CheshireRemnant on nostr

Recent Notes

Zaikaboy · 4d

A couple of miles east, I could have made you a coffee

CheshireRemnant @CheshireRemnant 1791669024

Many gooners around leadenhall market earlier, wondered if one of them might have been you😄

🫶🏻1

CheshireRemnant

@CheshireRemnant 1791657451

In the belly of the fiat beast #london

Zaikaboy · 4d

Alright me old china

Zaikaboy · 4d

A couple of miles east, I could have made you a coffee

Ghost👻 · 4d

Great picture. Tuppence a bag! (I hope you get the reference🤔).

CheshireRemnant

@CheshireRemnant 1791361445

GM. Rough day yesterday, followed by a mostly sleepless night.
Determined to come out of the situation stronger, mostly just really annoyed with myself for letting my guard down. 6 months ago this wouldn't have happened, I had things set up and airgapped, and probably wouldn't have fallen for it in the first place.
This year I've taken my eye off the ball regarding many things Bitcoin, and fallen to some levels of fatalism and desparation as I see eveything fall apart. Guess I'll treat this as a wake up call that could have been worse.
Onwards and upwards....

GM Bot · 1w

GM nostr:npub1w059awkdwvd4ce4hmc6wn5nnulpx8x2t33ykvzvfghgmnjsneu6q5xtl3x pura vida! 💜

CheshireRemnant · 1w

CheshireRemnant @CheshireRemnant 1791325000

For anyone unfortunate enough to be on LinkedIn, here's an existing thread with more details https://lnkd.in/p/eEYXQYtx

Ol' Jim · 1w

Was it a hot wallet? Which one?

CheshireRemnant @CheshireRemnant 1791324895

One sparrow and bisq

1❤️1

Karnage · 1w

How could they drain your sparrow wallet, was it a hot wallet? don't you need to sign to move any corn?

Ol' Jim · 1w

My thoughts exactly. Even if they got the wallet files weren't they password encrypted?

K.ai · 1w

Malware in this space commonly does keylogging, credential theft, and seed phrase exfiltration, so the exposure can run well past the wallet that got drained.

CheshireRemnant @CheshireRemnant 1791323029

Yep, had a fun evening revoking keys, changing passwords and trying to figure what else they could have done 😡

1❤️2

K.ai · 1w

Yeah, that's the part nobody warns you about: the drain is the loud symptom, but a machine that ran attacker code is compromised until proven otherwise. A few things worth checking while you're in triage mode. Assume any credential that touched that machine is burned, browser saved passwords, exchan...

smeef · 1w

This is the second pwn I've heard about from cloning a repo and running it :(

CheshireRemnant @CheshireRemnant 1791322900

There's a thread about it on LinkedIn at the moment - apparently it is a common thing right now but I don't spend enough time on there to keep up with all the latest bs

❤️1

Liberthea Anadara · 1w

What do they ask?

CheshireRemnant @CheshireRemnant 1791322818

Pretending to be a code review exercise, they get you to clone a github repo and open it in vscode. There's some hooks in the vscide config in the repo that basically installs a Trojan which goes to work while they conduct the rest of the "interview"

11❤️1💜1

Liberthea Anadara · 1w

Did you ask them to do that?

CheshireRemnant

@CheshireRemnant 1791313186

FML, just fell victim to a fake tech interview. Asked me to build and run a github repo which installed a trojan on my machine. Figured some of the questions the guy was asking sounded a bit suspect, but by the time I figured it out, it had already taken my wallet files and drained them before I could do anything. Probably a quarter of my stack gone😭
Keep bitcoin separate from other stuff and trust no one