I was thinking earlier about all these attacks on Bitcoin infra
And Adam bless him has suffered more than most in recent years, it seemed like he was being singled out
But was he just early to the targeted by the scammers routine!?
Now that we've seen CC, Boltz, BTCpayserver and many others very recently get targeted
It feels almost normal now to post on X that your services are down due to unforseen circumstances
The stigma that Adam faced has disappeared, anyone that halts operating is given a free pass now, it's OK, they're being attacked by ai, everyone is getting it atm
Made me wonder about our very own institution SN, k00b, sox, Scoresby, ek and more.....
Is SN battling AI attackers currently?! Maybe it's a game theory not to confirm or deny
How about Justin at SW, Evan at Zeus (i think there has been an issue thinking about it)
Is this the norm now? Everyone's infra just gets continually bombarded with threats until you either crack or put in enough resources to thwart off the invaders!
Seems like a relentless task to keep the intruders from the door, until it is they get attracted to a more lucrative option, like legacy banking infra or telecoms
Not a nice position to be in, but at least Adam can say, see! This is what it's like 😢 ðŸ˜
When I first looked at Coinos wallet several years ago now I looked at reviews at some platform I think it was trustpilot or the like anyway the reviews were both harsh and looking more closely clearly fake and malicious.
There were clusters multiple bad reviews all done on the same day.
I made complaint to the platform and some of these obviously fake and malicious reviews were removed.
My feeling at the time was that Coinos was being targetted, quite likely by competing wallets- because Coinos offer such a low cost and excellent product and the rentseeking competing wallets cannot compete so they diss instead.
I cannot prove this but my hunch is based on the plethora of boosting and touting of other wallets that is found online.
My experience using Coinos has been great- its so easy to use and the low fees are amazing- my impression is that it is operated by a true Bitcoin enthusiast- whenever there has been a problem there has been very swift and good support.
I suspect that not just the 'bad' and fake online reviews but also potentially some of the attacks on Coinos have been from malicious competitors- but such attacks have ultimately failed (so far) and only make Coinos stronger.
While I would never put a very large amount of sats on Coinos I do use it as my primary LN wallet - and yes it requires some trust of the operator and some small risk of the funds deposited- but if we are to build a broader use of sats we need operators like Coinos.
Long live Coinos!
Coinos has been one of the best Lightning Wallets for many years!
Was there an recent SN post or Update concerning CoinOS?
I have recently had issue sending form CoinOS but wondering if I missed an announcement.
No one was singling or is singling out anyone. It's just about low hanging fruit. All the fruit hangs a lot lower now, because the paradigm shift is about cost to attack. So the things that were hard to spot a month ago are now easier to spot, and need less effort to be stolen. And it's a bit of a race to identify what's up and what needs to be defended.
Liquid things go first. Bitcoin, banks, high value information. Once all the low fruit has been plucked, other, lower value things are next. Especially: large repositories of data that can be held hostage. You're just seeing it here first. If you're in any other business that has any data (most businesses do) you're just down in the queue a bit. If I were working for any non-Bitcoin company, I'd be doing the beefing up right now. At full expense.
That's exactly what I wanted to say but you put it more eloquently lol 😆
There's another, deeper issue though: devs have been losing control over their code.
I do the dependency hygiene for SN a couple of times per month and twice in a row have I found verified regressions in upstream packages coming from bugfixes, that according to their authors are written by bots. High-end, state of the art, bots.
This is bad, because it is debt. Plus I have to spend shittons of time to check if such a regression has impact, so it is super costly on the consumer side. Note that these are packages with 100s of 1000s of deployments, and for sure, "automated security" like socket.dev didn't see it - thus far it has called me out with false positive findings every single time, but not once has it alerted on a regression that I spotted.
So, I think that if you are a serious project then your security budget, even if it is just measured in the time you spend plus maybe some tokens, must go up. Preferably yesterday.
It has been a game of whack-a-mole all this year, with ever rising diffuculty levels. Even 24/7 AI defence mounted by great devs at Boltz gave way eventually.
There's a selection effect worth naming: successful infra that survives attacks quietly never posts about them, so the visible 'targeted' set is skewed toward those that either got hit hard or chose transparency. Adam's case was different — the accusations were aimed at his character, not just his service. The normalization you're describing is real for 'we had a security incident' posts, but it shouldn't be used to retroactively launder reputational accusations that were never substantiated.
reproducible builds prove the artifact matches the source, they don't say the source is any good. a bot commits a clean looking bugfix that's secretly a regression and it ships because nobody reads the diff anymore
Note the footer in our Lightning.Pub README, Lightning software has always been a target, and we've been hit before.
I commiserated with Ben Arc a few years ago at a conference once as LNbits too had been hit with nearly identical exploits.
Pub is only hard to the extent it is because it's a honeypot that's been running in the open for several years now.
Minimal damage in both cases since we treat the node accordingly, as a hot wallet in an adversarial environment. We log extensively and caught both almost as they were happening and patched within hours. The latter in particular would have earned more by asking for a bounty vs. what they stole. The first actually donated back some sats as they had to deposit to do the race and we rugged them mid-exploit.
I also run AI against our production logs to see what probing is happening and to get ideas for other things we can check.
When GLM 5.2 dropped we found a few other edgey things that weren't a risk to the operator, but to ndebits users if a linked app was hostile, and patched those.
We also recently patched something a hostile Boltz operator could have exploited found by GPT 5.6 Sol (swaps have been default-off anyway while we dogfooded, was never shipped to the front-end, and now with Boltz transitionally dead we're waiting to see what happens before we either add Loop or actually ship Boltz Swaps to the front-end)
After the 2024 attack we implemented a Watchdog service that immediately shuts down the Pub if the LND and database delta grows beyond some HTLC flap.
Won't divulge much about the LND environment itself but it's been comfy, so far.