were treated as covered by the EIO. The refusal ground available to Revolut was jurisdictional. They APPLIED it. EU AML law imposes no verification duty on the bank and provides no meaningful mechanism to check who is really behind an authenticated state request. Refusal to answer carries fines in the millions. In practice, verification is impossible. Now, how the attackers targeted high-value clients? Per Duel's verified .eml files, they used public blockchain data as query keys. Hundreds of crypto transaction IDs and deposit wallet addresses tied to suspected high-value Revolut users were submitted under the forged EIO cover. Revolut returned encrypted zip files with folders of ten customers each, ID pictures, verification selfies, account data, unredacted transaction data, with the password sent in a follow-up PEC. Anyone whose wallet address appears on-chain can be turned into a target this way. Self-custody does not close this door: the moment your KYC data sits with a regulated intermediary, the same channel opens.

Researching weak wallet generation incidents we found that even when we could identify affected addresses, we had no way to warn the users who were using them. Unlukey turns each known weak generation code into datasets that wallets can use to identify and warn users: coinspect.com/blog/introduci…

‼️ BREAKING: Duel can report that the Revolut hacker used a "spray and pray" strategy, sending hundreds of cryptocurrency transaction IDs to Revolut and asking for the associated account details. Revolut complied. This explains the sheer volume of data the hackers were able to obtain over several months. The hacker, who goes by the name "IAmNotAVillain," told Duel that he would present Revolut with hundreds of crypto transaction IDs and deposit addresses he believed to be associated with high value Revolut clients. Compelled by the fake "European Investigation Order," Revolut would send back large numbers of files containing all associated customer information. We received and verified authentic .eml copies of the emails sent by Revolut. One of the emails contained 10 folders, each one named after a customer. Each folder contained ID pictures, a selfie, account data, and transaction data, fully unredacted. For security, Revolut sent the password to the downloadable zip file in a separate email. It has been a point of curiosity in our investigation: how exactly did the hacker manage to pull off getting data specifically on high value clients? What did he ask for? Now we know. All he had to do was knock using data from public blockchains, and Revolut provided all of the requested information in a near-firehose format. We are working on a larger investigative piece that will answer a few more questions, including the fallout between "Villain" and "Smilik," more chat logs, and a video showing the extent of the hacker's files. We wanted to release this piece of information ASAP so that everyone was aware of how it was done.

Bold is the tree hiding the forest of friends who gave up on self-custody. After a decade, we simply did a poor job of educating people on how to use the chains safely. Stuck between being too dogmatic, pushing for purity of an overly complex system, and too reckless of yolo mode Let me try again; don't just bookmark this do it. Give the link to this tweet to your AI and have it help you: 1) Use @ambire as your main wallet; it handles simulation, complex tx, and is designed to work well with @safe 2) Deploy a Safe now. I don't care if it's a 1/1 linked to your hot wallet for now; it's fine. It's already better this way, and with Ambire, using it is seamless. YOU DO NOT HAVE TO USE THE SAFE UI; Ambire will do it all for you. 3a) Generate a real seed; use pen and paper. You'll get the fancy steel stuff later if you want. 3b) Too lazy for the seed stuff? ok, use a "hotwallet" for your signer generated with a passkeys with an good password manager, you have a Mac? The Passwords app is fine; you're a Revolut client? NordPass is included; you ready to spend a bit? 1Password has a great API, and you'll love it once you're AI-pilled. 5) The signer wallet must hold no funds, doesn't hold gas, doesn't do any txs; it's the key to unlock the door of your safe; it signs, and that's it. You'll learn later that proposing (creating tx), signing, and executing tx are 3 different jobs that don't need to be done by the same wallets. 6a) Now create a second hot wallet, "executooor," and send some gas to it, a few bucks of ETH suffice. Use gas.zip to have some gas on every chain you use. 6b) Don't want to do that? No worries, use the "gas tank" feature on Ambire; it does the same job you can always improve later. That's it for step one, and just that you're safer than Bold and 99% of guys out there. Step 2 is buying a hardware wallet and rotating the safe signer with it for much safer holding Once you're there, you can start considering a 1/2 with a second hw or with an old phone you have in your drawer that you've factory reset and will use only for that. You keep it out of easy reach; it's your insurance if something bad happens to your main signer. Then maybe a 2/3 and the nerdy stuff; you can always do "better," but the foundation of all that is getting your first safe deployed and climbing from there. Do it now; it's not hard, it's worth it.