标签：#crypto

Interesting research on a new class of weak RSA keys: keys with lots of zeros. It turns out that these keys are out in the wild. The badkeys project is an open-source service that checks public keys for known vulnerabilities. While developing this tool, Hanno collected a massive number of real-world keys from public sources, including Certificate Transparency logs, internet-wide TLS and SSH scans, PGP keys, and many others. By searching this dataset for unexpectedly sparse RSA moduli, we uncovered a large number of keys in the wild with the patterns in Figure 1...

If you ship a desktop app outside an app store, you eventually hit the same wall: how do you check a license when the user is on a plane, behind a corporate firewall, or just offline? Calling your server on every launch isn't an option. Here's how offline activation actually works, without the hand-waving. The naive version, and why it breaks The first thing everyone reaches for is "call home on launch, get back yes/no." It works in the demo and fails in the wild: No network = no app. Fail-closed locks out paying customers. Fail-open means anyone who blocks your domain runs free. Both are bad. A boolean is forgeable. If your app trusts a {"valid": true} response, a proxy or a patched DNS entry returns that for free. The fix isn't a better endpoint. It's moving the trust off the network and onto cryptography. The model that works: signed leases The durable pattern is a cryptographically signed lease (Keygen calls these license files, Keylight calls them leases — same idea): On first activation, the device talks to the server once . The server returns a small signed document: the license state, an expiry, the device binding, and any entitlements (which features/tiers are unlocked). The document is signed with the server's private key (Ed25519 is the modern choice — small, fast, boring in the good way). Your app ships the matching public key and verifies the signature locally on every launch. No network needed. Because the app only ever verifies with a public key, there's nothing secret in the binary to steal, and a forged lease fails the signature check. That's the whole trick: the server vouches once, math vouches forever after. first launch ──► server signs lease (Ed25519, private key) ──► stored on device every launch ──► app verifies signature (public key) ──► no network Device binding (so one key isn't infinite installs) A lease is bound to a device so a single license can't be pasted onto a thousand machines. The lease embeds a device fingerprint, and the SDK ch

Save up to $190 on your pass to TechCrunch Founder Summit 2026. Early Bird pricing ends today, at 11:59 p.m. PT, after which rates increase. Register now.

Diagrid has announced the release of Dapr 1.18, introducing what it calls Verifiable Execution, a new set of capabilities designed to bring cryptographic trust, provenance, and tamper-evident execution records to distributed applications and AI agents. By Craig Risi

I run brand and product work for crypto and fintech companies, and this year the same request keeps landing on my desk, worded slightly differently each time: we don't want to look like crypto anymore. It comes from payment companies, exchanges, stablecoin startups — the ones that spent years looking like "the future" and now want to look like a bank. Or rather, a neobank. The first thing they ask to kill is the gradient. This isn't taste finally maturing. It's regulation. Under MiCA you can't operate in European crypto without a license, and a licensed company that still looks like a 2021 DeFi protocol has a problem its lawyers can't fix. So the whole industry is quietly repainting itself toward "trustworthy." Here's the trap I keep watching people walk into. The gradient everyone's fleeing is already being replaced by a new monoculture — the same off-white, the same restrained type, the same calm. Swapping a gradient for clean sans-serif feels like progress because it looks like the companies that already won (Stripe, Coinbase). But you're not them, and wearing the surface of a trusted brand doesn't make you inherit the trust. It's just a different uniform. The escape route became a traffic jam. The deeper issue: the audience flipped. For 15 years crypto brands were built for insiders who chose crypto because it wasn't a bank. The dark dashboard and the "to the moon" energy were tribe signals. But a licensed company now answers to regulators, banks, institutions, and normal people moving their salary — none of whom read a glowing gradient as "innovative." They read it as "unregulated." Same brand, overnight liability. And the part most people skip: trust isn't a color. It's spread across every surface you own, all the way down to the transaction detail nobody thinks about. A clean homepage in front of a 2021 dashboard isn't progress — it's a tell. The repackaging that works goes all the way down: the same restraint and clarity from the cold email to the onboarding

The prediction market giant Polymarket said it's refunding users who had funds stolen due to a third-party breach.

Twenty-five days on Hyperliquid. Sixty-five closed trades. P&L: -$9.21. Turns out that was the smallest wrong thing about it. The landing page showed -$7.72 because it uses a different P&L formula and excludes two open positions. Either number is small. Both numbers were also wrong about what they were telling me. I spent yesterday auditing every trade. The audit produced three findings I did not expect. Each one was a different kind of wrong. This is the first post in a series about ziom trader , my small AI-assisted crypto trading bot. "Ziom" is Polish for buddy, mate, or dude depending on who's talking. The name is unserious on purpose. The system is not. This is not a "watch me print money" series. The number is negative. Good. The point of the series is to track what happens when an LLM-assisted trading system moves from backtests and dashboards into live execution: where the bot is wrong, where the dashboard is wrong, where I am wrong, and which layer gets to prove it. Frame The natural first read of -$9.21 is "the strategy is losing money." That read assumes the displayed P&L attributes to the strategy. It does not. The number that shows up at the surface is the sum of at least three different layers: the strategy itself, the execution wrapper around it, and the monitoring layer that observes both. Each layer can author its own kind of failure. The displayed number compresses all three into a single dollar figure and loses the attribution on the way up. The framing that landed for me, from Daniel Nevoigt, is that methodology overview without forward-correlation disclosure is a log with good intentions. Same applies to P&L: total P&L without layer-attribution disclosure is a log with good intentions. You see the number. You do not see where it came from. Here is what I found when I forced the attribution. Layer 1: Shadow does not equal live Before deploying any lane, the system runs against backtested data. The shadow says "this strategy returns X over Y trade

Building a real-time crypto trading bot sounds like a weekend project — until exchange APIs return cryptic errors, WebSocket connections drop mid-trade, and rate limits turn your strategy into a debugging nightmare. After building my own bot from scratch, I learned that reliability is what separates a hobby script from a system that actually survives in production. This guide walks through the entire process: modular bot architecture, a real-time trading loop, plug-in strategies, backtesting, paper trading, and deployment to a $5 VPS — with production reliability patterns baked in from day one. Full source code included — the free AlgoTrak Backtest Lab on GitHub has 5 classic strategies, a complete backtesting engine, and Jupyter notebooks to get started immediately. Architecture Overview Before writing code, here's the modular structure we'll build: crypto_bot/ ├── strategies/ │ ├── rsi_strategy.py │ ├── macd_strategy.py │ └── ... # Plug in your own ├── core/ │ ├── trader.py # Data fetching + order execution │ └── logger.py # File + DB logging ├── config/ │ └── settings.json ├── cli.py # Entry point ├── bot.py # Main loop └── logs/ Each strategy is a standalone Python class. The trader handles exchange communication. The CLI lets you switch between strategies, symbols, and modes (paper vs live) without touching code. Real-Time Trading Loop Here's the core loop that runs every candle interval: while True : df = fetch_ohlcv ( symbol , interval ) signal = strategy . evaluate ( df ) if signal == " BUY " : trader . buy ( symbol , quantity ) elif signal == " SELL " : trader . sell ( symbol , quantity ) sleep ( next_candle_time ()) Three key points: fetch_ohlcv() pulls the latest OHLCV candle data from the exchange Your strategy evaluates the last N candles and returns a signal Orders execute only on valid signals — no guesswork Modular Strategy Example (RSI) Strategies follow a simple class interface. Here's a complete RSI strategy: import pandas as pd import pandas_ta a

If you've ever sent a transaction on Solana and wondered why it landed instantly one time and struggled another, you're not alone. Solana is incredibly fast, but how your transaction enters the network matters just as much as what you're sending. In this article, we'll break down Solana transaction processing in plain English — no developer jargon — and explain why landing services like Lunar Lander and Astralane can dramatically improve speed and reliability. The Big Picture: How Solana Handles Transactions At a high level, Solana works like this: You submit a transaction The network decides which transactions get processed first A validator includes your transaction in a block The transaction is finalized on-chain The key detail most users don't see is step #2 — how Solana decides which transactions get priority when the network is busy. That decision is driven by something called Stake-Weighted Quality of Service (QoS) . Stake-Weighted QoS (Explained Like You're Not a Developer) Solana has a built-in traffic management system. Think of it like traffic control for a highway. A Simple Analogy Imagine a highway with two lanes: 🚗 Fast lane (priority access) 🚙 Regular lane (everyone else) Solana prioritizes transaction traffic based on stake, meaning traffic originating from or routed through high-stake validators is more likely to be processed during congestion. Why? Because validators that stake SOL are financially invested in keeping the network healthy. Giving them priority helps protect Solana from spam and overload. What This Means for You Transactions that enter Solana through stake-backed paths have a much higher chance of landing quickly Transactions that enter through generic or overloaded RPCs compete for a smaller slice of capacity During congestion, non-priority transactions are more likely to be delayed or dropped This is the core idea behind Solana's stake-weighted QoS system. Where Transactions Usually Go Wrong Most wallets and apps send transactions t

Order warns of national security risks if post-quantum cryptography isn't adopted in time.

Four days left to save up to $190 on your pass to TechCrunch Founder Summit 2026 - the ultimate founder bootcamp - before Early Bird rates end on June 26 at 11:59 p.m. PT. Register here.

Here is a number that should reframe how you think about the agent economy: in roughly one year, AI agents moved about $73M across 176 million machine-to-machine transactions on a single exchange, at an average of around $0.31 per transaction , across 100k+ registered agents . Read that again. Agents are not "coming." They are already transacting, at scale, in production, right now. The interesting question is no longer whether autonomous software moves money. It is what those transactions are trusting - and what happens the first time that trust is misplaced. Payments scaled. Settlement did not. Almost all of that volume runs on payment rails. A payment rail does one job, and does it well: it moves a unit of value in one direction. Agent pays a service. Agent tips an API. Agent settles a micro-invoice. At thirty-one cents a pop, the failure modes are invisible - if a transaction goes wrong, you are out pocket change, and you move on. The problem is that a payment and a trade are not the same operation. A payment asks one question: did the money move? A trade asks a harder one: did **both * sides happen - or neither?* When your agent pays for something, there is one transfer and one direction of risk. When your agent trades - my asset for yours, your stablecoin for my token, one chain's value for another's - there are now two transfers that must both complete, or both not. The risk lives in the gap between them. One side sends; the other side is supposed to send back. On a payment rail, "supposed to" is doing an enormous amount of load-bearing work. The hidden assumption Every one of those 176 million transactions made an assumption that nobody had to state out loud: the counterparty will deliver. Between parties who already trust each other - a company and its own agents, two services under one operator - that assumption is fine. It holds because the trust was established off-chain, by humans, before the agent ever ran. But the entire promise of the agent economy i

Many of those videos were reportedly filmed on “near-perfect copies” of the Polymarket website, while featuring trades and winnings that were not real.

The Quest Begins (The "Why") Honestly, I was tired of staring at charts at 2 a.m., trying to catch that perfect entry while my coffee went cold. I’d set a manual alert, jump onto the exchange, click “buy”, and then second‑guess myself as the price slipped away. It felt like I was playing a never‑ending game of Whac‑A‑Mole, and I kept losing the mole. One night, after yet another missed opportunity, I thought: What if I could offload the repetitive bits to a script? Not a fancy AI that predicts the future—just a simple bot that watches the market, checks a condition, and places an order when the condition is met. If I could automate the boring part, I could focus on strategy, learning, and maybe even get some sleep. That was the dragon I wanted to slay: the exhaustion of manual trading. The Revelation (The Insight) The big “aha!” moment came when I realized I didn’t need to build a high‑frequency trading engine from scratch. There are solid, well‑tested libraries that handle the messy bits—authentication, rate limits, WebSocket connections—so I could concentrate on the logic. Using CCXT (a unified crypto exchange library) and a touch of asyncio , I could write a bot that: Connects to an exchange (I used Binance’s testnet so I wouldn’t lose real money). Polls the ticker for a symbol at a reasonable interval. Checks a simple condition—like “price > 20 % above the 20‑period moving average”. Places a market order if the condition holds, then waits for the next cycle. It felt like Neo dodging bullets in The Matrix when the bot finally executed a trade without crashing or getting rate‑limited. The relief was genuine: I could now let the code do the watching while I worked on the next idea. Wielding the Power (Code & Examples) The Struggle – A Naïve Loop My first attempt was a blocking while True loop with time.sleep . It looked harmless, but it had two nasty traps: Trap #1 – No error handling. A network hiccup would raise an exception and kill the whole script. Trap #2 – I

Most weeks in the agent economy look like a pile of unrelated announcements. This one had a theme hiding in it. Four different teams shipped progress on agent commerce, and if you line them up, they're all solving the same half of the problem — and all leaving the same half open. This is a builder's map. No leaderboard, no "who wins." Just what each thing is, what it does well, and the question none of them answer yet. The rails that shipped Mastercard Agent Pay for Machines. Mastercard's agent-payment program continues to roll, with 30+ partners spanning crypto and TradFi (Aave Labs, Alchemy, Anchorage, BVNK, Coinbase, MoonPay, OKX, Polygon, Ripple, Solana). The mechanically interesting part: agent payment authorizations get recorded to Polygon. A TradFi network is writing agent-spend permissions on-chain. That's a real signal about where this is heading. x402. Coinbase's HTTP-402 payment protocol keeps expanding its reach — it's now usable behind mainstream web infrastructure (AWS/CloudFront paths), which lowers the integration cost for ordinary web services to charge agents per request. Worth noting alongside the growth: standalone x402 transaction volume is well off its peak (OKX Ventures put the drop around 92% from the November high). The protocol is spreading even as raw volume cools — rails proliferate faster than they fill. Eco. A cross-chain stablecoin orchestration layer that abstracts routing, solving, and finality across ~15 chains. Where a payment intent can't move natively, Eco figures out the path. This is genuinely useful — it's the "make the stablecoin show up on the right chain" problem — but orchestration is routing, not atomic exchange. ERC-8004 (Trustless Agents). Not a rail at all — an identity and reputation layer for agents, with a v2 direction that leans into MCP. This is the one that actually points at the gap the others leave. More on that below. The thing they have in common Mastercard, x402, and Eco are all answers to "how does an agent

(or: How I Turned My Laptop Into a Lightsaber for the Market) The Quest Begins (The “Why”) Ever stared at a blinking cursor at 2 a.m., wishing you could make your laptop do the heavy lifting while you chased dreams (or just caught up on sleep)? I was there, scrolling through Reddit’s r/investing, watching folks brag about “algo‑trading gains” while I was still manually refreshing Yahoo Finance like a peasant in a medieval market. One night, after yet another failed attempt to predict a stock’s move with gut feeling (spoiler: my gut is terrible at math), I remembered a line from The Matrix : “There is no spoon.” Turns out, there is no magic either—just code, data, and a healthy dose of stubbornness. I decided to slay the dragon of emotion‑driven trading and build a bot that could execute a simple strategy while I binge‑watched Stranger Things . Spoiler alert: the first version was a hot mess, but the journey taught me more about Python, APIs, and risk management than any textbook ever could. Let’s walk through that adventure together—code, pitfalls, and all the triumphant “I‑did‑it!” moments. The Revelation (The Insight) The big “aha!” moment came when I realized a trading bot isn’t some omniscient AI that predicts the future; it’s just a disciplined executor of rules you define. Think of it as Indiana Jones whip‑cracking through a booby‑trapped temple: you set the traps (your strategy), the bot avoids them (risk checks), and grabs the idol (profit) when the conditions are right. For my first bot I chose a mean‑reversion idea: if a stock’s price deviates too far from its 20‑day moving average, I bet it’ll snap back. It’s not flashy, but it’s easy to understand, back‑test, and implement. The magic happens in three simple steps: Fetch data – pull recent price bars from a free API (I used Alpha Vantage; you can swap for Polygon, IEX Cloud, etc.). Calculate the signal – compare the latest close to the moving average and compute a z‑score. Execute – if the z‑score crosses

The crypto platform claims you can “pay anyone to do anything,” from quitting a job on camera to getting a memecoin-themed tattoo. But it mostly seems like people trying to scam each other.

Negative Risk (NegRisk) is one of the most powerful innovations on Polymarket for builders of sophisticated Polymarket trading bots . It dramatically improves capital efficiency in multi-outcome “winner-take-all” events by mathematically linking all related conditional tokens. Why Negative Risk Matters In standard multi-outcome markets, positions are completely independent. Betting against one candidate requires buying separate “No” shares across every other outcome — tying up large amounts of capital. Negative Risk solves this with a conversion operation : Holding 1 No share on any outcome can be converted into 1 Yes share on every other outcome in the same event. This happens atomically through the NegRisk Adapter smart contract. Economically: Betting against one outcome = betting for all others. Example (3-outcome election event): You hold 1 No on “Other”. Convert → Receive 1 Yes on Trump + 1 Yes on Harris. This makes hedging and market making far more efficient, especially in political, sports, or crypto events with 3–20+ outcomes. How to Detect & Trade NegRisk Markets Use the Gamma API for discovery: { "id" : "event-123" , "title" : "Who will win the next major election?" , "negRisk" : true , "markets" : [ ... ] } When placing orders via SDK (TypeScript/Python): const order = await client . createAndPostOrder ( { tokenID : tokenId , price : 0.42 , size : 500 , side : Side . BUY }, { tickSize : " 0.01 " , negRisk : true // Critical flag } ); Augmented Negative Risk (Dynamic Outcomes) For events where new outcomes can appear mid-trading (e.g., surprise candidates): Uses placeholders + “Other” bucket. enableNegRisk: true + negRiskAugmented: true . Avoid trading the “Other” outcome directly as its definition narrows over time. Technical Integration for Trading Bots Position Tracking — Track positions at the event level, not individual markets. Use conversion math for net exposure. Inventory Skew — In Shadow Market Making or live MM, apply inventory skew across the

A honeypot is the cleanest way to drain a trading bot on Solana: the token lets you buy , but there is no way to sell . Your agent spends real USDC, receives tokens, and then discovers the exit is welded shut. The position is worth zero and there is nothing to do about it. Honeypots don't show up on a price chart — the chart looks great, because everyone can buy and nobody can sell. You only find out at exit. So the check has to happen before the buy. What makes a Solana token a honeypot No live sell route — there is simply no route back to USDC/SOL on any DEX. The most common case. Transfer restrictions — Token-2022 extensions like transferHook or pausable let the creator block transfers (and therefore sells). Freeze authority — the issuer can freeze your account so the tokens can't move. Detect it in one call RugCheck AI is a remote MCP server. Point your agent at the endpoint and ask before any buy: simulate_sell("<mint>") -> { sellable: true|false, verdict: "..." } A token with no live sell route comes back sellable:false — that's the honeypot, even when nothing on-chain formally blocks the sell yet. For the full picture in one shot: scan_token("<mint>") -> { verdict: SAFE|CAUTION|DANGER, safety_score, sellable, risks: [...] } Or simulate the whole round-trip at your real size: simulate_trade("<mint>", 100) -> { buyable, sellable, exit_usd, round_trip_loss_pct } A honeypot shows buyable:true, sellable:false. A healthy token shows a small round-trip loss (slippage) and sellable:true. A real one I scanned a fresh pump token on 2026-06-17 (re-run to verify): scan_token returned DANGER, score 20 — no live sell route, 100% of supply held by a single wallet, $0 liquidity. An agent that bought it could never get out. That verdict is available before the buy, even though the token is too new to be indexed anywhere else. Wire it into your agent It's a standard Streamable HTTP MCP server. In Cline / Claude Dev, add an mcpServers entry named rugcheck-ai pointing at the end

Crypto Clipper spreads over USB and communicates over Tor.