How do Facebook and Instagram apps track what you do in the browser, even in incognito mode?

Meta apps start a local server on the phone and keep it running in the background. The Meta analytics script, running on most websites, pings any "localhost" server with the anonymized tracker ID for that session. The app then associates the browser ID with your Meta account, and voilà, all your browsing history is now linked to your Facebook account.

Android is designed to block such things, but Meta found a workaround using basic Sockets and transmitting the tracker ID in the initial handshake of a WebRTC (voice call) request. It's genius and evil as fuck.

We're still investigating what happened here. It seems a handful of accounts may have been compromised and had their autowithdrawal settings tampered with, including our own "coinos@coinos.io" account.

We ran a script to search for accounts that had the attacker's "speed.app" withdrawal address in place and found about 9 that seem to have been affected. There could be more though, we will update as we have more information.

I worry that this may be the same attacker who exploited a password reset vulnerability back in January which allowed them to gain access to a number of accounts. It's possible that since that time they have been sitting on the account data and working to brute force the encrypted nostr private keys that we had on file for some accounts that had imported their nostr key into Coinos. Those keys were encrypted at rest in our database but it's possible they may have been cracked.

We no longer store nostr private keys for accounts and have since added support for external signing apps and browser extension login, but there was a time when we were storing encrypted nsec private keys.

Having a users nsec would allow an attacker to authenticate into Coinos by signing a nostr event and change the user settings. It also means your entire nostr profile and identity may be compromised.

This is only a hypothesis at this point and we need to investigate further but we may end up recommending that affected users rotate their nostr keys.

This clip will go down in history:

At 4:25 PM ET, S&P 500 futures were trading +1.7% higher.

At 4:26 PM ET, Howard Lutnick handed a poster outlining "reciprocal tariffs" to President Trump.

Stock market futures fell REAL-TIME as Trump read off tariffs name by name.

By 4:42 PM ET, the S&P 500 erased over -$2 TRILLION in market cap.

That's -$125 billion per minute.