The Lazarus Group, a state-sponsored hacking group, has been targeting cryptocurrency exchanges using advanced social engineering and technical exploits. The attackers used malicious code disguised as legitimate projects, exploited vulnerabilities like pyyaml for remote code execution, and moved laterally within networks to steal cryptocurrency assets. Enhanced security measures, including network segmentation, endpoint monitoring, and improved employee awareness, are recommended to defend against such sophisticated APT (Advanced Persistent Threat) attacks.
2025.02.24·links.tldrnewsletter.com·8 min read·TLDR Crypto Kanye West may have sold or rented his X account to the BarkMeta Doginals crew for $17 million - there are suspicions that they're orchestrating a crypto scam.
mETH Protocol recovered 15,000 cmETH tokens ($43M) from the $1.4B Bybit hack, leveraging an 8-hour withdrawal delay to halt unauthorized transactions.
2025.02.24·links.tldrnewsletter.com·2 min read·TLDR Crypto The record-breaking $1.4B Bybit hack demonstrates the increasing sophistication of crypto exploits.
2025.02.24·links.tldrnewsletter.com·4 min read·TLDR Crypto OXFUN is reportedly insolvent, according to multiple former employees, with only $180,000 in withdrawal liquidity remaining after a mass fund exodus.
HBO's streaming service, Max, is reportedly considering another rebrand that will shift its color scheme from blue to HBO's neutral black-and-white palette. The initial switch to 'Max' faced criticism and weakened brand recognition. The proposed change has reignited backlash, raising questions about returning to HBO's stronger original identity.
Netflix has introduced a new visual identity for Netflix Sports. Designed by Study Hall, it features an abstracted Netflix N, bold typography, and an expanded color palette. This dynamic design adapts to different storytelling modes, capturing the intensity and emotion of sports through Netflix's unique lens.
Google Lens for iPhone now supports visual searches by letting users draw or tap directly on images and text in Chrome or the Google app. The feature, inspired by Android's “Circle to Search,” is accessible via the three-dot menu, with a Chrome shortcut coming soon. Lens will automatically offer AI-generated explanations (“AI Overviews”) for unusual images.
UX agencies face an existential shift as in-house teams mature and AI boosts productivity. Mid-sized firms will struggle while specialized consultants and AI-driven providers thrive. The industry is polarizing: elite strategists and scalable automation will dominate. Adaptation is crucial—embracing AI and niche expertise ensures survival in this evolving landscape.
2025.02.24·jakobnielsenphd.substack.com·9 min read·TLDR Design Understanding value is key to transitioning from UX to Product Design. Unlike B2C, B2B design involves different user and buyer personas. Product designers must define and measure value through user actions, optimizing “Time to Value” for engagement and business growth. Prioritizing both users and decision-makers bridges UX and business strategy.
2025.02.24·dataanddesign.substack.com·5 min read·TLDR Design Fuji Run is a no-code 3D game designed with Spline, Webflow, and Figma. Created by Adrian Red, it features stunning visuals, smooth animations, and immersive gameplay. Players control a kitsune, a fox-like creature from Japanese folklore, navigating Mount Fuji in a beautifully crafted Japanese-inspired world.
Flora is an AI-powered workflow tool that integrates text, image, and video AI into 10x creative output.
Vizcom offers a transformative approach to concept drawing, enabling users to turn their sketches into impressive, realistic renderings quickly and efficiently.
This Figma plugin allows you to visualize the spacing, margins, padding, and measurements of components, making it easier to create consistent designs.
Icona, created by Suitcase Type Foundry, is a highly legible and versatile typeface designed for neutrality across various formats. It is available in both sans and serif versions and features a large x-height, multiple weights, and extensive language support, making it ideal for long-term brand identities.
2025.02.24·the-brandidentity.com·3 min read·TLDR Design Ragged Edge rebranded Wise Platform to better appeal to senior finance leaders, balancing personality with reliability. The new identity features a subdued color palette, Wise Sans typeface, API-inspired illustrations, and a refined verbal tone to stand out while conveying functionality.
Advanced accessibility techniques enhance UX by integrating accessibility into every stage of design. Design systems, inclusive user journeys, balanced aesthetics, rigorous testing, device-agnostic approaches, and ARIA implementation ensure digital products serve all users effectively, improving usability while fostering innovation.
Superside is embracing AI to streamline the design process, incorporating it into its latest rebrand.
Alien Romulus authentically captures the franchise's signature retro-futuristic style with pixelated screens, tactile controls, and industrial aesthetics.
The iPhone 17 Pro Max may feature a new “camera bar” that separates flash, microphone, and LiDAR from the triple cameras, exclusive to Pro, Pro Max, and Air models.
When it comes to leadership hires, gut instincts often matter more than you think. It's easy to get lost in candidate “scorecards,” but remember that a strong track record isn't enough. Leaders have to navigate unknowns, so you're betting on their judgment more than their resume. Pick people who thrive under uncertainty and can handle critical, high-stakes decisions in real time.
In fintech, revenue streams aren't created equal—here's why some startups soar. From Stripe's towering multiple to Klarna's comeback, valuations depend on the risk mix in your business model. Payments and stable SaaS can earn higher marks, while lending-heavy models face bigger swings. For founders, it's a reality check: recurring income drives higher valuation, so steering your startup toward predictable revenue can pay off.
Chargeflow's unique success-based pricing model fueled rapid growth, attracting 15,000 merchants and recovering millions in chargebacks. By investing in GTM strategies before product development, Chargeflow improved customer acquisition and retention. Its approach, focusing on seamless onboarding and value demonstration, differentiated it in marketplaces like Shopify and Stripe.
Even healthy metrics can face skepticism these days—here's how to push through. Investors are more cautious than ever, so you'll need a crystal-clear story that shows why your market matters, what your metrics really mean, and how AI fits (if at all). They're also more likely to trust founders who tap warm introductions from existing backers. Bottom line: if you combine evidence of strong fundamentals with a compelling vision, you stand a better chance of securing funding despite a tough climate.
Question your own success so you don't block your next breakthrough. Inspired by how Apple dared to shift from iPods to iPhones, this read encourages founders to disrupt what's already working. Sometimes you need to “destroy” familiar tactics or product lines to open doors to bigger, more impactful innovations. If you feel stuck optimizing the same wins, it's a push to challenge the status quo and embrace what's next.
Sponsored
Tinkering with auth isn't your core competency. Help your B2B SaaS hit the ground running [10] with everything you need out of the box: organizations, RBAC, SSO / SAML with IdP integration, advanced security features, and easy UI customization. “PropelAuth solves for everything that Auth0 fails at.” — Pujun Bhatnagar, Founder @
AI Graphic Designer for SMBs (starting with AI emojis).
AI Matchmaker for recruiting 10x engineers.
Croct helps product teams scale UI optimization by offering built-in AB testing and personalization, ultra-low latency APIs, design system integration, and quick implementation.
Canoo's bankruptcy highlights the recurring pattern of EV startups collapsing despite high-profile partnerships. The company burned through funding while paying millions for executive perks like private jets, all while generating less than $1M in revenue. The piece examines how constant pivots - from subscription vehicles to commercial vans to military contracts - along with misplaced priorities on deals over operations, doomed the company. Canoo joins a growing graveyard of EV startups that couldn't survive the capital-intensive reality of automotive manufacturing.
Venture capital has four core jobs: finding deals, picking investments, winning deals, and supporting companies. The article shows how focusing too much on one area often means sacrificing others - like how being great at finding hot deals might make you worse at picking good investments. Through real industry examples, it explains why most VCs can't excel in all four areas and need to choose their strengths carefully.
Just as early cars were designed to look like horse carriages, we're stuck thinking about AI in human terms. The article uses this historical parallel to show why our current AI applications might be too limited by human-like design.
Divvy Homes sold to Brookfield Properties for $1 billion, but due to debt obligations, common shareholders received no payout.
AngelList reports a stagnant TVPI for recent venture funds on its platform, with U.S. startups experiencing historically low investment activity in 2024.
David Frankel of Founder Collective created a checklist for navigating company acquisitions.
Crypto exchange Bybit has suffered a major hack, losing approximately $1.4 billion worth of Ethereum from a multisig wallet. CEO Ben Zhou confirmed the breach, which represents the largest crypto theft in history and potentially the largest single theft ever.
SpyLend is a malicious app masquerading as a finance app called Finance Simplified on the Google Play store. The app evaded detection by running a WebView which instructed users to download an APK for a loan app if the user was in India. It collected a large amount of data and used it to extort users to accept high interest rate loans.
Threat actors have been abusing major Counter Strike 2 tournaments to steal Steam accounts and crypto via stream jacking. They are impersonating professional CS2 players on live streams and promoting fake skin and cryptocurrency giveaways. The attackers use hacked YouTube accounts with looped footage of past streams to trick viewers to scan QR codes or send them crypto.
A manufacturing company suffered a sophisticated cyberattack where threat actors used a spam email flood as a decoy to contact employees via Teams, posing as IT support. Using Windows Quick Assist, they gained access and achieved network infiltration in just 48 minutes, much faster than typical attacks. This blog dives into how this became possible.
This blog post describes the Vulnwatch tool from Databricks, an AI-powered system that automatically identifies and prioritizes vulnerabilities in third-party libraries, achieving 85% accuracy in identifying business-critical CVEs while reducing manual security team workload by 95%. The system combines multiple scoring methods including severity score (based on CVSS, EPSS, and community impact), component score (measuring library criticality to Databricks services), and topic score (using LDA to cluster libraries by service context). Using fine-tuned LLMs and vector similarity matching, the system can identify vulnerable dependencies on day zero, enabling the security team to focus only on the most critical 5% of vulnerabilities rather than sifting through hundreds of daily CVE publications.
AI vulnerabilities shift the traditional patching paradigm from patching individual vulnerabilities to a data modeling problem. This post from NCC Group explores the Gatekeeper and State Machine architectural pattern for securing the data that enters and exits an AI system. Each architecture includes an explanation of the architecture and examples of how it can be applied.
BforeAI uses predictive attack intelligence technology to create a list of domains that are likely to be used for malicious purposes in the future instead of leveraging blocklists consisting of domains that have already been seen in attacks.
SHAREM is a shell code analysis framework that is capable of emulating more than 20K WinAPIs and virtually all Windows syscalls.
OSX-PROXMOX allows you to install OSX (aka Hackintosh) on any computer. The README describes the various steps one can take and even claims to be able to install on a cloud VM.
Apple has discontinued Advanced Data Protection (ADP), its end-to-end encrypted iCloud storage service, for new UK users and will require existing users to disable it. This follows reports of UK security services requesting backdoor access to encrypted backups.
Cryptographer Matthew Green discusses the backdoor request that the UK government made from Apple and Apple's subsequent decision to disable their encrypted cloud backup feature. He discusses three different points around how seriously Apple has taken encryption for customers, the exact asks from the UK government as well as the ramifications, and how Apple might respond. Green ends on a note that the exit makes the UK Government's request for backdoor moot, but it's unclear what will happen to users who already had Advanced Data Protection enabled, whether they would retain the encryption or be forced to downgrade.
2025.02.24·blog.cryptographyengineering.com·7 min read·TLDR InfoSec In this transcript of a talk that David Kennedy gave at BSides London 2024, Kennedy breaks down how existing binaries like Cloudflared and SSH can be used for tunneling and port forwarding in network security scenarios. He notes that the initial example relies on SSH existing on the system and also discusses how the binary can be copied into a Windows system easily. Kennedy also explores defensive measures such as monitoring for specific command line switches and DNS logging to detect potential attacks involving these binaries.
Microsoft has increased bug bounty payments for moderate-severity vulnerabilities from nothing to a maximum of $5,000 and expanded the range of vulnerabilities it will pay people to find and report vulnerabilities.