DEV Community: mrtd

How to Store Your Seed Phrase Safely (Without Losing It Forever)

mrtd — Wed, 24 Jun 2026 00:05:27 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

Your seed phrase is your crypto — treat it that way

A seed phrase (the 12 or 24 words your wallet shows you when you first set it up) is the master key to everything in that wallet. Anyone who has it controls your funds; anyone who loses it loses their funds. There is no password reset, no support line that can recover it, no bank to call. That single property — total power, zero recovery — is why how you store those words matters more than almost anything else you do in crypto.

This is the storage companion to our defense checklist and our guide to social-engineering scams, which covers the other half of the problem: people being tricked into giving the phrase away.

How much crypto simply vanishes

Lost keys are not a rare edge case. Analysts at Chainalysis have estimated that on the order of 1.8 million BTC sit in wallets that haven't moved since 2014 or earlier — coins that are most likely gone for good. Broader estimates, summarized by Ledger Academy, put permanently lost bitcoin at roughly 2.3 to 3.7 million coins — well over 10% of the supply that will ever exist. Most of that wasn't stolen. It was misplaced backups, dead hard drives, forgotten passphrases, and seed words nobody can find anymore.

The takeaway: for most people, losing the phrase is at least as big a risk as someone stealing it. Good storage has to defend against both.

The two failure modes

Every storage decision is a trade-off between two opposite dangers:

Loss / destruction — fire, flood, a faded ballpoint scrawl, a backup thrown out by mistake, a single copy in one place that gets destroyed.
Theft / exposure — a roommate, burglar, repair worker, or house guest who finds the words, or a digital copy that ends up somewhere it can be read.

Push too hard against one and you invite the other. One copy locked in a single safe is theft-resistant but a single point of failure. Five copies scattered around are loss-resistant but five chances to be stolen. The whole craft of seed storage is balancing these.

Rule 1 — Never store it digitally

The fastest way to lose a wallet is to put the words somewhere connected to the internet. No photos, no screenshots, no cloud notes, no email drafts, no password manager, no text file, no messaging yourself. Anything that touches a synced device or an online account can be exposed by malware or a breach of that service. Seed phrases belong offline and analog, full stop.

Rule 2 — Make the backup survive fire and water

Paper is fine until the first house fire, flood, or decade of humidity. The accepted gold standard is metal: a stainless-steel plate or capsule that is fireproof and corrosion-resistant, with no electronics to fail. As storage specialists like Unchained and Keystone note, stamped letters survive heat and time better than engraved ones, where the thin surface layer (and the inscription) is the first thing destroyed in a fire. If you only ever do one upgrade to your setup, move from paper to metal.

Rule 3 — Redundancy in separate places

One backup is a single point of failure. Two or three identical copies remove the "my only copy burned" risk — but each full copy is also one more place it can be stolen, so geography matters. Keep copies in genuinely separate locations you control or trust: home safe, a relative's house, a bank safe-deposit box. The goal is that no single fire, flood, or break-in can take all of them at once.

Rule 4 — For serious amounts, split the secret

If a wallet holds more than you'd be comfortable trusting to one hidden plate, stop relying on a single complete copy of the words anywhere. Two well-established approaches remove that single point:

Multisig (e.g. 2-of-3). Funds need any two of three independent keys. You can lose — or have stolen — one key entirely and still be safe, and still recover. It's why one key can sit with a custodian or in a safe-deposit box without putting the funds at the mercy of that one location.
Shamir's Secret Sharing (SLIP-39). Splits the secret into several shares where only a chosen number are needed to rebuild it. Some hardware wallets implement it directly. No single share, found on its own, reveals anything.

Both mean an attacker has to compromise multiple places, and you can survive losing one — the best of both failure modes.

Rule 5 — Plan for the day you're not around

A backup so good that only you can ever find or understand it becomes a guaranteed loss the moment something happens to you. A real plan includes inheritance: a trusted person who knows a recovery exists, enough documented instructions (kept separate from the words themselves) for them to act, and, for larger estates, proper legal arrangements. Plenty of the permanently lost coins above belonged to people who simply never told anyone how to recover them.

Common mistakes that quietly lose wallets

A single paper copy in a drawer — one accident from gone.
A photo or cloud note "just in case" — the case it creates is theft.
Faded or smudged ink, or cheap label-maker tape that peels in a year.
Storing the words next to the hardware wallet — one theft takes both.
Telling no one, with no inheritance path.
A secret passphrase (the optional "25th word") that's memorized and never backed up — forget it and the metal plate is useless.
Typing the words into a "wallet validation" or "sync" tool — that's not storage, that's how the phrase is stolen.

A simple, solid setup for most people

You don't need an elaborate scheme to be in far better shape than average:

Generate the wallet on a hardware device; write the words on paper once, offline, to start.
Transfer them to a stamped metal backup.
Keep two copies in two separate, secure locations you trust.
Store backups away from the hardware wallet itself.
Tell one trusted person that a recovery exists and how to reach it if needed.
For larger holdings, graduate to multisig or SLIP-39 so no one place holds the whole key.

Storage is the unglamorous part of crypto security, and it's exactly where most coins are quietly lost — not to hackers, but to fire, water, and forgetting. The reassuring part is that a metal plate, two locations, and one trusted contact already put you ahead of the people whose coins make up that lost-forever statistic. And if the worst does happen and funds are taken rather than lost, understand the limits of recovery and tracing before you assume anything can be undone.

Informational only — not financial or security advice.

Fake GTA 6 'Early Access' Sites Are Draining Crypto Wallets -- There Is No Early Access

mrtd — Tue, 23 Jun 2026 16:40:15 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

There is no paid "early access" to GTA 6 — only scams

With Grand Theft Auto VI set to launch on November 19, 2026 and official pre-orders opening June 25, years of pent-up hype have created a near-perfect environment for fraud. Security firms are now reporting a surge of fake "early access" sites that take your money — often in crypto — and deliver malware or nothing at all. The single most useful fact to hold onto: Rockstar Games is not selling early access to anyone. Any site that offers it is a scam.

Two scams wearing the same Vice City paint

The fake sites look the part — neon Vice City artwork, GTA 6 logos, luxury cars, AI-generated splash images — and they split into two money-making schemes:

1. Pay-in-crypto "VIP early access." You're asked to send a few hundred dollars in cryptocurrency, enter a payment code, and the game "unlocks." It never does. As Help Net Security and Malwarebytes document, the crypto angle is the whole point for the scammer: payments are irreversible, there's no chargeback and no fraud department to call. Once it's sent, it's gone.

2. Fake "installers" that are malware. Other sites mimic Rockstar's branding and push "downloads" through Discord servers, YouTube links, and forums — Windows installers or Android APKs that actually install trojans. Per Infosecurity Magazine and Gizmodo, the payloads range from credential stealers (browser-saved passwords, banking logins, game session tokens) to cryptominers and cryptocurrency-wallet drainers — and some Android versions intercept SMS messages to defeat text-based two-factor authentication.

Why this is a crypto-security story, not just a gaming one

The two schemes converge on your wallet. The "early access" sites want an irreversible crypto payment; the malware sites want to install a drainer that empties the wallet you already have — and, on Android, to read the SMS codes that would otherwise protect your exchange and bank logins. If you keep crypto on the same device you game on, a single bad "GTA 6 installer" can cost far more than the price of the game.

How to stay safe

Treat every paid "GTA 6 early access" offer as fraud. There isn't one. Official pre-orders open June 25 through legitimate storefronts (Steam, PlayStation Store, Xbox) and select retailers — nowhere else.
Never pay cryptocurrency for game access. A request for crypto in exchange for "unlocking" anything is a flashing red flag precisely because it can't be reversed.
Don't run "installers" or APKs from Discord, YouTube descriptions, forums, or lookalike sites. That's the malware delivery vector. Until launch, there is no GTA 6 file to install.
If you already interacted with one: assume the device and any wallet on it may be compromised. Move funds to a clean wallet, revoke token approvals, change passwords from a different device, and run a malware scan. The SMS-interception angle is also a good reason to move 2FA off text messages to an authenticator app.

This is the same playbook we cover in our guide to social-engineering scams: manufactured urgency around something people desperately want, an irreversible payment, and a download that isn't what it claims. The hype is real; the early access is not.

Informational only — not financial or security advice. This is a developing story; details may change as security researchers track new variants.

The Crypto Scam Texts You Ignore Are Run by Trafficking Victims

mrtd — Tue, 23 Jun 2026 14:35:40 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

The "wrong number" text isn't a wrong number

"Hi, is this Jessica?" "Sorry to bother you — are you free to invest?" The misfired text from a stranger who keeps the conversation friendly and eventually mentions a can't-miss crypto opportunity is one of the most common scam openers on the planet. What most people don't realize is who is usually on the other end: not a lone con artist, but a person who was trafficked, had their passport taken, and is being forced to run that script under threat of violence.

This is the supply side of the scams we cover in our social-engineering guide, and understanding it makes the scams much easier to refuse.

The pipeline: fake job, seized passport, forced fraud

The operations run out of guarded compounds across Southeast Asia — concentrated in border areas of Myanmar, Cambodia, Laos, and connected through Thailand. The recruitment funnel is brutally simple:

A fake job offer. Ads promise well-paid "customer service," "translator," "crypto," or tech roles, often requiring travel to the region.
Arrival and capture. On landing, recruits' identity documents are seized and many are trafficked across a border into a compound.
Forced scamming. Inside, they're held against their will and made to defraud strangers online. The U.S. Department of Justice and U.N. human-rights investigators have documented beatings, torture, and worse used to enforce quotas.

So the manipulation aimed at you is itself the product of coercion aimed at someone else. There are two sets of victims in every one of these chats.

The money: "pig butchering" at industrial scale

The dominant playbook is what's grimly called "pig butchering" — building trust or a fake romance over weeks, then steering the target onto a bogus crypto investment platform that shows fake gains until the moment they try to withdraw. According to Chainalysis, crypto investment fraud of this kind drove an estimated $7.2 billion in losses in 2025, making it one of the most financially devastating forms of cybercrime.

2026: the biggest crackdowns yet — and why the texts keep coming

This year brought the largest coordinated response so far. The DOJ's Scam Center Strike Force and partner agencies restrained more than $701 million in cryptocurrency tied to laundered victim funds and removed over a million scam social-media accounts; a separate global operation reported hundreds of arrests and multiple centers shut. These are real blows.

But the model is resilient: when one compound is raided, operators relocate across a porous border and rebuild. Enforcement alone won't end it — which is why the most reliable protection is still the target refusing to bite.

How to protect yourself — on both sides of the funnel

If you're the target of the scam:

Treat any unsolicited contact that drifts toward investing — especially crypto with great returns — as a scam, no matter how warm or long-running the relationship feels. Romance plus a can't-lose investment is the signature.
The tell is the withdrawal. Fake platforms show profits and then invent fees, taxes, or "verification" to stop you cashing out. Real ones don't.
Never let someone you met online walk you into a platform, an app, or a "support agent." The hard rules in our social-engineering guide neutralize almost all of it.

If you're job-hunting:

Be deeply skeptical of high-paying overseas "crypto," "customer service," or "translator" roles that need you to travel fast and hand over your passport. That is the trafficking funnel, not a career.
Verify the employer independently — real company, real address, real people — before you book anything, and tell someone where you're going.

The uncomfortable truth is that the spam you delete without thinking is the front end of a violent, multibillion-dollar industry built on trafficked labor. The same five seconds of skepticism that protects your savings also helps starve it.

Informational only — not financial or security advice. If you or someone you know may be trapped in one of these operations, contact local authorities or an anti-trafficking organization.

Social Engineering Is How Crypto's Biggest Thefts Now Happen — and How Not to Be Next

mrtd — Tue, 23 Jun 2026 00:04:10 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

The biggest threat to your crypto isn't a hack — it's you

Audited contracts, hardware wallets, cold storage — none of it matters if someone convinces you to hand over the keys. In 2026, social engineering is the leading cause of crypto loss, not exotic exploits. Of an estimated $11.36 billion in crypto scam losses, roughly 65% trace to social engineering — manipulating a human, not breaking a system. The most expensive failures are psychological, and the defense is mostly a set of hard rules you decide in advance.

This is the human-layer companion to our token-approvals guide and defense checklist.

How the manipulation actually works

The mechanics vary; the playbook rarely does. Attackers build trust or urgency, then get you to do one irreversible thing.

Support impersonation. A "support agent" for your exchange or hardware-wallet maker contacts you — on Telegram, X, email, or via a paid search ad — and walks you toward entering your seed phrase or approving a transaction. Investigator ZachXBT documented a victim who lost $91M (783 BTC) to attackers impersonating exchange and hardware-wallet support, and a separate $282M hardware-wallet case. The iron rule: real support never contacts you first, and never asks for your seed phrase.
The "your account is compromised, move funds now" panic play. A fake alert pushes you to "secure" your assets by moving them to a wallet the attacker controls. Urgency is the weapon.
Romance / "pig butchering." A long con that builds a relationship over weeks before introducing a fake investment platform with fake returns — until you can't withdraw.
Fake jobs, airdrops, and "verification." Recruiters, giveaways, and support bots that all funnel toward one thing: your seed phrase, a malicious signature, or a "verify your wallet" approval.

Most of it arrives through messaging platforms — Telegram above all — phishing pages, and impersonated profiles.

Hardware wallets don't make you immune

A hardware wallet protects your key from malware. It does not protect you from yourself typing the seed phrase into a fake "wallet validation" site, or from approving a malicious transaction on a spoofed dApp. Social engineering routes around the hardware entirely by targeting the one part it can't secure: your decision.

The rules that stop almost all of it

Your seed phrase is never needed by anyone, ever. Not support, not "validation," not a migration, not an airdrop. Anyone asking is an attacker. Full stop.
Real support never DMs you first. Exchanges and wallet makers don't slide into your DMs. Treat any unsolicited "support" contact as impersonation and block it without engaging.
Reach support only through bookmarks or in-app help — never a paid search ad, a DM link, or a number someone gives you. Lookalike URLs and sponsored results are a primary vector.
Urgency is a red flag, not a reason. Every social-engineering script needs you to act now. Slow down; a real problem survives a five-minute pause to verify through official channels.
Verify every signature. If a request asks you to approve a token you're not trading, sign a message you don't understand, or "validate" your wallet, stop.

A practical defense setup

Compartmentalize. Keep savings on a hardware wallet that never touches random dApps; use a separate, low-balance hot wallet for day-to-day interactions.
Assume every unsolicited contact is a scam — recruiter, support, influencer giveaway, "I can recover your funds." Especially the funds-recovery ones; they prey on prior victims.
Never type your seed phrase into anything connected to the internet. No legitimate process requires it.
Independently verify people and platforms before sending money or signing — official sites, known channels, a second source.
If you're hit, move remaining funds to a fresh wallet, revoke approvals, and report it; understand that, as we cover in how stolen crypto gets traced, speed is everything and recovery is rarely guaranteed.

The uncomfortable summary: the strongest wallet in the world has a human attached to it, and that's what attackers target. The good news is that a handful of non-negotiable rules — never share the seed, never trust unsolicited support, never act on urgency — neutralize the overwhelming majority of these attacks.

Informational only — not financial or security advice.

Token Approvals: The Silent Way Wallets Get Drained — and How to Revoke Them

mrtd — Mon, 22 Jun 2026 00:07:58 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

The drain that needs no exploit

Most wallets aren't emptied by some exotic smart-contract hack. They're emptied because the owner signed a permission — usually on a convincing phishing site — and a drainer used that permission to move the tokens out minutes later. No private key stolen, no zero-day. Just an approval the victim granted and forgot. This is the single most common way ordinary holders lose funds, and the defense is boring, free, and entirely in your control.

This pairs with our defense checklist and the incidents in our Crypto Hack Tracker.

What a token approval actually is

To let a dApp (a DEX, a lending protocol, an NFT marketplace) move your ERC-20 tokens, you grant it an allowance — an on-chain permission to spend up to some amount of a specific token from your wallet. That's normal and necessary; it's how DeFi works.

The trap is the "unlimited" (infinite) approval. To save you from re-approving on every trade, most dApps request permission to spend as many tokens as you hold — now and forever. Convenient, and also a standing key to your tokens that never expires. If the contract you approved is malicious, or is later compromised, or you signed it on a phishing clone, that allowance is all an attacker needs.

Why old approvals are a liability

Approvals don't disappear when you stop using a dApp or disconnect your wallet — disconnecting is not revoking. The allowance sits on-chain indefinitely. Over a year of DeFi use, a typical wallet accumulates dozens of live approvals, many of them unlimited, to contracts the owner barely remembers. Each one is attack surface. The fix is to treat approvals like passwords: review them, and revoke the ones you don't need.

How to check and revoke

Revoke.cash is the most-used tool, covering 100+ networks. Enter your address (or connect your wallet), and it lists every active approval. Sort newest-to-oldest if you suspect you just signed something malicious, and pay special attention to anything marked unlimited. Revoking sends an on-chain transaction (you'll pay a small gas fee in the network's native token) that sets the allowance back to zero.
Etherscan's Token Approval Checker (and the equivalent on other explorers) does the same from the block explorer side.
MetaMask and other modern wallets now surface and let you revoke allowances natively.

One critical caution: phishing clones of Revoke.cash exist. Bookmark the real site and use the bookmark — never reach a "revoke" tool through a search ad or a link someone DMs you.

If you think you're already compromised

Move fast — the window is short:

Disconnect your wallet from all dApps.
Revoke every approval via Revoke.cash or the Etherscan checker, prioritizing unlimited ones.
Move remaining funds to a fresh wallet (a brand-new seed phrase the attacker has never seen).

Be clear-eyed about the limit: revoking does not recover already-stolen funds and does not reverse transactions. It stops further draining and closes the door. For where stolen funds go next, see How Stolen Crypto Gets Traced.

Habits that keep you safe

Prefer limited approvals over unlimited when a wallet offers the choice — approve only what the transaction needs.
Revoke periodically. A monthly sweep of Revoke.cash clears the junk you've accumulated.
Use a separate "hot" wallet for dApp interactions, holding only what you're actively using; keep savings in a hardware wallet that never touches random dApps.
Verify every signature request. If a site asks you to approve a token you're not trading, or requests an allowance that doesn't match what you're doing, stop.
Bookmark the tools you trust. Most drains start with a lookalike URL.

The uncomfortable truth is that the most expensive mistakes in crypto are usually a single careless click on "Approve." The good news is the antidote costs a few minutes and a little gas.

Informational only — not financial or security advice.

Hackers Hijack Brazil's Emergency Alert System, Waking Millions With a Fake 'Extreme Alert'

mrtd — Sun, 21 Jun 2026 07:46:34 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

A nation woken by an alert that should never have fired

Late on Friday, June 19, 2026 — around 11:40 p.m. local time and into the early hours of Saturday — phones across multiple Brazilian states blared a top-severity "Extreme Alert," the class normally reserved for imminent threats to life. It overrode silent mode by design, jolting people awake in São Paulo, Rio de Janeiro, Brasília, Bahia and Pará. There was no emergency. The national public-warning system had been hijacked.

The message was a taunt, not a warning

Instead of evacuation instructions or a hazard notice, the alert read "misantropi4" — a stylized spelling of the Portuguese misantropia (misanthropy, a hatred of humankind), with the final letter swapped for a "4." The content made clear this was not a malfunction or a mistaken broadcast but a deliberate intrusion into the system that Brazilians are supposed to be able to trust without question.

The regulator pulled the system offline

Brazil's telecoms regulator, Anatel, took the national warning platform — the Cell Broadcast–based Civil Defense alerting system — offline at around 1:30 a.m. to stop further messages from going out. The Federal Police opened an investigation into what officials have described as a probable remote intrusion into the country's critical public-warning infrastructure. As of reporting, no suspect has been publicly identified and authorities have not detailed how the system was accessed.

Why a fake alert is far more than a prank

Emergency alert systems are engineered for maximum trust and reach. They bypass silent mode, hit every phone within a geographic cell, and are reserved for genuine threats to life. That same design is exactly what makes a breach dangerous — not because of what this message said, but because of what the next false alarm could do.

A population that is jolted awake by a meaningless "Extreme Alert" learns, a little, to distrust the channel. The real damage of a hijacked warning system is the "cry wolf" effect: every false alert erodes the public's willingness to act on the real one that may follow — the flood, the wildfire, the evacuation order these systems exist to deliver. A warning channel only works if people believe it.

Critical civic infrastructure is an attack surface

Public-warning platforms belong on the same list as power grids, water utilities and transit systems: civic infrastructure that is high-impact, broadly accessible, and — by mandate — able to command the attention of an entire nation in seconds. They are operated jointly by governments and mobile carriers and tie together many moving parts, which is part of what makes them attractive and difficult to fully lock down.

The risk isn't hypothetical. Even accidental false alerts have shown how fast a single message spreads panic across a population — the 2018 erroneous ballistic-missile alert in Hawaii, a human error rather than an attack, sent an entire state scrambling before the correction came. A deliberate intrusion into the same kind of system raises the stakes considerably.

What to take from it

For the public: a legitimate emergency alert describes a real, specific hazard and points to official guidance. A cryptic word or an obvious taunt is a red flag, not an instruction. When in doubt, confirmation comes from broadcasters and official government channels — not from the alert alone.

For operators: the episode is a blunt reminder that alert origination needs strong authentication and continuous monitoring, that a fast kill-switch matters (Anatel's quick takedown limited the damage), and that a clear public-communication plan is part of incident response — because in a warning system, restoring trust is as urgent as restoring the service.

This is a developing story; details may change as Brazilian authorities continue their investigation.

How to Get a New Site Indexed by Google in 2026 (What Works, What's a Waste)

mrtd — Sun, 21 Jun 2026 00:03:01 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

The uncomfortable first lesson

You built a clean site, submitted a sitemap, maybe pinged IndexNow — and Google still shows nothing. Here's the part most guides skip: getting indexed by Google and getting indexed by everything else are two different problems, and conflating them wastes weeks. We separate what actually moves Google in 2026 from the folklore that just feels productive.

Bing, Yandex and ChatGPT are the easy half

If you've set up IndexNow, you've largely solved discovery for Bing, Yandex, Naver, Seznam and Yep — you POST your new/changed URLs to one endpoint and they get notified instantly. And because ChatGPT Search retrieves from Bing's index, confirmed Bing indexing effectively gates your visibility in ChatGPT's web results. That's a big chunk of the modern search surface handled with one integration.

The catch: Google does not use IndexNow. It has said so repeatedly. So every "instant indexing" claim that leans on IndexNow is talking about Bing's world, not Google's. For Google, you need different levers.

What actually gets you into Google

There are really only two fast paths, plus one slow one.

1. Google Search Console — the only direct lever. Verify your domain (a private DNS TXT record; it does not trigger penalties or "re-evaluation," a common fear), submit your sitemap.xml, then use URL Inspection → Request Indexing on your key pages. There's a soft daily cap (~10–12 URLs), so spread a new site's pages over a few days. GSC is also the only place you can see whether a domain carries an inherited problem — essential if you bought an aged or expired domain.

2. Links on pages Google already re-crawls hourly. Googlebot's crawl budget for a brand-new, zero-authority domain is tiny. The fastest way to get a new URL discovered is a link to it from a page Google visits constantly — Reddit, Hacker News, Medium, established communities. These links are usually nofollow, but in 2026 nofollow is a hint, not a wall — it still seeds discovery. The rule: genuine participation only. One useful link in a relevant thread beats ten drops that get your account banned and stamp an unnatural-link footprint on your domain.

3. Time plus a track record. Consistent, original, bylined publishing with clean technical signals is what graduates you from "crawled occasionally" to "crawled and trusted." There's no button for this.

The myths that waste your time

"Use the Google Indexing API." It's officially restricted to JobPosting and livestream BroadcastEvent structured data. Using it for articles is against Google's terms, unreliable, and risks losing API access. Ignore the blog posts recommending it.
"Ping Google with your sitemap URL." Google deprecated the sitemap ping endpoint in 2023. It does nothing now. Google schedules recrawls off your <lastmod> — so keep it accurate (only bump it on real content changes; inflating it on every page erodes the signal).
"Pay a Telegram indexing bot / a 300-site submission service." These are the exact spam footprints Google's 2024–2026 spam updates target. On an aged/expired domain you're more sensitive to this, not less. Net effect ranges from zero to a penalty.
"Apply to Google News for traffic." Google News is auto-discovery now — no application. A days-old site won't get Top Stories; that needs a publishing track record, clear bylines/datelines, and correct NewsArticle schema. Anyone selling "instant approval" is running a scam.

Don't forget the AI crawlers

ChatGPT-Search (OAI-SearchBot), Perplexity and Google's AI systems matter now — and a crucial 2026 detail: most AI crawlers and Google News do not execute JavaScript. If your content is injected client-side, they see an empty shell. Ship server-rendered or static HTML, confirm it with curl -A "OAI-SearchBot" <url>, and make sure robots.txt doesn't accidentally block OAI-SearchBot, Googlebot, PerplexityBot. Structured data (Organization, NewsArticle, FAQPage, Dataset) and a clean entity footprint help these systems decide you're a real, citable source.

A realistic checklist for a new site

Server-render your content; verify with a bot user-agent. Non-negotiable.
IndexNow on every publish → Bing/Yandex/ChatGPT-Search covered.
GSC: verify, submit sitemap, Request Indexing on key URLs over a few days.
Bing Webmaster: one-click import from GSC; confirms ChatGPT-Search eligibility.
Earn a few links on fast-crawled, high-authority pages — genuinely.
Internal linking + accurate lastmod + a frequently-updated homepage so what Google does crawl, it crawls efficiently.
Publish consistently and wait. Authority is earned, not pinged.

The honest summary: indexing isn't one switch. Bing-class engines you can notify instantly; Google you have to earn with verification, real links, clean signals and time. Anything promising to shortcut that last part is selling you the myth.

This is a practitioner's evidence-based guide, not a guarantee — search behavior changes. For our take on AI-search specifically, see our AI-search visibility analysis.

How Stolen Crypto Gets Traced — and Why It Rarely Stays Hidden

mrtd — Sat, 20 Jun 2026 00:03:01 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

The counterintuitive truth about stolen crypto

When a protocol gets drained, the instinct is to assume the money is gone — spirited into the anonymous ether. The opposite is usually true. Public blockchains record every transfer permanently and openly, so stolen funds leave an immutable, timestamped trail that anyone can follow in real time. Thieves can move the money almost instantly; what they struggle to do is spend it without revealing themselves. That gap — between moving and cashing out — is where nearly every recovery happens.

This is an evergreen companion to our Crypto Hack Tracker and incident post-mortems: not how thefts happen, but how the stolen funds get chased.

Why crypto is traceable in the first place

Three properties make blockchains hostile to launderers:

The ledger is public and permanent. Once funds move, the transaction is visible forever. There is no delete button.
Wallets are pseudonymous, not anonymous. An address isn't a name — but the moment any address touches a service that knows its customer (an exchange, an off-ramp), its entire history becomes attributable.
Address clustering. Analysts group wallets likely controlled by one actor using on-chain heuristics — funding sources, change-address patterns, repeated gas-payers, contract fingerprints — collapsing dozens of scattered addresses into a single traceable entity.

Who does the tracing

A mature forensics industry now exists. Commercial analytics firms — Chainalysis, TRM Labs, Elliptic, and intelligence platforms like Arkham — map fund flows and label entities. TRM's Beacon Network (2025) gives investigators, exchanges and custodians a real-time channel to coordinate freezes. Security outfits like PeckShield, SlowMist and Lookonchain flag incidents within minutes and publish the fund movements, while independent investigators such as ZachXBT fuse on-chain tracing with old-fashioned OSINT. The speed of that public alerting is itself a weapon: the faster an address is labeled "stolen," the harder it is to cash out.

What thieves try — and why it usually isn't enough

Launderers do have tools to break the trail. Mixers like Tornado Cash pool funds to sever the link between deposit and withdrawal. Cross-chain bridges and chain-hopping move value between blockchains to shake single-chain tools. Peel chains skim small amounts across thousands of hops. State-linked actors stretch laundering over weeks in sub-$500K tranches.

But each of these obscures rather than erases. Mixers leak signal through timing and amounts; bridges are increasingly mapped by cross-chain analytics; peel chains are pattern-recognizable; and all of it eventually has to converge on an exit. Tornado Cash itself shows the cat-and-mouse: OFAC-sanctioned in August 2022 (cited as laundering over $7B, including $455M+ for North Korea's Lazarus Group), then delisted in March 2025 after a court ruled its immutable contracts aren't sanctionable property. The legal status changed; the traceability did not.

The choke points

Funds become catchable wherever crypto meets the regulated world:

Centralized exchanges + KYC — the decisive choke point. When laundered funds hit a compliant exchange, accounts get identified and balances frozen. This is the mechanism behind most seizures.
Fiat off-ramps — converting to bank money requires KYC'd intermediaries.
Stablecoin freezes — issuers can freeze tokens on-chain. Tether says it has helped freeze billions in USDT across thousands of cases with law enforcement worldwide (a single August 2025 action froze ~$344M alongside OFAC); Circle can freeze USDC too, more conservatively.
Law-enforcement coordination — the FBI, IRS-CI and partners act on the trail that analytics firms hand them, within a freeze window measured in hours.

It does work — the receipts

Bitfinex (2016): US authorities seized 94,000+ BTC in 2022 (then ~$3.6B); Ilya Lichtenstein was sentenced to 5 years in 2024.
Poly Network (2021): ~$610M drained — and returned almost entirely within days.
Euler Finance (2023): ~$197M exploited; the attacker returned the recoverable funds.
Ronin / Axie Infinity (2022): ~$600M stolen by Lazarus; Chainalysis and US agencies clawed back ~$30M — the first-ever seizure of crypto stolen by a North Korean group.

The hard reality

Recovery is bimodal. When the attacker is cooperative or careless and the theft is reported fast, most funds can come back (Poly Network, Euler). Against professional or state actors, expect partial recovery at best. Chainalysis put 2025 crypto theft above $3.4B, with North Korea's Lazarus alone responsible for roughly $2B — about three-quarters of service-compromise losses. Bybit's $1.5B 2025 loss was mostly laundered despite intense tracing. Tracing isn't magic; it's leverage.

If you're hit: the playbook

Move in hours, not days. The freeze window is tiny and closes as funds split and hop. Speed is the single biggest determinant of recovery.
Notify exchanges and stablecoin issuers immediately with the attacker addresses — on-chain freezes can lock funds before cash-out.
Engage analytics/IR firms (Chainalysis, TRM, Elliptic) and credible independent investigators to trace and publicly flag the flow.
Report to law enforcement early — seizures legally require their involvement.
Preserve evidence: transaction hashes, timestamps, the anchor attacker addresses, logs.
Set expectations. Making stolen funds unspendable is a win even when full recovery isn't possible.

The thief's problem is permanent: the blockchain remembers. For the defensive side of this coin, see How to Actually Protect Your Crypto.

Informational only — not financial, legal, or security advice.

Weaponized DMCA: How Fake Copyright Strikes Bury Competitors in Google — and How to Fight Back

mrtd — Fri, 19 Jun 2026 00:04:03 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

A takedown that proved the point

In April 2026, someone filed a bogus copyright complaint to bury a Press Gazette investigation into Clickout Media — a firm reported to be buying up news brands, swapping staff for AI, and stuffing the sites with offshore-gambling affiliate links. The DMCA notice falsely claimed the original reporting had copied an unrelated article. Google removed the story from search before adjudicating anything; a Search Engine Land follow-up got delisted too. Both were reinstated about two weeks later after counter-notices, but the lesson landed: a single piece of paper can knock a competitor off Google for days, no court and no evidence required (Techdirt).

How a DMCA notice actually hits your rankings

There are two distinct mechanisms, and conflating them fuels a lot of bad SEO advice:

URL delisting. A single facially valid notice removes the specific URL(s) from Google Search. Google acts on the paperwork, not a ruling — verification effectively happens after removal. That ordering is exactly what makes the system abusable.
Site-wide demotion. Since the 2012 "Pirate Update," Google has used the volume of valid removal notices as a ranking signal: "If we receive multiple valid removal notices for a site, the entire site may be downgraded in Search results" (Search Engine Land).

If you're hit, it surfaces in Search Console as a "Notice of DMCA removal" — not a manual action, not a security issue, which is why owners often miss it.

The "18-month penalty" is a myth

A claim circulating in SEO circles says mass DMCA complaints trigger a fixed ~18-month algorithmic filter. We could find no evidence for it — not from Google, Search Engine Land, TorrentFreak, or court filings. Google's own description is the opposite of a fixed sentence: the copyright demotion is a periodically re-checked, decaying signal that eases as a site's valid-notice volume falls. There's no published clock. Treat "18 months" as folklore, not a mechanism.

Why it's abused — and what it costs the abuser

Because removal precedes verification, "spray a pile of notices" is a real tactic, not a hypothetical: TorrentFreak has documented mass bogus notices impersonating well-known brands to knock out legitimate tools. There's also a murkier "takedown-as-a-service" market — though the specific pricing and volume figures floating around trace to single trade-press sources and should be taken as illustrative, not gospel.

Filing a knowingly false notice is not free of risk. Under 17 U.S.C. §512(f), anyone who knowingly misrepresents that material is infringing is liable for damages and attorneys' fees. Courts have enforced it — Online Policy Group v. Diebold (2004) cost Diebold $125,000, and Automattic v. Steiner (2014) produced a ~$25,000 judgment for a fraudulent takedown. The catch: §512(f) wins are rare. Courts require subjective bad faith (Rossi, Lenz), so honest-mistake filers usually walk. It's a real deterrent, but a limited one.

If you're hit: the defense playbook

Catch it early. Watch Search Console for "Notice of DMCA removal," set alerts on sudden traffic/ranking drops, and search the Lumen Database (Harvard) — where Google deposits notices — for the complaint text and the (often anonymous or foreign) filer.
File a counter-notification via Google's official form, asserting a good-faith belief the removal was mistaken. If no lawsuit follows, content is typically reinstated in ~10–14 business days.
Document everything: authorship and publication proof (drafts, originals, archive.org captures), the Lumen copy of the notice, and your traffic/ranking loss.
Escalate to your host, registrar, and Google with proof of original authorship — Google can and does decline clearly non-infringing URLs.
Weigh §512(f) action or a demand letter where bad faith is provable.
Go public. Reporting egregious abuse to outlets like TorrentFreak, Techdirt or the EFF has reversed bogus takedowns through pressure alone.

The takeaway

Weaponized DMCA works because of a structural choice — remove first, verify later — not because of a secret penalty timer. Knowing the real mechanics (URL delisting vs. demotion signal), ignoring the folklore, and having a counter-notice + documentation drill ready is the difference between a two-week dip and a permanent one. Monitor Lumen, watch Search Console, and keep your authorship trail.

Informational only — not legal advice. Consult a qualified attorney for your situation.

UXLINK Exploiter Routes 8,340 ETH Through Tornado Cash as $44M Haul Is Laundered

mrtd — Fri, 19 Jun 2026 00:03:57 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

What's happening now

The wallet attributed to the UXLINK exploiter has resumed moving its haul. On June 17, 2026, the address swapped roughly 14.6 million DAI for about 8,298.6 ETH, then deposited 8,340 ETH into Tornado Cash, according to on-chain alerts from PeckShield and corroborating reporting from The Crypto Times and FX Daily Report.

The Tornado Cash deposits were broken into uneven tranches — amounts like 100 ETH, 10 ETH and 2.6458848 ETH — a routine obfuscation pattern meant to frustrate clustering. The same wallet also bridged about 2.64 ETH (~$4,600) from Ethereum to a Bitcoin address. Even after this round, blockchain trackers say the wallet still holds roughly 10.54 million DAI that has not moved — a large, fully traceable balance sitting in the open.

Background, in brief

UXLINK, a Web3 social protocol, disclosed a security breach on September 22, 2025, tied to a compromise of its administrative multisig. Headline loss estimates have clustered around $44 million, though component figures vary across outlets and were never fully reconciled. Early attribution and forensic tracking came from SlowMist and PeckShield. This article does not detail how the breach was carried out; our focus is the public, on-chain movement of the already-stolen funds.

The Tornado Cash factor

Why route through Tornado Cash now? Because the legal calculus changed. OFAC delisted Tornado Cash from the SDN list on March 21, 2025, following the Fifth Circuit's Van Loon v. Treasury ruling that its immutable smart contracts are not sanctionable "property." In April 2025, a federal judge in the Western District of Texas issued a permanent injunction barring OFAC from re-sanctioning the protocol (CoinDesk).

That means simply using the mixer is no longer an OFAC violation per se — which is precisely why exploiters can now route funds through it with less friction. The caveats matter, though: laundering criminal proceeds remains illegal regardless, co-founder Roman Semenov is still individually SDN-listed, and developer Roman Storm's criminal case continued into 2026 (CoinDesk). Delisting the tool did not decriminalize what it's being used for.

A months-long laundering pattern

This is not a one-off. Trackers have watched the same wallet alternate between ETH and stablecoins for months. Back around March 20, 2026, it ran the opposite leg — swapping 5,496 ETH for roughly 11 million DAI, with Lookonchain estimating about $935,000 in trading profit on that move alone (The Crypto Times). The pattern — park value in DAI when ETH looks rich, rotate back to ETH before mixing — suggests an actor managing the haul actively rather than dumping it.

What UXLINK has done

In the aftermath, UXLINK coordinated with centralized exchanges and law enforcement across Singapore, South Korea and Japan to flag and freeze suspicious transfers, recovering a portion of the assets. The project ran a two-phase user-compensation plan and executed a first token buyback in October 2025 using recovered funds. There is no reported freeze or seizure of the specific ETH now headed into Tornado Cash, and no public negotiation with the attacker.

The takeaway

Two lessons stand out. For projects: an admin multisig is critical infrastructure — signer hygiene, hardware isolation and spending limits are not optional once a treasury or mint authority is attached. For the ecosystem: tracing still works. The funds are labeled, followed and reported in near-real-time; ~$10.5M of the haul remains frozen-in-place by visibility alone. What the mixer delisting changed is the exit — the off-ramp is now legally cleaner, which shifts more of the deterrence burden onto exchanges and on-chain analytics rather than sanctions designations.

See this incident alongside other 2026 exploits in our Crypto Hack Tracker.

Informational only — not financial or security advice. Figures are based on third-party on-chain analytics and may be revised.

How to Actually Protect Your Crypto: 9 Lessons From the Hacks We Cover

mrtd — Thu, 18 Jun 2026 10:44:35 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

We cover crypto-security incidents every week, and after enough post-mortems a pattern emerges: the losses are rarely exotic. The same handful of mistakes show up again and again. Here is a practical defense checklist drawn straight from the cases we've reported — no hype, just what actually moves the needle.

1. Treat your seed phrase as the whole game

A hardware wallet never asks for your seed phrase on a website. The biggest retail losses start with a phished seed or a fake "wallet validation" page. If anything — an app, a support agent, a pop-up — asks you to type your 12/24 words, it is a scam. Store the phrase offline, never as a photo or cloud note.

2. Audit your token approvals

Many drains don't steal your keys — they abuse an approval (allowance) you granted a contract long ago. A buggy or abandoned contract you once approved is a standing door into your wallet. Periodically review and revoke allowances (tools like revoke.cash make this easy), especially for routers and bridges you no longer use.

3. "Deprecated" is not "safe" — withdraw from dead protocols

The Aztec Connect drain of ~$2.19M happened three years after the product shut down, because the immutable contract still held residual funds with no team to pause it. Treat any shutdown announcement as a deadline: withdraw your balance and revoke approvals before you forget.

4. Be paranoid around security disclosures and "urgent updates"

Scammers ride the news cycle. After any legitimate disclosure, expect fake "firmware update" or "migrate your funds now" messages. Update wallet firmware only inside the official app, bookmark official sites, and distrust urgency.

5. Avoid thin-liquidity tokens

Most retail blow-ups happen in low-liquidity altcoins and freshly minted "mining" tokens that are trivial to manipulate. There's a reason Russia's regulator restricted retail investors to just BTC, ETH and USDT — depth is protection. The deeper and more boring the market, the harder you are to rug.

6. Assume romance/investment "opportunities" are scams

The industrial "pig-butchering" networks behind the largest-ever $15B bitcoin seizure and the Disruption Week takedown all run the same playbook: a friendly stranger, a slow build, a fake platform showing fake gains. If someone you met online is guiding your crypto investing, you are the target.

7. Lock down your accounts AND your registrar

Account security isn't just 2FA. The GoDaddy case showed a domain moving despite 2FA and a transfer lock — because the registrar's support desk operated above the customer's settings. For anything critical (exchange logins, your domain, email), use phishing-resistant 2FA (a passkey or hardware key, not SMS) and a registry-level lock on key domains.

8. The money rarely comes back — prevention is the whole strategy

Across enforcement actions, recovered funds are a tiny fraction of what's stolen; mixers and cross-chain bridges move proceeds faster than freezes land. Don't rely on getting hacked funds back. The defense is not falling for it in the first place.

9. Verify before you trust a "no admin keys" claim

"Fully decentralized, no admin keys" is marketed as safety, but it can also mean no one can stop an exploit either. Immutability cuts both ways. For any protocol holding your funds, look for real audits, a live bug bounty, and a track record — not just a slogan.

None of this is complicated, and that's the point. The exotic-sounding hacks we write up almost always reduce to one of these nine failures. Get them right and you've eliminated the vast majority of how people actually lose crypto.

We turn every incident into lessons like these. Follow @mrtdnet on Telegram for the next one.

Russia Will Let Retail Investors Hold Just 3 Cryptos — BTC, ETH, USDT — From July 2026

mrtd — Thu, 18 Jun 2026 06:33:30 +0000

Originally published on MRTD.NET — fast, sourced news on crypto security, cyber & SEO.

Russia is about to do something most crypto-friendly framings avoid saying out loud: tell ordinary investors exactly which coins they are allowed to own. From July 1, 2026, non-qualified retail investors in Russia will be permitted to trade just three digital assets — Bitcoin, Ethereum, and USDT — under the country's incoming "On Digital Currency and Digital Rights" law. First Deputy Governor Vladimir Chistyukhin laid out the framework in early June and pointedly tamped down hopes of near-term additions.

What the rules actually say

Three constraints define the retail regime, per reporting from Crypto Briefing and others:

A three-asset allowlist. Bitcoin, Ethereum and USDT are in. Everything else — Solana, XRP, Cardano, the long tail — is off-limits to ordinary investors unless they qualify as "professional."
A hard spending cap. Retail buyers face an annual limit of about 300,000 rubles (~$4,000) on crypto bought through brokers.
Mandatory risk testing. All investors, qualified or not, must pass a risk-awareness test before trading.

This is not a ban — Russia is building a regulated on-ramp — but it is a tightly fenced one.

In, out, and the "professional" escape hatch

The split is stark. Out of the 10,000-plus tokens that trade somewhere on the market, Russia's retail allowlist is exactly three — about 0.03% of available assets. Yet those three carry the overwhelming majority of real liquidity: Bitcoin and Ethereum together account for roughly two-thirds of total crypto market capitalization, and USDT is the stablecoin that settles the bulk of global crypto trading pairs.

The notable omission is XRP — despite its large market cap and active community, it did not make the cut, a reminder that "big" and "liquid/regulator-approved" are not the same thing. Anything beyond the three requires clearing the professional-investor bar, which is precisely the gate that keeps the retail majority inside the fence.

The logic, and the signal

The central bank's stated rationale is liquidity and risk: restrict newcomers to the deepest, hardest-to-manipulate markets, cap their exposure, and make them acknowledge the risk in writing. Whatever one thinks of the paternalism, the mechanism is coherent — thin-liquidity altcoins are where retail investors get hurt most.

The more interesting question is whether this becomes a template. Russia is effectively treating retail crypto like a regulated securities product: an approved-instrument list, position caps, and suitability testing. That is a very different model from the US "regulation by enforcement" approach or the EU's MiCA licensing regime. An explicit, short allowlist is simple to administer and easy for other risk-averse regulators to copy — and it quietly concentrates legitimacy in BTC, ETH, and the dominant stablecoin while sidelining everything else.

Bottom line

For Russian retail, the practical effect from July 2026 is narrow: three coins, a ~$4,000 yearly cap, and a test. For the wider market, the signal is bigger. When a G20 central bank writes down a three-name allowlist, it is making a statement about which crypto assets it considers real enough to let citizens touch — and which it does not. Expect the "approved list" model to come up elsewhere.

We track crypto policy alongside the hacks. Have detail on the final rule text? Reach us via @mrtdnet on Telegram.