Cofounder at @blumcrypto | ex-Binance

Joined June 2010
34 Photos and videos
Gleb Kostarev retweeted
As mentioned in reopening announcement, here is the full context behind the deliberate decision that resulted in 316 duplicate transactions reaching a few hundred users on TON. When the bridge was drained during the May 11 incident, a number of legitimate cross-chain transactions initiated by users were left in limbo: processed on the TAC side, but never settled on TON because the TON Adapter no longer held the funds to complete them. Ahead of the relaunch, we faced a clear choice on how to handle these pending transactions. The first option was to hard-fork TAC: coordinating with validators and partners, re-issuing tokens to mirror a snapshot of the previous state, and a number of operations that break the immutability of the TAC blockchain. Immutability is a core property of any serious chain, and we will not compromise it to patch an operational issue, however convenient that shortcut would have been. The second option was to let the TON Adapter process these pending transactions through its normal flow once the bridge was live. This preserved chain soundness and immutability. The trade-off: 316 transactions reprocessed on TON, delivering approximately $80,000 to users who were not meant to receive them. We chose immutability. If you received an unexpected transaction in any of these assets: TAC, USDT, BLUM, tsTON, Re7 USDTv2, Re7 cbBTCv2, Re7 WETHv2, mRe7YIELD, cbBTC, syUSDT - kindly return the funds back to the TAC team multisig on TON: UQAkTfPo4zo72Zyr5dk1QrWvCWlgA0gRd3njyg5hqmwdrQrI We appreciate your cooperation.
We're happy to share that cross-chain transactions between TON and TAC are now available again. The patched sequencer software has been independently reviewed by our auditor and TON ecosystem partners and we can resume operations with complete confidence. TAC CCL is now safer than ever. All missing funds in USDT, BLUM, and tsTON have been restored. Users can use TAC-powered products (DeFi Wallet vaults, Acid ID staking feature, and others) as before. Affected users expecting transactions on TON in BLUM or USDT will receive their funds automatically - no action is required from their side. ❗️Important Notice: As part of the relaunch, a necessary step resulted in some users receiving more tokens than expected. More details to follow in a post later today. Thank you for your support, patience and trust.
4
22
10,171
Gleb Kostarev retweeted
If you have API keys in your code, even private repos, now is the time to double check and change them...
May 19
We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.
715
846
6,911
1,891,761
Gleb Kostarev retweeted
May 17
Update on the TAC incident. TAC Protocol has returned the BLUM tokens taken in the bridge exploit. Liquidity on STON.fi is restored — pools are open for trading and LP operations again. $BLUM deposits on the exchanges will be opened soon.

We're happy to announce that ~90% of the funds from the May 12th security incident have been recovered. The attacker decided to return the funds that were sitting across Ethereum, TON, TAC, BSC and Zcash, and retained the 10% as a bounty. We are happy to confirm that the unbalance on the cross-chain layer will be completely fixed. A detailed update and full post-mortem will follow in the coming days. Big thanks to @SEAL_911, our security partners, the @ton_blockchain community and to every partner team that stood with us.
36
11
74
30,089
Congrats to @TacBuild team on resolving this issue
We're happy to announce that ~90% of the funds from the May 12th security incident have been recovered. The attacker decided to return the funds that were sitting across Ethereum, TON, TAC, BSC and Zcash, and retained the 10% as a bounty. We are happy to confirm that the unbalance on the cross-chain layer will be completely fixed. A detailed update and full post-mortem will follow in the coming days. Big thanks to @SEAL_911, our security partners, the @ton_blockchain community and to every partner team that stood with us.
7
24
8,965
Gleb Kostarev retweeted
We, the TAC team, based on coordinated discussions with our security partners and law enforcement, formally assert that upon successful return of the funds to the TAC team multisig at 0xa05CBfF7b395DeA456539Db279AbC6EE5a8150f9 and EQAkTfPo4zo72Zyr5dk1QrWvCWlgA0gRd3njyg5hqmwdrVcN and t1dXd2EUAe34BYEtNUtNfrBFQTTs8LhoTUH: 1. Legal action will not be taken against the operator of the address(es) eth/bsc:0x46FB375EAc7a44C231b2b7aB762040ee74908CDc, zec:t1h6NcBAciYGdaVb4Ej1AELTx1D9UF9WUDr and ton:EQBPHhXyG_vbsAEnB6YccNhhaVc6I3ixOCc7vriaOzo4AFA8. The entity controlling the above address(es) carried out the incident affecting the TAC cross-chain layer in multiple transactions, resulting in the movement of approximately $2.8M in USDT, BLUM, and tsTON. Any further investigations or legal matters against the entity, in relation to this incident, will end. 2. We view this occurrence as a white-hat rescue, and as a result: eth:0x46FB375EAc7a44C231b2b7aB762040ee74908CDc and zec:t1h6NcBAciYGdaVb4Ej1AELTx1D9UF9WUDr will be rewarded with 10% of the recovered fund as a white-hat bounty from the TAC team, which translates to approximately 13 ETH 300ZEC. 3. The remaining balance, will be directed to the TAC team multisigs mentioned above.
16
2
46
11,549
Gleb Kostarev retweeted
Following the security incident, we identified an exploit on the TON side of the TAC crosschain layer that was carried out by an external attacker. The incident resulted in a loss of approximately $2.8M across USDT, BLUM, and tsTON. The TAC token, TON and all ERC-20 tokens bridged from Ethereum are NOT affected. The bridge remains paused while forensic analysis and remediation work are ongoing. A post-mortem with additional disclosure will be published in the next 48 hours. We are actively working with law enforcement, SEAL 911, and our security partners to trace and block the stolen funds. Our focus is on making users whole and fully restoring bridge liquidity through a legally structured sale of Foundation’s TAC token treasury reserves. We will continue to share updates through our official channels. Thank you for your patience and trust.
7
8
71
37,201
Important notice for Blum users @TacBuild — an external bridge used to move $BLUM from TON to other networks — was exploited today. $BLUM was among the affected assets. The attack happened on the TAC side. Blum's contracts, application, and user funds are not affected. As a precaution, swaps involving $BLUM on @ston_fi are temporarily paused. All other Blum features are working as usual. $BLUM remains available for trading on centralized exchanges. We are in close coordination with the TAC team and have notified major exchanges. We will share updates as the situation develops.
We are currently investigating a security incident affecting the TAC bridge with TON. The bridge has been paused as soon as we received reports from our security partners. The issue appears isolated to native TON Jettons bridged from TON (excluding $TON). $TON and every other Ethereum native asset are not affected. TON cross-chain transactions remain paused while the investigation is ongoing. Protecting our users is our top priority. Should any users be affected as a result of this incident, we are committed to doing everything we can to make them whole. We will be sharing regular updates through our official channels.
9
4
21
10,419
Gleb Kostarev retweeted
We are currently investigating a security incident affecting the TAC bridge with TON. The bridge has been paused as soon as we received reports from our security partners. The issue appears isolated to native TON Jettons bridged from TON (excluding $TON). $TON and every other Ethereum native asset are not affected. TON cross-chain transactions remain paused while the investigation is ongoing. Protecting our users is our top priority. Should any users be affected as a result of this incident, we are committed to doing everything we can to make them whole. We will be sharing regular updates through our official channels.
8
6
62
23,945
Gleb Kostarev retweeted
Apr 20
$M (Memecore) is currently trading at a $34.5B FDV and ranked top 25 by market cap - but the circulating supply shown on CoinMarketCap and Coingecko is wrong. Their site lists 1.29B circulating. Only ~230M is actually unlocked. That's nearly 6x lower. (@CoinMarketCap @coingecko pls fix) This creates misleading optics and can bait people into shorting because it looks like a worthless coin trading at tens of billions FDV. Don't do that. Onchain, this is likely ~99.5% insider controlled: Binance Alpha wallets: 48.85% Insider wallet cluster: 23.46% Genesis (team) wallets: 25.82% Meson Finance Kraken (funded by that cluster): 1.42% Total estimated insider control: ~99.6% of circulating supply. That means only ~9.7M tokens (~0.1% of total supply) are in non-insider hands. At a $35B valuation with only 2.3% unlocked, the real float is just ~0.0115% of total supply - roughly ~$4M actually held by non-insiders. The above figures are estimates based on onchain data, but they clearly show the bigger picture. Don't touch this coin.
Apr 20
Officially recognized on @ZachXBT ! We’re just getting started. Please provide a single data point to support your $6B mkt cap at a top 20 token and why insiders hold >90% of supply.
50
45
476
144,852
Gleb Kostarev retweeted
Apr 20
Officially recognized on @ZachXBT ! We’re just getting started. Please provide a single data point to support your $6B mkt cap at a top 20 token and why insiders hold >90% of supply.
2,788
3,897
11,523
1,891,477
Gleb Kostarev retweeted
Replying to @durov
No country is perfect, but Dubai and UAE broadly are objectively safer and better run than many areas of Europe
1,808
5,367
53,556
4,264,769
Now @blumcrypto supports deposits from @BNBCHAIN and Ethereum 🎉🎉🎉
Big news 🎉 BNB and ETH are the next 🚀
35
9
114
36,857
1/ Big drama in the CIS community today. A trader on @Bybit had large short positions and a few longs. The shorts were supposed to even generate profit. But during the crash, Bybit closed the shorts at market, then liquidated the longs and even spot collateral. Result: –$1M.
29
10
139
34,230
9/ People say: “On CEXs, ADL is a black box. On DEXs, it’s transparent.” True — on-chain, you can see everything. But when your profitable position is force-closed during a crash... does it really matter whether it happened on a CEX or a DEX?
6
25
16,480
10/ ADL isn’t a scam. It’s the brutal reality of leveraged markets: Exchanges never take the counterparty risk.
2
19
12,637