Register and share your invite link to earn from video plays and referrals.

Beau
@beausecurity
Former CIA officer - now safety @pudgypenguins
4K Following    32.1K Followers
Very obvious to me that “MAGA” is dead just as America also rejected “woke” last election I doubt this actually leads to moderate policy tho - think it’ll just be a back and forth between extremes The thing that stands out to me about the last 2 years is how DOGE cut all those jobs and somehow the gov spent more money 😂 Tired boss. Love the idea of America First but let’s actually act like it
Show more
Super important. Less than 10 days before Blur shuts down and yet there are still 98 @pudgypenguins and 64 @BoredApeYC there. GONDI built a bridge to make transferring your item in loan over easier. If you have any questions feel free to ping me. Thank you to @GrailsOTC and @beausecurity for also supporting their respective communities ❤️
Show more
The only thing that would sway my vote this election is being accosted by 10 party reps outside the polling place asking me if I want their recommended pre-filled ballot (this should be illegal)
The only thing that would sway my vote this election is six text messages from an unidentified number during my work day.
Get out and Vote today if you’re in the United States! The system is better when everyone participates (also don’t let dumber people than yourself decide the future)
🔐 SIGNAL IS ENCRYPTED. YOUR SETTINGS PROBABLY STILL LEAK YOUR NUMBER. Your messages are encrypted by default. The rest is up to you: your phone number, your lock screen, when you are online. Account (Settings > Account) • Set a Signal PIN. • Registration Lock: On. Without it, someone who SIM swaps your number can register your Signal account on their phone. It lapses after 7 days without using Signal. Privacy (Settings > Privacy) • Phone Number > Who can see my number: Nobody. • Phone Number > Who can find me by my number: Nobody. Create a username first, or new people can't reach you at all. • Screen Lock: On. An unlocked phone should not mean open chats. • Read receipts: Off. • Typing indicators: Off. • Advanced > Always Relay Calls: On. Calls go through Signal's servers, so your contacts don't see your IP address. Chats (Settings > Chats) • Generate Link Previews: Off. • Share Contacts with iOS: Off (iOS only). Data and Storage • Media auto-download: Off for everything. Nothing lands on your phone until you tap it. Notifications • Notification content: No Name or Content. Your lock screen shows nothing about who is writing or what they say. iOS Settings > Apps > Signal • Contacts: Off. Signal is only as private as your settings. This is the Signal baseline we use at
Show more
🚨LEGITIMATE GOOGLE EMAILS CAN STILL PHISH YOU!🚨 Imagine receiving a phishing email from a REAL Google domain... ✅ Legit "From" Google address ✅ SPF: PASS ✅ DKIM: PASS ✅ DMARC: PASS And it's STILL a scam (Scam that's been ongoing since 2023...)👀 Scammers are abusing legitimate Google email notification workflows to send phishing messages that pass traditional email authentication checks... Here's how the attack works⤵️ - Scammers manipulate a Google app or notification name to display a fake security warning such as "Fake app login", "Subpoena", and others.. The display shows the "App Name" but the "App Name" the scammer puts is the scam text... - Google sends the notification from its legitimate infrastructure, making the email appear trustworthy... - The email includes a legit link to your google account that leads to a dead end and a phone number to call if you need any support or assistance.. - The victim gets confused, calls the number, and the social engineering begins.... 📞THAT PHONE CALL IS THE TRAP! The attacker doesn't necessarily need a malicious link when they can convince YOU to call them... 🔐SO HOW DO YOU PROTECT YOURSELF NOW THEN? ✅ Still Check the sender "From": Expand the From field and inspect the actual address. ✅ Check authentication: In Gmail, open the three-dot menu in top left of email → Show original → Review SPF, DKIM, and DMARC, ensure it shows 'PASS' ⚠️ BUT HERE'S THE IMPORTANT PART TO CHECK NOW: Even if ALL THE ABOVE CHECKS PASS, the email can still be malicious! Authentication verifies aspects of where an email came from, NOT whether its contents are trustworthy. 🚩 Never call support numbers provided in unexpected security emails. 🚩 Don't trust an email simply because it came from a legitimate domain. 🚩 Open the company's official website or app yourself and independently verify the alert. Scammers are finding ways to exploit the very systems we rely on to identify legitimate emails. Your best defense isn't just checking WHO sent an email. It's verifying WHAT they're asking you to do. Stay Safe & Stay Vigilant
Show more
do these things, future-you will thank you also if you're not already following @beausecurity you really should be, he's been talking about this stuff for *years*, well before all the ai hacks started getting crazy
Show more
Just got a phishing email that Gmail authenticated as Google. DKIM/DMARC passed. I can see a lot of people falling for this one, since it plays to the idea that your account has already been compromised. Scammer puts the scam in an app-password name, triggers a real Google alert, then forwards the alert email to your email address. How this attack works, and why it’s convincing: 1. The trick: The attacker puts the threatening text and shortened URL into an app password’s customizable name on another account. Google incorporates that text into a real security notification and signs the email. 2. The delivery: That notification is forwarded through another mailbox to the victim. In this message, Gmail still recorded passing Google DKIM and DMARC authentication. 3. What makes it convincing: The Google sender, signature, branding, and “Check activity” button are legitimate. The suspected attacker-supplied text appears inside the same trusted-looking template, using a deadline to push you toward its separate link. 4. The giveaway: Both the notification and its genuine Google button refer to someone else’s account. The “permanent access after 24 hours” claim is false; app passwords can be revoked. Be careful out there folks!
Show more
0
109
3.9K
996
Forward to community
5 ways to improve your OPSEC in a couple hours this weekend: - buy @Yubico’s Yubikeys to replace insecure 2FA - sign up for @optery to have your personal info removed from data broker sites (I also have a discount code for anyone who wants it) - set up a new Gmail that isn’t tied to your name or shared with anyone. Use this email for your banking, CEX accounts, password manager etc - get a virtual mailbox set up to receive packages and mail somewhere other than at home - set up a 2nd phone number just to have on accounts where you can’t get rid of SMS 2FA (like your Apple ID) Any one of these things will measurably improve your personal security and they all can get knocked out in a couple hours You could bookmark this and do one task each weekend through November and be in great shape. Don’t be overwhelmed, just get started!
Show more
I currently own 0 dollars of this token but PsyopAnime is easily one of the more undervalued cultural movements on X and blockchain Will fix this tomorrow
The most important thing about videos like this is it forces you to ask: “What would I do in this situation?” Asking yourself that question and thinking through it makes you more prepared than 99% of people
Show more
En estos casos no hay que pensarlo 2 veces Apretás el acelerador y listo ✅️
After the past several months of folks claiming self custody is dead / too risky, a single exchange hack results in more losses than all the self custody failures this year combined.
Show more
Btw the PudgyStrategy NFTs are ineligible to claim this specific activation If you want to swap Penguins in and out of that contract (using official tools) for aesthetics and rarity, please do it! But you won’t be able to claim extra packs
Show more
pudgys and licensors from OverpassIP, go claim your free box(es) of Vibes 4 @ faq: * is this free? yes * is domestic/int'l shipping free? yes * when does claim end? Nov 6 11:59:59PM EST * is there a claim checker? no * what if I bought a penguin and the box was already claimed? sorry, thanks for the volume * if I already submitted a claim and then acquire another pudgy, can I update my order? yes, just click on the banner and resubmit your order * how does this benefit the holders? 🐧
Show more
There will be a way to migrate your Abstract SBTs. No SBT will be left behind.
To celebrate the launch of The Huddle, every big Pudgy NFT and all 245 Set 4 licensees can claim one free booster box of our upcoming @vibes_tcg set, Table for Two. Claims are on a per-asset basis—one box per eligible NFT and will be open for 7 days. Claim yours below 🐧
Show more
0
177
850
147
Forward to community
The reason it’s not slam-dunk smart to hold BTC in a CEX or ETF is now you have to trust infinite people/orgs to get security right and you still have to trust yourself to protect your account When you self custody, you only have to trust yourself
Show more
I suspect IBIT is already on North Korea’s shortlist. In February 2025, the attackers behind the Bybit hack compromised a Safe{Wallet} developer’s Mac through a malicious project disguised as legitimate Docker-related tooling. They had access for 17 days before the theft, giving them enough time to manipulate the transaction interface used by Bybit’s signers. The signers believed they were approving a legitimate transaction. Instead, they unknowingly authorized the theft of $1.5 billion from a cold wallet. The keys could stay offline while the signers approved a theft through a compromised interface. TRM Labs attributes the recent Binance incident with high confidence to TraderTraitor, the North Korean group also linked to Bybit and the theft of 4,502.9 BTC from DMM Bitcoin. Binance’s preliminary investigation points to a compromised DevOps engineer’s laptop as the entry point. Binance says there’s no evidence that private keys were leaked, while TRM’s analysis suggests the attackers may have gained control of the signing infrastructure. If confirmed, the attackers could have moved funds through a compromised approval process without extracting the keys. Now imagine the same thing happening to IBIT. BlackRock’s IBIT is the world’s largest Bitcoin ETF, holding roughly 815,000 BTC worth around $63 billion. Coinbase remains its active Bitcoin custodian. Although Anchorage Digital has been appointed as an additional custodian, the fund’s latest quarterly filing says there are currently no plans to transfer any Bitcoin there. That’s an extraordinary concentration of Bitcoin under one custodian. Regardless of how large or well-funded that provider is, a critical failure in its security infrastructure could put the entire fund at risk. A $6 billion theft would wipe out roughly 9.5% of IBIT’s assets, equivalent to around $4 per share at current valuations. Binance managed to freeze some stolen stablecoins. Bitcoin has no such mechanism, making stolen BTC far harder to recover. BlackRock doesn’t separately insure the Bitcoin held by the fund. Coinbase has disclosed $320 million in commercial crime insurance coverage, shared across its customers. Its custody agreement also limits liability to $100 million per cold storage address, with any recovery subject to contractual terms, liability determinations, and other conditions. If a major theft occurred and the fund couldn’t recover the Bitcoin or obtain sufficient compensation, the remaining losses would ultimately be borne by IBIT shareholders. Bitcoin ETFs have made owning Bitcoin much more accessible, and there’s real value in that convenience. But as more capital flows into these products, enormous amounts of Bitcoin are also being concentrated among a handful of custodians and the infrastructure they depend on. The larger these pools become, the more attractive they are to attackers. A compromise at any critical point could have consequences far beyond a single institution. And that’s why security has no finish line. Even the most sophisticated cold storage setup still depends on hardware, software, supply chains, signing workflows, and the people operating them. Keeping private keys offline is essential, but it doesn’t eliminate the risks surrounding the transaction approval process. Spread your assets across independent custody setups. Keep your private keys offline. Verify transaction details on a trusted device screen, independently of the computer initiating the transaction. Continuously review your security architecture, and build it around the assumption that some part of your infrastructure will eventually be compromised. There are no silver bullets in security, and no permanent guarantees. Stay vigilant, keep verifying, and never mistake a clean track record for proof that you’re safe. Bunker mode.
Show more
If you bought a Trezor with the reseller CryptoBilis after March 2026, move your funds to a new wallet right now. We’ve received a report of 1 device with tampering. We believe this is a credible implant and we are acting fast on it. As of now, we have no reports of lost funds.
Show more
Ladies and gentlemen… Pudgy Penguins
I recently bought a Ledger and multiple times during checkout they asked me if I’d rather pick up the device from Best Buy instead of have it shipped direct They proactively asked me if I wanted to use a 3rd party reseller… Insane imo
Show more
Singapore Police Say Ledger crypto Wallets Sold at Local Retailers Contained Malicious Hardware Implants Singapore police said on October 28 that some Ledger cryptocurrency hardware wallets purchased from local retailers contained malicious hardware implants capable of stealing users' recovery phrases or private keys. At least two cases have been reported since September 10, resulting in losses of approximately S$3.5 million ($2.7 million). Ledger, a leading French hardware wallet manufacturer, is reviewing the affected cases, while police investigations remain ongoing.
Show more