Learn Crypto Podcast

A 535,400 USDT address-poisoning loss opens this Cardano and Midnight news update, alongside the reported Binance compromise chain and an iOS vulnerability warning. Peter explains why wallet transaction history cannot replace checking an address against its original source, and why unfamiliar interview code or software should be handled in an isolated environment.

The update then covers Blockenfy’s growth from a Midnight hackathon winner, NightKit’s preview route for connecting existing wallets, and EMURGO and Yoroi’s plan to deregister their DRep IDs on 30 November 2026. Viewers will understand how NightKit aims to reduce wallet setup friction and why affected Cardano delegators need to choose a new representative.

The episode includes a sponsored segment from Nexo Australia explaining its Credit Line product, changing loan-to-value ratios and the possibility that borrowers may need to add collateral, repay part of a loan or have assets sold.

Chapters:
0:00 It Wasn't Really a Hack: Address Poisoning
1:54 How the Binance Hackers Got In
4:58 Following the Stolen Funds
6:46 Binance Warns iPhone Users
8:07 Sponsor: Nexo
10:42 Blockenfy on Midnight
11:59 NightKit by 1AM
15:08 EMURGO and Yoroi DReps Are Closing
16:20 How to Find a New DRep
17:42 Strike Finance Liquidity
18:28 Cardano Developer Survey
19:24 I've Joined AlphaGrowth for Cardano PRIME
20:29 Coming Up: Aussie Crypto Tax Videos
21:32 Wrap Up

What you'll learn:
- Address-poisoning victims can mistake a fake transaction in their wallet history for their own test transfer, so the destination address must be checked against its original source before sending funds.
- Developers handling unfamiliar interview assignments or repositories can reduce risk by using a burner computer, virtual environment or Linux system booted from a USB drive.
- Nexo Australia’s sponsored segment explains how a crypto-backed Credit Line uses collateral and why a rising loan-to-value ratio can lead to demands for more collateral, repayment or asset sales.
- Blockenfy progressed from winning the 2025 Midnight Hackathon in Buenos Aires to building a profitable white-label real-world asset tokenisation business.
- NightKit by 1AM is in preview on Midnight testnets and lets users connect an existing wallet, sign a message and open a Midnight account without an app holding their key.
- EMURGO and Yoroi plan to deregister their DRep IDs on 30 November 2026, so affected Cardano delegators will need to select a new DRep.
- Cardano’s developer survey asks builders for 15 minutes of feedback after receiving 109 responses last year.
- Peter has joined AlphaGrowth to support communications and content for Cardano PRIME.

Links & References:
PSA and hack updates on Binance:
- https://link.learncardano.io/QUBpUA
- https://link.learncardano.io/B59542
- https://link.learncardano.io/3M9Ziq
- https://link.learncardano.io/FVTCvB
- https://link.learncardano.io/DjXeJU
- https://link.learncardano.io/17IzsG
- https://link.learncardano.io/0m9vh0
Midnight Updates:
- https://link.learncardano.io/gH7Loe
- https://link.learncardano.io/YpZkvT
Emurgo / YOROI DRep:
- https://link.learncardano.io/nrE9bB
- https://link.learncardano.io/vG2x1z
Strike:
- https://link.learncardano.io/R0YU4g
Developer Survey:
- https://link.learncardano.io/MXumOK
Cardano PRIME:
- https://link.learncardano.io/Inp2ix
New Upcoming Content:
- https://link.learncardano.io/6FI2qc

Website: https://link.learncardano.io/bQ68Rc
X/Twitter: https://link.learncardano.io/3a1Qtv

Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice.

DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.

🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k

Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/

Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano

A Web3Auth infrastructure vulnerability exposed private keys for some Keplr wallets created through Google or Apple social login. Peter explains why this was not a compromise of Google or Apple accounts, how affected wallets could be swept, and what the reported recovery activity means for users.

The episode breaks down how Web3Auth reconstructs wallet keys, the difference between a two-of-three Shamir’s Secret Sharing setup and single-factor authentication, and why changing a Google password cannot secure a private key that has already leaked. It also covers the concentration risk of using one social account across many services and the role of unique credentials and password managers.

Cardano users also get practical context on social-login wallets, self-custody and the questions to ask before trusting any provider-assisted wallet setup.

Chapters:
0:00 Intro
0:40 What Happened at Keplr
2:40 How a Web3Auth Login Works
3:56 Shamir's Secret Sharing
4:59 Single Factor Mode
6:07 Web3Auth's Statement
6:22 The Rescue and the Numbers
8:32 Should You Sign In With Google?
10:07 CZ on Self-Custody
10:41 Are Cardano Users Affected?
11:12 Wrap Up

What you'll learn:
- Web3Auth said a vulnerability in its own infrastructure led to private keys leaking from some Keplr wallets created with Google or Apple login.
- Google and Apple accounts were not identified as the compromised systems; the failure involved the wallet key service behind the social login.
- Web3Auth’s typical two-of-three model separates login, device and recovery shares, but single-factor mode can make the network-held share sufficient to rebuild a wallet key.
- Changing a Google password cannot protect a wallet after its private key has already leaked.
- The episode cites roughly 44,700 swept wallets and about US$5.6 million held in Web3Auth recovery addresses, while distinguishing recovery activity from confirmed theft.
- Using one Google account across many services creates concentration risk even when Google itself was not breached in this incident.
- Crypto users should understand who can reconstruct their wallet key and whether independent device or recovery factors are required.
- Cardano users should review any wallet that uses social login and compare its key-sharing design with seed phrase or hardware-wallet self-custody.

Links & References:
Full show notes:
- https://link.learncardano.io/MBzf2y
- https://link.learncardano.io/qiQ3pp
- https://link.learncardano.io/wehj3I
- https://link.learncardano.io/zsZ82Y
- https://link.learncardano.io/EFvn8V
- https://link.learncardano.io/bA98t8

Website: https://link.learncardano.io/bQ68Rc
X/Twitter: https://link.learncardano.io/3a1Qtv

Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice.

DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.

🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k

Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/

Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano

Cardano’s next scaling phase and Midnight’s mainnet rollout are both moving forward. This update covers the final NIGHT redemption window, a draft rewards model for Cardano stake pool operators, open smart-contract deployment on Midnight, Monument Bank’s tokenised deposit plans, and the latest Dijkstra testnet work ahead of Leios.

Peter also breaks down live ecosystem activity across RealFi, Strike, ATLAS, Ascend, Revuto and WingRiders, including new mainnet launches, integrations and infrastructure upgrades. The episode includes a paid sponsorship segment from Nexo Australia at 7:58 explaining how crypto-backed credit lines work, including loan-to-value and liquidation risk.

PAID PARTNERSHIP DISCLOSURE: This episode contains a sponsored segment from Nexo Australia beginning at 7:58.

Chapters:
0:00 Happy 39th Birthday, Charles
0:39 Glacier Drop: The Last Thaw
2:43 NIGHT Rewards for SPOs
4:10 Midnight and Other Chains
5:27 Midnight Mainnet Open to Developers
6:05 Monument Bank and the SALT Panel
7:58 Sponsor: Nexo
10:41 RealFi and Pulsewave
12:16 Dijkstra and Leios
14:06 Strike and Conflux
16:10 Atlas on Mainnet
16:54 Ascend Market Prediction Perps
18:12 Revuto on Solana
19:23 WingRiders DEX Revamp
20:11 Wrap Up

What you'll learn:
• Midnight’s final NIGHT redemption tranche is under way, with 28 days remaining from the recording date to claim eligible tokens.
• A draft Midnight proposal outlines how participating Cardano stake pool operators and delegators could earn NIGHT through block production, but the mechanism is not yet active.
• Midnight has opened mainnet smart-contract deployment to developers, allowing more applications to move beyond the earlier gated process.
• Monument Bank presented plans for a one-year tokenised fixed-term deposit that would be available to UK retail customers.
• The Dijkstra test network was upgraded on 2 November as Cardano prepares protocol work that includes Leios scaling.
• Strike is adding Conflux-linked fiat off-ramps and incentives while approaching two billion in all-time trading volume, according to the episode’s cited updates.
• ATLAS has launched on Cardano mainnet, while Ascend has introduced prediction perpetuals to private mainnet groups on Midnight.
• The sponsored Nexo Australia segment explains that borrowing against crypto can create rising loan-to-value and liquidation risk when collateral values fall.

References:
Happy BDay Charles:
- https://link.learncardano.io/jgCX8P
Pineapple on Pizza:
- https://link.learncardano.io/cezM7v
Glacier Drop Redeem Ends Soon:
- https://link.learncardano.io/mVjpbV
Midnight Updates:
- https://link.learncardano.io/5Z5RPo
- https://link.learncardano.io/OCNBqh
- https://link.learncardano.io/rx1BNt
- https://link.learncardano.io/AjTvig
- https://link.learncardano.io/wJzW1u
Learn more about Nexo:
- https://link.learncardano.io/QR6DJe
RealFi:
- https://link.learncardano.io/nIK3uH
- https://link.learncardano.io/psHjzK
Dijkstra Hardfork:
- https://link.learncardano.io/vIidij
Strike Finance Killing It:
- https://link.learncardano.io/OhsgKc
- https://link.learncardano.io/RvcYTw
- https://link.learncardano.io/rU5ZYr
ATLAS Beta Public Mainnet Live:
- https://link.learncardano.io/nndhj7
- https://link.learncardano.io/hJVE3z
- https://link.learncardano.io/XkLxVE
- https://link.learncardano.io/lSMxd2
Ascend Prediction Perps Live in Midnight Mainnet:
- https://link.learncardano.io/HMs6sM
- https://link.learncardano.io/aK7Xm2
Revuto Solana:
- https://link.learncardano.io/SWWhA7
Wingriders Upgrade:
- https://link.learncardano.io/XpziVg
- https://link.learncardano.io/TmHJxa

Website: https://link.learncardano.io/cQEeJd
X/Twitter: https://link.learncardano.io/sH30IF

Disclaimer: Educational content only; not financial, tax, accounting or legal advice. Borrowing against crypto can involve collateral calls and liquidation risk. Consider your circumstances and seek appropriately licensed professional advice.

DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.

🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k

Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/

Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano

Cardano PRIME has selected its first cohort of nine teams for AlphaGrowth's Cardano DeFi program. Peter breaks down what Sundae Labs, Liqwid Finance, Indigo, Steer, VIA Labs, ReBond, Dial, Midgard Labs and TxPipe are expected to deliver.

The cohort covers new market functions, isolated lending markets, collateral upgrades, automated liquidity management, cross-chain routing, tokenised bonds, programmable invoices and independent smart-contract audits—all aimed at addressing infrastructure gaps and supporting deeper liquidity on Cardano.

Chapters:
0:00 Cardano PRIME's First Cohort
1:15 How the Teams Were Picked
1:51 Sundae Labs and What Cardano DeFi Is Missing
3:17 Liqwid V3
3:49 Indigo
4:08 Steer
4:40 VIA Labs
5:18 ReBond
5:40 Dial
7:05 Midgard Labs
7:22 TxPipe
7:52 Nine Teams, One Goal
8:48 Wrap Up

What you'll learn:
- Cardano PRIME's first cohort includes nine established and newer teams working across Cardano DeFi infrastructure.
- Sundae Labs, Liqwid Finance and Indigo are funded to expand core market, lending and collateral capabilities.
- Steer and VIA Labs focus on automated liquidity management and easier cross-chain asset routing into Cardano.
- ReBond and Dial add tokenised bond and programmable invoice use cases.
- Midgard Labs and TxPipe provide independent smart-contract security reviews for cohort projects.
- The program is designed to address missing infrastructure and support AlphaGrowth's stated goal of increasing Cardano DeFi liquidity.

Links & References:
- Cardano Prime on X: "TxPipe (@txpipe_tools) TxPipe builds core developer tooling for Cardano and runs smart-contract security audits. PRIME has secured a block of audit hours with them, so every grantee ships with an independent security review behind it." / X: https://link.learncardano.io/hgGYGE
Cardano DeFi is ready to scale.:
- https://link.learncardano.io/2kmfpx

Website: https://link.learncardano.io/bQ68Rc
X/Twitter: https://link.learncardano.io/3a1Qtv

Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice.

DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.

🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k

Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/

Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano

CVE-2026-98432 is a critical Linux kernel vulnerability affecting versions dating back to 4.4. Because many Cardano stake pools run Linux infrastructure, exposed relays may face crashes or, in a worst-case scenario, remote compromise.

Peter explains how the reported TCP use-after-free works, what it could mean for relays and block producers, and the practical guidance from Intersect: identify affected kernels, apply fixed packages when available, reboot, and use temporary MPTCP or firewall mitigations only as exposure reduction—not as a replacement for patching. The episode also covers Clay Stake Pool’s closure and why delegators should check that their chosen pool is still operating.

Chapters:
0:00 A Linux Bug Hits Cardano Stake Pools
0:31 The Notice: CVE-2026-98432
1:45 Red Hat Details and Which Kernels Are Patched
2:35 How the Bug Works
3:27 Anthropic's Claimed Exploit
3:52 What It Means for Stake Pools
4:38 Worst Case: From Relay to Block Producer
5:16 Your Delegated ADA
5:54 Ubuntu Is Still Waiting on a Patch
6:32 What Stake Pool Operators Should Do
7:03 More Attacks Every Week
7:29 Clay Stake Pool Closes
8:34 Check Your Delegation
8:51 Wrap Up

What you'll learn:
- CVE-2026-98432 is rated CVSS 9.8 and affects Linux kernel versions dating back to 4.4.
- Internet-facing Cardano relays are the most exposed part of a typical stake pool setup.
- A relay outage can stop a pool from propagating blocks even when the block producer remains online.
- Intersect advises operators to check kernels, install fixed packages and reboot as soon as their distribution publishes them.
- Disabling MPTCP or filtering TCP packets with IPv4 options may reduce exposure but does not replace patching.
- Delegators keep custody of their ADA, but should still confirm their chosen stake pool remains active and maintained.

Links & References:
CVE-2026-98432 (CVSS 9.8):
- https://link.learncardano.io/1gLE5G
- https://link.learncardano.io/dwTQxW
- https://link.learncardano.io/tfLwiU
Security advice:
- https://link.learncardano.io/oyvXSP
- https://link.learncardano.io/2QIXbc
Claymates Closing It's Stakepool:
- https://link.learncardano.io/2La0QW
Intersect Weekly Update Advice:
- https://link.learncardano.io/OKumWG
- https://link.learncardano.io/KEGOaM

Website: https://link.learncardano.io/bQ68Rc
X/Twitter: https://link.learncardano.io/3a1Qtv

Disclaimer: This content is for educational purposes only. Nothing constitutes financial advice.

DISCLAIMER: This content is for informational and educational purposes only and is not financial, investment, or legal advice. I am not affiliated with, nor compensated by, the project discussed—no tokens, payments, or incentives received. I do not hold a stake in the project, including private or future allocations. All views are my own, based on public information. Always do your own research and consult a licensed advisor before investing. Crypto investments carry high risk, and past performance is no guarantee of future results. I am not responsible for any decisions you make based on this content.

🔗 https://www.youtube.com/watch?v=Fq8FhvxET2k

Subscribe to the audio podcast:
🔗 https://bit.ly/learncardano-spotify
🔗 https://apple.co/3jEPM8C
🔗 https://learncardano.io/

Follow on Social:
🔗 https://x.com/learncardano
🔗 https://facebook.com/learncardano