@XBToshi: Crypto's multisigs and MPC setups fail when attackers target engineers

Submit
@XBToshi
@XBToshi

It's state-sponsored military cyber warfare against normal engineers working from home. Crypto spent billions building multisigs, KMS enclaves, and MPC clusters, but the adversary isn't trying to crack prime numbers. They find one tired DevOps dev on LinkedIn, send a poisoned PDF, and walk straight through the front door with full sudo rights. You can audit your smart contracts fifty times, but the human endpoint is always running zero-day vulnerabilities. Damn, Lazarus is good at breaking people.

ZachXBT (@zachxbt)

@SG2Trader @SpecterAnalyst Likely Lazarus Group (DPRK)

x.com

@XBToshi: Crypto's multisigs and MPC setups fail when attackers target engineers

submitted bytim12,5312h
1
Read original article
AI summary of the linked article

This post argues that crypto's multisig, KMS and MPC security setups are often defeated not through cryptographic weaknesses but by attackers targeting individual engineers. The author says attackers can find a DevOps engineer on LinkedIn, send a poisoned PDF, and gain full sudo rights, and that the human endpoint is a bigger weakness than smart contract code. The post attributes these attacks to Lazarus and describes them as state-sponsored cyber warfare against engineers working from home.

Recommended by 1 curator
misha
1 comment
avatar
misha· 17 minutes ago
Btw poisoned PDF is a thing; recommend to use Dangerzone to first open PDFs 🥷 ⚠️ https://dangerzone.rocks/

Featured on Kiwi News: this story reached #2

Featured on Kiwi News

Wrote it? Add the badge to your post or README:

Top stories that week →