tl;dr
Two critical security flaws put most websites at risk of attack.
Market Snap
Market Wrap
After BTF rallied close to $85k yesterday, Nasdaq futures took a hit after Tesla results once again raised concerns about the AI trade. Ken Griffin, founder and CEO of Citadel, made this claim at a Citadel conference on Tuesday in reference to AI stocks:
“The big picture is there is almost certainly bubbles … And any radical transformation of our economy is generally intertwined with a bubble.
What’s left in the wake of these bubbles, if we want to use that word, is often game changing for the world. And the companies that are on the other side of that bubble are the market leaders for decades to come.”
Occasional Series – Pretty scary, huh?
Interest expenditure is now the second-largest line item for the US and accounts for more than half the annual deficit. It is a similar situation for the UK and France. It is possibly sustainable for the US given the dollar’s status as the world’s reserve currency, and the impending explosion in the issuance of GENIUS Act-compliant USD stablecoins. The UK and France? Nah.
Curious Cryptos’ Commentary – The PHP problem
Researchers using AI models from OpenAI and Google have found two critical flaws in PHP that rank 9.2 in terms of severity on a scale of 0 to 10.
It’s likely that you have not heard of PHP before. It is a piece of software that runs on an estimated 70% of all websites, so there is little doubt you have already interacted with it this very morning. The problem is that in certain situations, a malicious attacker can run commands on any unpatched server running PHP, without ever logging in, known apparently as “unauthenticated remote code execution”.
“A flaw like this could let an attacker run their own code on an affected server over the internet, which can lead to stolen data, a defaced site, or a full takeover”.
The scope for feral scumbag scammers to exploit this problem is huge.
Patches for the bugs were released yesterday and have been deployed by many institutions and companies, including GoDaddy. Now that the issue is known about, any website which remains unpatched is at severe risk of being attacked, which in turn puts you at risk. Scammers are already at work exploiting this problem.
This is what you must do to keep your TradFi funds and your crypto funds safe.
TradFi
Be on the lookout for an increase in the number of scam calls. Anyone claiming to be from your bank, or HMRC, or your online broker, is a lying scumbag. I play with them, trying to keep them on the phone as long as possible until they realise they are wasting their time (a realisation that is always accompanied by a string of expletives resulting in the startling claim that I form part of the female anatomy) but I recommend you simply put the phone down.
I would advise you to check your banking app first thing every morning, but I know you do that already. The sooner you have identified and reported any banking or credit card fraud, the more likely it is you will get your funds back, and the less likely it is you will suffer any future loss.
Assume for now that any website you use is potentially compromised.
Cryptos
Any unsolicited phone calls are undoubtedly a scam. The conversation will usually turn to a request for you to input your seed phrase into a fake website. If you ever fall for that ancient trick, your cryptos have gone. My solution is to input the following 24-word seed phrase into the scammers’ website:
“F*** off you f****** feral scumbag scammer. Die a slow and painful death in front of your loved ones as they spit on you.”
As you are unlikely to sell your BTC anytime soon, secure access to it using a Ledger Nano stored off-site (probably at your bank) as one key in a multisig setup. Sign up for Ledger Recover of your seed phrase, and you no longer need to physically store the seed at home.
For alts for which you have got a detailed selling plan, keep a small amount on a centralised cryptocurrency exchange, enough to fill the first one or two sell orders. The remainder of your alts should be secured using a Ledger Nano again with Ledger Recover for this different seed phrase.
If you want to keep your alt-related Ledger Nano at home (which is not what I do), perhaps because you trade into and out of alts far too frequently for your own good, then some time spent researching various methods of increasing your crypto security would be useful. I could list them all here, but then the feral scammers will be in no doubt about what measures you might have taken, making the process rather redundant.
Revoke all permissions that you have granted to DeFi applications, probably via MetaMask. Better still, with no alts left in any of your MetaMask wallets, ditch them all and start again.
And for now, at least, I repeat – assume that any website you use is potentially compromised.