A public iOS bug (worse_query) lets a malicious app read other apps' files. Seed phrases and keys sitting on the phone are the prize.
Readable ≠ signable.
Zengo splits signing into two MPC key shares. The one on your phone can't move funds alone.
Delete sideloaded apps. Update iOS. 🧘
Welcome to Zengo, @avax 🔺 The fast network behind AVAX now sits next to the rest of your crypto, secured by MPC and never hacked since 2018.
BREAKING: Avalanche is now accessible to 2M+ registered users worldwide through Zengo, an @etoro company.
Avalanche joins Zengo’s self-custodial ecosystem, bringing the network to a broader global audience.
Avalanche is live in Zengo.
Buy AVAX or swap into it, then send and receive, all in the self-custodial wallet you already use. No seed phrase.
Update the app to get started.
xitter.twitterapi.xyz/avax/status/2117980756…
BREAKING: Avalanche is now accessible to 2M+ registered users worldwide through Zengo, an @etoro company.
Avalanche joins Zengo’s self-custodial ecosystem, bringing the network to a broader global audience.
One laptop. ~$6.3B out the door.
When one machine can sign alone, that's the whole attack surface.
Zengo: two key shares, neither signs alone. 🧘
Where are your coins sitting tonight?
1
5
39,799
Stocks trade while you sleep now.
In Zengo, your stock tokens sit in a wallet you control.
Which ticker are you up for? 👀
1
2
729
Would you let an AI agent manage your wealth?
🟢 Yes, it's already better than me
🟡 Some of it, with hard limits
🔴 Never, I trust my own bad decisions
2
5
907
Stocks trade 24/7 now.
The wallet holding them shouldn't hinge on 24 words.
Robinhood Chain is live in Zengo 🪶 What are you holding?
5
703
1,404 wallets drained. Nobody leaked a seed. They were just guessable.
No seed phrase in Zengo. Two key shares, neither signs alone 🧘
Where was yours made?
Thanks for the shoutout 🧡 USDC that pays its own gas, in a wallet with no seed phrase. Arc fam, follow @ZenGo for what's next.
xitter.twitterapi.xyz/ArcInsiderHB/status/21…
This Post is from a suspended account. Learn more
4
685
Day 1 on Arc.
USDC pays its own gas. No spare token just to move dollars.
What are you sending first?
xitter.twitterapi.xyz/ZenGo/status/211040028…
Zengo now supports Arc.
On Arc, USDC pays its own network fees. Buy, swap, send and receive USDC without holding any other token just to cover gas.
Welcome, @arc
1
4
722
Verification only helps if you trust what's doing the verifying. Zengo took another route: no seed phrase, no hardware in the mail. Two key shares, neither signs alone.
xitter.twitterapi.xyz/peterktodd/status/2108…
Solid digging. Whatever the root cause turns out to be, the question is the same: who can sign? Zengo has no seed phrase to pre-generate, copy, or phish. Two key shares, neither signs alone.
xitter.twitterapi.xyz/exsiway_/status/210863…
so about the $86m ledger drain. everyone’s screaming “ledger got hacked” again. i spent the evening digging and it’s dumber and scarier than that
there’s a shop in malaysia called cryptobilis that sells hardware wallets. ledger has it listed as an official authorized reseller since at least 2022, for malaysia, indonesia and the philippines. legit shop, real devices, years of normal customers
this spring the founders sell it. the deal comes with an NDA: they can’t tell anyone about the sale until october 19
by august the company registry shows one owner with 100%. some guy from heilongjiang, china
the shop keeps running like nothing happened. the site, the name and the “authorized by ledger” badge all stay up
then on oct 8 @MagicalTux posts photos of a ledger he cracked open. hidden under the screen there’s an extra little board with an LTE modem and an eSIM. it just watches the display. you set up your wallet, your 24 words show up, and they get sent out over mobile data. ledger’s genuine check doesn’t catch it because the actual ledger chip is real. his device came from malaysia
xitter.twitterapi.xyz/MagicalTux/status/2108…
that post does 120k views
22 hours later someone sweeps everything. 203 BTC hits two addresses in literally one block. ~$58m USDT moves on tron in the same hour. i added up all the wallets: ~$91m
about 7 hours after that ledger says “we’re investigating” and asks cryptobilis to pause sales
cryptobilis is still on ledger’s site as an authorized reseller
to be fair, nobody has officially tied the new owner to the bugged devices yet, and ledger hasn’t confirmed how it happened. but read it as a business plan:
get authorized, sell real stuff for years, quietly sell the company under an NDA, keep the badge, ship devices that phone home, then drain everything the second someone notices
and was ledger even told the shop got sold? nobody’s said so
“authorized reseller” means ledger trusted whoever ran the shop back in 2022. says nothing about who runs it today
bought your hardware wallet anywhere but the manufacturer? open it up today, ledger literally has a guide for that. then move to a fresh seed on a device bought direct
wonder who’s going to answer for this: the chinese frontman from heilongjiang, the shop’s previous owners, or ledger itself
@Ledger clearly needs to keep a much closer eye on who they call official resellers, and take way more responsibility for who sells their devices and how
4
1,124
Your security shouldn't depend on who sold you the box.
Zengo: no seed phrase, nothing to ship. Two key shares, neither signs alone. 🧘
Box or math, which do you trust?
1
5
857
Seedless is having a moment 👀
Zengo was built without one from day one. Two key shares, plus a Recovery Kit (your email and a Recovery File in your cloud).
What made you ditch the seed?










