No. The last time this happened, it led to the Ethereum/Ethereum classic split, and that was 10 years ago.
However, the stablecoins are not “real” cryptocurrencies like e.g. BTC or ETH, but are built as smartcontracts on top of ETH, basically using it as a big replicated database. So they might(?) just manually “give back” the money to Binance, as in freezing money in the stolen account forever and “printing” an equal amount to Binance's credit.
Or, to put it in another way, no need to reverse an erroneous SQL transaction if you can just create a new one that fixes the data you altered.
I think the idea is that they freeze them indefinitely, and then they no longer count against the centralised reserves, since they can never cash out. Now they can mint the equivalent amount back to Binance and remain solvent.
It’s been years since anything Tether minted was plausibly 100% backed by real assets. Both times they’ve been forced to show the books, they only had fractional backing. And they’ve minted tens of billions of tokens since.
And yet people like the parent and those with billions invested in Tether seem to believe that it's all backed and fully solvent and minting new money from thin air is completely reasonable.
It's remarkable to me how long this scam has lasted and how much confidence people have in it, in spite of the very shady characters involved and the likelihood of fraud.
Personally I'm skeptical of Tether. But you don't need to trust them to believe that if they permanently freeze Z USDT and then mint Z USDT then their ratio of reserves to USDT is unchanged.
Well I think you do need to trust them: you are taking at face value their statements and assuming they do what they say they will. What if they mint coins without collateral (they have been caught doing this before), what if they unfreeze coins later (they have done this before)?
These stablecoins are just a database owned by untrustworthy people and backed by nothing but their promises, they're just one step up from NFTs.
Because if they permanently freeze 2 billion in a wallet, that Tether can never move or cash out, so their liabilities go down 2 billion. They can mint an equivalent amount to a non-frozen wallet without affecting their reserve ratio.
And yes they can print money, you have to trust their reserves that are off chain.
To be clear: There is no permanently frozen guarantee. Tether can and has unfrozen (called removeBlackList)addresses before. All of this is just a public database fully controlled by Tether Limited.
Excluding wash and artificial activity, supposedly stablecoins trade 400M/h so if it took 2h to notice and lock they might have been able trade about half a billion without overwhelming existing volumes?
right but too late to call freeze on the original wallet address as per gp's post. I would imagine it got distributed to many wallets and attempts to tumble by the time Tether could move on it.
It’s legal (at least in the US) the government just advised every major exchange that they couldn’t uphold their KYC obligations with it so they dropped it.
"ever so gently" as in you'll get a 30 year sentence for doing so. I guess the government is "ever so gently" nudging me away from committing murder too.
But there is still a distinction between monero being banned and the government saying “we don’t believe you can fulfill kyc obligations”. There is a legitimate argument that yes they could that could be made in court, depending on the implementation.
That's why it's paramount for LEOs to go after people doing the bad deeds instead of simply banning a whole monetary ecosystem, just because it's easier to do.
If you ban a coin, instead of persuing the actual criminal, then you're both doing a disservice to honest users of the coin and leaving the bad actor to do harm to society in some other way.
There are only 8B people in the world - they all fit into a "box" of 2k by 2k by 2k of humans.
It really isn't that hard to know who's doing bad things to others, especially with current technology.
Criminals used to meet in person to discuss crime (because mail/phones can be intercepted) and meet in person to move cash. It was a hard limiting factor on what they can get away with. With e2e messengers and anonymous crypto both of those "issues" are fixed.
Do you know anyone who uses it for legit purposes? I don't. I bet you ban a coin like that and you kill orders of magnitude more crime revenue compared to .001% of honest users using it to send money home and save a few dollars on the transaction.
(Some random internet user pasted me things that were clearly from my ChatGPT session, he identified me because it had links to my github). So it wasn't a hallucination, it appeared to be some sort of KV cache leakage, though I obviously don't know the true root cause of the bug.
This is easy to exploit for example:
`docker docker run -d --rm -p 0.0.0.0:80:80 wordpress@sha256:c96e9e9a8ead2fea02f05469b356134da45681aaefa0f961a87653d58c462794` (basically `wordpress:7.1.3-php8.5-apache` with vulnerable php version 8.5.11)
I think the point is it is hard to claim that this exploit is the "end of the world", if it is trivially defeated by the default setup. Almost every deployment of php is going to be fronted by apache or nginx, and the default client_max_body_size for nginx is 1m.
I didn't say it's "end of the world". I am just saying it's an insane vulnerability.
It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit. For example:
- Docker image `php:8.5.11-apache` is easy to exploit.
- Or the WordPress blog I installed with Digital Ocean template in 2023.
> It's not easily defeated by the default setup. Quite the contrary, the default setups are great. Typical apache + mod_php is the easiest to exploit.
But apache + mod_php hasn't been the default setup for a very long time, that's what people are trying to tell you. Given your expertise, you must know that already. So I have to conclude that you're arguing in bad faith because it's the only setup you can break.
The first comment in that page literally says "the preferred method is now fastcgi" and links to PHP-FPM. This comment is 13 years old, and I personally haven't seen mod_php in the wild for a long time. PHP-FPM is also the default configuration in both Red Hat and Debian and in most operating systems derived from them.
Hi LiveOverflow, I'm Elias and you made a video reply to my blog post. Why did you delete my comment on your video? (EDIT: Youtube fucked with my comment, not LiveOverflow! Editing to put this at the top of the thread so that it is read)
Your second exploit that you slopped out - after someone pointed out your first exploit depended on reading the container's memory via `/proc/pid/..` - also depends on an extremely contrived thing outside of a lab.
To get around the fact that you need to hit the same php worker over and over again (this is another way the LLMs were stacking the deck in their exploits; so many of the exploits online had php running with one worker - which is an unbelievably unrealistic precondition. That, and with ASLR off, lol.), you hold WORKERS-1 connections open indefinitely (lol) and then need to sequentially, and stably, hit the same php worker for 10-30 seconds.
Of course, luck is not a security boundary, everyone should still patch their servers.
But how is it a realistic precondition to have a server in which you are the *only* person making requests for 30 straight seconds? Even a single googlebot pinging the website would fuck your heap grooming up, let alone regular users, or another person trying the exploit out! Similarly, Holding WORKERS-1 connections open indefinitely so that you can isolate one php worker is extremely unrealistic in practice.
Yes. this is a vulnerability, it is bad. No, it is not easy to replicate in real world conditions. The LLM gets you an "exploit" locally. How on earth did you not extrapolate from the LLM decieving you the first time, and think for some reason the second time the conditions were 100% truthful? Did you even read the stdout from the exploit you wrote?
I really like your work man, you're a great inspiration, but what the fuck are you doing? And why delete my comment pointing this out?
I am not deleting any comments ever. I just checked, YouTube held your comment as "likely spam". I accepted it now and pinned it, I always appreciate it when sb is reaching out with a reasonable comment!
It is an absolutely slopped exploit, hahaha, I fully agree. But that was exactly my point. Memory corruption exploits over the internet have been historically extremely difficult. And it took many days of building a PoC. And this is clearly different now. And of course there are a lot of practical challenges, but that does not make it unrealistic vulnerability to exploit.
> But how is it a realistic precondition to have a server in which you are the only person making requests for 30 straight seconds?
I think it's VERY realistic. My random blog from 2023 https://raisistance.com has hours or days without requests. I think a majority of (old) PHP sites barely anybody visits. And there are tons of random company or government website without any requests at night or so. Also depending on the setup, there ar methods to deal with concurrent traffic. For example Apache (see here: https://x.com/LiveOverflow/status/2113555517339480284).
I think it's clear so far that it's not mass-exploitation material. But once you are more targeted and have a random LAMP stack, it becomes very realistic.
Would you setup a random vulnerable php version from Docker image like `php:8.5.11-apache` on a server, put a flag there, and give me the IP? For me this is a realistic setup and it's fairly easy to exploit.
Hey, good to hear that it was just YouTube holding the comment. I really thought you deleted it which was audacious. I'm now much less mad :P.
I think we can set up something interesting here, I'd be down to set up a little "PHP2Shell Olympics" as we change preconditions and see how well the exploits fare. I am pretty sure our opinions of "this can be exploited, and LLMs can aid a rapid exploit of previously-complex ASLR nonsense" and "it's difficult to do memory corruption over the internet; php2shell is not a log4shell moment" are mutually compatible.
My contact details are on the bottom of the blog post.
Really, your request log is empty for hours at a time? I find that hard to believe. Even old blog sites still get an insane amount of bot traffic. I have sites that are only barely in googles index and it’s pretty rare to see anything less than 1 req/s (99% bot traffic)
Yes! Even my own stuff sometimes goes a few hours to a day without a single request, the internet is either very slow and dead or super active, no in-between, I think it heavily depends on who indexed you and how big your site looks like or maybe identified stack (for vuln crawlers, i'd wager if they see a wordpress marker they'd put you on some list to get retried by the swarm) or something.
My datamining project for a game for example, that noone besides me and 2 friends use, gets thousands of requests per second, because all the AI bots found it and try to index every single page (thousands of ssr pages) and they repeat the requests when my cache-control headers expire (ie: when i consider the old page stale), so it's an endless stream (I dont mind the challenge of serving all of these at high performance xD).
My main website, in the same domain (not a subdomain), barely gets any requests, it only has the one main index page with a single link to the datamining subdomain, that's about it.
From my raisistance.com blog 10 October 2026 00:05:56–25 October 2026 09:25:02 UTC:
- 95.3% of seconds had zero logged requests
- 11,582 of 22,159 complete minutes (52.3%) had no requests. The longest quiet stretch was 27 minutes 26 seconds.
- 3,283 continuous quiet stretches lasted at least 120 seconds. Together they totalled 225 hours 27 minutes 27 seconds—61.0% of the logged timespan.
- Excluding Apache’s internal dummy connections: 3,305 qualifying stretches totalled 227 hours 1 minute 51 seconds—61.5% of the timespan.
- Of 38,389 seconds with exactly one request, 14,692 contained an Apache ::1 internal dummy connection. Others included homepage visits, WordPress login requests, crawlers, and scanner probes.
All the "working" php2shell exploits on GitHub and X are like that. There are ZERO publicly available RCE exploits for php2shell that actually work remotely on production deployments.
All of these RCE PoCs are local and rely on unrealistic setups because LLMs couldn't achieve RCE without resorting to reward hacking.
Well usually you have a PHP application actually doing something, not just serving static files. If it's just static files, PHP2Shell isn't really a thing.
Right now a ton of wages from top earners are not being taken out for social security because the cap is around 176k (for the current year); I'm assuming it would simply extend the timeline for it hitting its deficit.
Durable execution comes with overhead that you'll need to determine whether or not fits your use case. If you're looking for raw speed then durable workflows are going to be a steep trade off. Most workflows should be durable by default, though, so it is more the rule than the exception.
> The national favorability rating for the Democratic Party sits around 39% to 41% favorable, with unfavorable ratings ranging from 48% to 54% across recent mid-2026 polls. [0]
And Congress as a whole...
> The approval rating for the U.S. Congress stands at 10%, while disapproval has climbed to 86%, according to data from Gallup. [1]
Diffuse organizations like "Congress" or "the party" aren't what you're voting for. Unfortunately Congress really does take it on the chin for the actions of the President in midterms, because that's very recognizable and personalized, and partisan votes (or just staying home) are the only lever people have to express displeasure.
"People hate Congress but love their Congressperson. "
I honestly think most Congress people want to do good for the country. But the system has become totally dysfunctional making it basically impossible to really work on issues. The influence of money is just too much. To me this goes hand in hand with the rising inequality that gives a few people at the top outsized influence. Super PACs don't even have to deploy their money anymore. The simple threat is already enough to bring most Congress people in line if they want to keep their job.
> I honestly think most Congress people want to do good for the country.
That seems wildly unlikely. Wouldn't there be evidence for it by now? Over the last decades there have been scant murmurs of the US congress sitting down and taking a serious look at what might be good for a country. I'm happy to say that the root cause is a voting public in the US (everywhere, really) rewarding unprincipled liars and punishing principled politicians. But the outcome is that the US Congress is full of unprincipled liars who have little regard for the good of the country, because that would be a principle that gets in the way of political expediency.
The system isn't some abstract concept foisted upon them from on high. They control it. There are some very high-level constraints on them that are all-weather good ideas and apart from that it is a free-for-all. The reason the system is dysfunctional is because that suits the congresspeople.
Most of the US airforce is executive transport. Clearly you dont actually know people higher up in government. As someone who dated a very high up state legislator in my state said: She totally doesnt care cause she doesnt suffer the consequences. And at the congressional level it is again a level apart. Michal Crichton has a name for this, I think!
I hate my congressman. Why, he won't listen to me. No public meetings, no interviews with real press. Only 1 way phone calls, where you can submit questions via e-mail a day before the event.
No private meetings either. I have repeatedly called both his local office and his DC office. If I have a donation, a staffer will meet with me.
His philosophy is simple "You love Donald, I love Donald". It is the focus of the mailers that are sent out every quarter.
This elections democrat has no polling. The prediction markets give her an 8% chance of winning.
I'm sure you understand the dystopian irony of your last sentence, but I thought I'd highlight it anyway. That's some "no fighting in the war-room" level commentary on the state of the USA.
People don't feel like they are well-represented by either party.
They may like some republican stances (say, reduced regulations and welfare spending), but despise others (Trump, wars, anti-renewable). Meanwhile they might like some democrat stances (Inclusivity, environment), but not others (high spending, rent controls, etc).
So you're stuck between a rock and a hard place where there's no good way to express your desires. I can totally understand not wanting to vote in such an environment, and disliking the government no matter what. You can't get your specific views represented because everything has been collapsed into two broad camps that average out - and as lots of research shows, no one is truly average.
How does freezing crypto work in this context?
reply