14:02:15 Kimi breakdown of the range proof bug that drained liquid btc last night (4000 total btc): https://gist.github.com/1440000bytes/211ac92dd4433bb1a2e674bf0ff7db2e 14:10:42 Bug B — ambiguous key encoding (introduced by the fix itself): the fix ("Fix caching bug in rangeproof caching", c26d719c29, PR #1561 — authored 2026-08-03 per its git author date) computes the key as a salted hash over the raw concatenation proof ‖ commitment ‖ asset-generator ‖ scriptPubKey with no length [... too long, see https://mrelay.p2pool.observer/e/u5PRragLOVR0OVpk ] 14:10:42 [... more lines follow, see https://mrelay.p2pool.observer/e/u5PRragLOVR0OVpk ] 14:11:37 plotwist: it was the dev lmao 14:22:56 Blockstream has been obsessively shilling their 'Jade' hardware wallet devices, ever since Coldcard the coldcard incident, of course presenting them as a safer alternative 14:23:39 It will be fun to see how the mental gymnastics go from there (I know the bug is unrelated to private keys) 14:27:56 @thomasbuilds:matrix.org: I think thats where i would suspect 15:40:57 Like snex said in a podcast 15:41:11 “Get coldcarded” 16:19:04 From that Kimi breakdown, towards the end: "he fix was authored 2026-08-03 and sat unmerged for ~4 weeks, then was public, clearly titled, and easily diffable for 3–5 days pre-attack ("Fix caching bug in rangeproof caching") — effectively a published exploit recipe. " 16:30:54 Inside job 16:31:11 As unreleased code, the person had to know that the "core" team was running it 16:31:35 The half of the network that halted /rejected it, was running release software 16:32:20 In that case, why would they publicly release info pertaning to how the exploit could be pulled off, before doing it themselves? 16:32:53 wdym? They did do it themself 16:33:40 > was public, clearly titled, and easily diffable for 3–5 days pre-attack 16:34:04 it was public for a month 16:34:15 Would it not be easier, if this was indeed an inside job, to only release that info after exploiting the network? 16:34:17 For a month 16:34:56 Release what info? It was an i merged pr for a month 16:34:57 I don't see how that changes anything 16:34:58 Unmerged* 16:35:21 5 days after merge, once core /50% of network was running it, they swept the platform 16:35:22 By "release info", I mean publicly submit the PR 16:35:41 I dont mean the author was the attacker 16:35:47 One would think that, if this was found internally first and they wanted to exploit it, they would do so before submitting the PR. 16:36:06 how could you exploit something that isnt live? 16:36:25 Tje exploit was only possibly once thatcode was merged 16:36:44 I'm retarded, nevermind 16:36:55 It was never released. It was merged, and core ran it 16:37:21 And core seems to have controlled over half of the network, and likely the majority of the endpoints used by wallets and other service providers 16:37:24 They got coldcarded xD 16:51:02 > Kept 598.5 BTC for himself. About 15%. "Sending most back" was literal. 16:51:02 Was the dev(s) 100% 16:51:34 yep 16:51:35 They just wanted money and obviously didn't want to kill the project 16:51:51 So that's the move they did lol 16:51:53 so does that mean they are going to dump it into zcash now? 16:52:06 or are those coins considered clean? 16:52:44 I never heard of this blockchain before but seems like there are bitcoin core contributors in it? 16:52:58 i guess it matters on the users jurisdiction, bcuz it doesnt matter what blockstream says, if the espionage is illegal, then the feds will be looking to trace them 16:53:05 its not a lockchain 16:53:22 its a sidechain iirc, like lightning, but custodial 16:54:10 Well bitcoin guys like XMR more than ZEC > <@ofrnxmr:xmr.mx> so does that mean they are going to dump it into zcash now? 16:54:11 adam back / blockstream product.. again, iirc 16:54:13 ? 16:54:55 ZEC started as a BTC fork before they abandoned the bitcoin core they started with 16:54:55 iirc 16:56:15 just a codebase fork tho, not a blockchain fork like bitcoin cash. now ofc their software's in rust 16:56:19 The ZEC pump was market pricing in that 😂 16:57:13 @jbabb:cypherstack.com: only one of the nodes, the reference node is still c++ 16:57:35 The repo was archived recently 16:57:50 oh damn eh. rip 16:58:01 I thought also zebra, the first rust client, was or is also on the way to being archived 17:01:21 (I thought wrong) 17:08:30 just opened my view-only wallet and received ~0.12 xmr and it looks like from mining, someone used my wallet for mining by mistake? how is that possible 17:08:43 https://mrelay.p2pool.observer/m/matrix.org/xfBqFExHitoiJNJfyvgJdYZL.png (image.png) 17:09:22 trying to scan main wallet to see if it's real... 17:09:50 oh sorry wrong chat 19:31:14 ufo808: maybe change from a tx you made? 19:32:07 UkoeHB: oh yea, it might be, it would actually explain everything 19:32:21 you might be right, thanks 19:33:12 oh but hm, I didn't do any transactions 11 days ago... anyways I'm still re-syncing with a different node nad from height 1, let's see 19:33:50 you can just sync from before the first tx that you see in the view wallet 19:34:17 remote node sync from block 1 is over 30gb 19:35:12 that's why it's so confusing, because I did it exactly, synced from 3744800 multiple times, both wallets 19:35:25 3744801 is the height of 0.12.. tx 19:35:32 did you sync the spend wallet? 19:35:53 come to #monero-support:monero.social if you think this will drag on 19:36:17 @ofrnxmr:xmr.mx: yes