Public ledgers, exchange KYC and the limits of privacy
Every week, the same narrative comes back: crypto is about privacy, freedom, no to regulation and escaping control.
Research & analysis4 min
Read the publication
MASTR · 2024–2026
Phishing, exploits & privacy · 2
From the first contact to the permission, key or device an attacker wants.
53 · Selected publications · 2/3
Trust Wallet’s extension incident: the December 2025 record
As of 26.12.2025, this looks like a straight supply chain compromise of the Trust Wallet Chrome extension, not a user approval mistake.
Research & analysis3 min
US Border Agency Wants Virtually ALL Data From Travellers
The US border authority has published a proposal to massively expand data collection on travellers under the Visa Waiver Program.
Commentary & rants3 min
Your digital footprint in crypto: the complete three-part series
Your activity in the crypto world leaves an indelible digital footprint that can reveal far more about you than you might expect.
Research & analysis25 min
Solana: security and verification · 17 Nov 2025
Maybe instead of interacting with drainer accounts and scammer accounts, it would be smarter to start supporting the projects that actually try to do something good for this space and for your chain!
Commentary & rants2 min
Privacy, transparency and control at different layers
Every layer of the ecosystem is being pushed toward full visibility. Exchanges demand identification. Onramps track location and behaviour.
Research & analysis2 min
A new -100 followers tweet from me but fuck them:
The platform has turned into a giant contamination zone where scams, lies and synthetic hype spread faster than anything resembling truth.
Commentary & rants2 min
GMGN wallet-draining reports: the October 2025 account
Between October 25 and 28, 2025, hundreds of users who connected their wallets to a major Solana and BNB Smart Chain trading and analytics platform, reported their funds disappearing in real time.
Research & analysis4 min
Privacy, surveillance and control
A discussion of surveillance, data collection and the relationship between privacy and personal autonomy.
Original articles4 min
DragonForce and the ransomware service economy
An account of the DragonForce ecosystem, its affiliate model and the business structure around ransomware.
Original articles6 min
The Com: social engineering and account compromise
The FBI’s July 2025 Public Service Announcement (I-072325-PSA) calls The Com, short for "The Community" One of the fastest-evolving online criminal ecosystems in recent memory.
Research & analysis4 min
The JavaScript supply-chain worm: a warning for Web3 builders
The injected code auto-executes after install, pulls Trufflehog to hunt for secrets (tokens, API keys, passwords), then uses stolen maintainer creds to infect even more packages, a classic self-propagating supply-chain attack.
Research & analysis1 min
POPDOG: MASTR’s warning about an impersonated support account
POPDOG: MASTR’s warning about an impersonated support account. Dated original source, with context and links.
Commentary & rants1 min
The Coinbase data breach and a fake-support loss
Ed Suman, 67, a former artist who helped build Jeff Koons’ Balloon Dog, lost his entire $2M+ crypto retirement fund after falling for a fake Coinbase support call.
Research & analysis2 min
The Solflare X-account compromise: what the incident affected
To be absolutely clear: if something similar were to happen to us - we never promote tokens. The only tokens we ever mention are our own $MASTR token or $MASTR badged projects, which are typically at least one month old and have passed a…
Research & analysis2 min
40 #Web3 Security Tips You Wish You Knew Sooner — Save this ❗
31. Watch out for transaction fees too low to be true. Gas exploits and failed transactions can be used against you.
Commentary & rants3 min
Fake giveaways as an account-growth strategy
Fake giveaways as an account-growth strategy. Dated original source, with context and links.
Commentary & rants1 min
Scamr presale complaints: MASTR’s original response
We’ve received several DMs from people who feel scammed—by an account that spent weeks posting half-baked scam exposes, only to suddenly launch a token.
Research & analysis2 min
StilachiRAT: the wallet-extension and credential warning
StilachiRAT: the wallet-extension and credential warning. Dated original source, with context and links.
Research & analysis1 min
Account security: permissions, authentication and recovery
1️⃣ Revoke Unnecessary App Permissions Regularly review third-party app access: X Settings → Security and Account Access → Apps and Sessions Remove apps you don’t recognize or no longer use. (Better to remove them all)
Research & analysis1 min
Connected third-party apps and account-security review
Connected third-party apps and account-security review. Dated original source, with context and links.
Commentary & rants1 min
Account-security guidance from February 2025
Regularly review third-party app access (X Settings → Security and Account Access → Apps and Sessions).
Research & analysis1 min
Compromised X accounts and borrowed credibility
Compromised X accounts and borrowed credibility. Dated original source, with context and links.
Commentary & rants1 min
Web3 culture · 9 Jan 2025
We are the original #antiscam movement. We are the ones truly empowering you. We are sick of shitfluencers dumping on you all. We are the ones who fucking want to bring the masses into crypto without them being #rugged. We are the ones…
Commentary & rants2 min