Re:Building Together EP 334 — "People Over Pictures" (a.k.a. Revoking Together)

Host: CEELOS (@CEELOSFIGG) with co-host ValerieKates (@valeriekates_) · Fri, Sep 25 · 1:06:19 · 6 speakers

TL;DR

• The whole episode got hijacked (in the good way) by the day's big wallet exploit — a wave of drains traced back to old Magic Eden approvals. Everyone on stage spent the hour revoking, checking activity tabs, and comparing damage.
• The day's PSA: revoke.cash (no wallet connection needed — paste your address), plus the new batch-revoke feature that turned a multi-ETH cleanup into a single transaction.
• Casualties in the room were mostly sentimental: CEELOS and Val's jointly-owned DGen Tune, Jed's Corkies and Clutch Puppies. Regens appear untouched, likely saved by the collection's contract migration.
• Actual decision: a recurring wallet-security segment/space gets added to the schedule, and CEELOS put the call out to every host and big account to make "did you revoke today?" a regular refrain.
• Tools surfaced: Pocket Universe (browser extension) and its mobile counterpart Kerberus; Ledger/Trezor for cold storage — with Ghostin's crucial caveat that cold storage does not save you from approvals you already signed.
• The white-hat-ish twist: the drainer wallet holding millions in NFTs put up a claim site so people could get their stuff back, and had already pulled ~$7k in tip donations.

Highlights

[3:40] The revoke.cash sermon begins. CEELOS explains you can just paste an address — no connecting — and found that all his degen wallets were clean while his main wallet had 31 live approvals. Baked had the same split: side wallets pristine, main wallet stacked. "That's how that usually goes."

[7:33] The exploit had a strangely decent ending. Baked reports no regens moved, and that the wallet holding the drained NFTs put up a claim site so people could recover their assets — with about $7,000 in donation tips already sent to the person who built it. "I think this is the first time I've seen like a big hack go down, and it actually turned out not as bad as everyone thought."

[16:27] Val arrives to deliver the bad news about the shared degen wallet. The old jointly-owned DGen Tune — bought on Magic Eden years ago and largely forgotten — was part of the exploit. The On-Chain Buccaneer survived. CEELOS's verdict on the lost Tune: Val never liked it anyway.

[19:04] "Why not just redo the contract?" Baked floats the fix (pause the old contract, airdrop replacements to the drained holders) and CEELOS delivers the hard truth about how many teams actually care enough to do it. Ghostin adds the practical wrinkle at [31:49]: you'd have to move immediately, because once the stolen items resell you're now rugging the buyer who had a standing offer.

[24:25] The anonymous wallet standoff. Val explains she built one completely isolated wallet nobody could ever trace after CEELOS started announcing he watches wallets. CEELOS: "I found it… I just saw who funded that wallet, and I just kept going backwards." Val, unmoved: "No one knows that wallet." Ten seconds later, Val recounts a friend's 2022 epiphany — everyone can see everything — which CEELOS files under gift and curse of the blockchain [27:02].

[35:10] The call to action that landed hardest. CEELOS turns the day into a standing ask for every host, podcaster and reply guy: bring security up constantly, even if it's just ten minutes and even if it's repetitive, because you never know who's hearing it for the first time. This is also where the running bit is born — "did you revoke today?" — alongside the sock check/security check framing and the line about people out there unprotected in the wild wild west.

[39:30] Val turns into the research desk. She reads out what Pocket Universe actually does (transaction preview, drainer warnings, phishing blocks), then discovers the iOS app of the same name is unrelated astronomy software. Baked had already found it: "there's two different apps called Pocket Universe, and they're both about stars" [40:47]. The real mobile version is Kerberus, spelled out at [41:04] over admirable difficulty.

[42:07] Total signal collapse. CEELOS drops off mid-sentence because he went to the App Store to download the thing — "completely rugged him" — and for about two minutes the room is a braid of a listener saying hi, Val homeschooling a Minecraft lesson she can't play, and a character stuck in a crouch. Val at [44:52]: "Layla is yelling at me because she can't figure out how to get her player uncrouched." Baked is losing the thread from the other direction when CEELOS asks whether she did "station identification" and has to explain it's an old radio term [44:41].

[48:08] The dad joke of the week. CEELOS, on why everyone should keep spreading the word: "it's on us to keep getting that information out there… save their asses. I mean their assets. Oops." He claims Friday as his defense.

[1:01:36] Ghostin's genuinely important note. Cold storage is not a force field: if you signed approvals at any point, those live approvals persist and people with hardware wallets still got drained. Baked's translation at [1:02:10]: after you send NFTs to cold storage, go revoke immediately and keep that thing actually cold. Baked also passes on Ghostin's tip from the night before at [59:42] — keep your hardware wallet firmware updated.

[1:00:36] The landfill Bitcoin legend. The story of the guy who spent months searching a dump for a USB drive with 10+ BTC on it gets a fitting toomazing response: "I'm hiring the whole city, whoever finds it gets a bitcoin."

[1:03:38] The safest outro in web3. CEELOS signs off narrating himself doing 90 on the freeway steering with his knees; Baked admits he is, in fact, also driving with his knees. Val: "Oh my god, you guys, we are all over the place right now." CEELOS: "Let's get out of here before something terrible happens."

Topic timeline

Notable quotes

• "A lot of collections don't give a damn about their community and their holders, and they could care less if they got compromised." — CEELOS [19:28]
  ▶

  0:38
• "Wait a minute, everyone can see everything you do and everything you have. And I'm all, yup." — ValerieKates, on a friend's blockchain epiphany [26:47]
  ▶

  0:38
• "There's a lot of people out there just raw dogging it to the web three." — CEELOS [35:10]
  ▶

  0:38
• "It just amazes me that there's still that level of either unknowing or not fucking caring enough to protect your assets." — ValerieKates [23:23]
  ▶

  0:38
• "I be high most of the time… just to be on my, just clear the conscience." — toomazingTM, on why he revokes weekly [50:34]
  ▶

  0:38
• "Even with cold storage, you weren't completely safe there." — zGhostin [1:01:36]
  ▶

  0:38

Who said what

• CEELOS (@CEELOSFIGG, host) — ran the show from a gas station and then a freeway; turned the exploit into the episode's thesis, made revoke.cash the unofficial sponsor, and challenged every host with a mic to keep security in rotation.
• ValerieKates (@valeriekates_, co-host) — arrived with the bad news about the shared DGen Tune, doubled as the room's research desk on Pocket Universe/Kerberus and hot vs cold wallets, proposed putting recurring security talks back on the schedule, and fielded a Minecraft emergency live.
• Baked (@Bakedmetax) — reported on damage across the regen community, raised the "new contract + airdrop the drained holders" idea, and relayed the firmware-update tip; one lens down on his sunglasses for most of the hour.
• zGhostin (@zGhostin) — the room's early-warning system: spent the morning DMing people about open approvals, and closed the loop with the key technical point that signed approvals survive a move to cold storage.
• toomazingTM (@TooMazing265) — revokes weekly on principle, described how a DJ wallet quietly became a second main wallet, and provided the landfill-Bitcoin bounty proposal.
• A listener who hopped up around [42:07] (BeeCuzFuture)^* — said he misses catching the show now that it's during his workday, which prompted the explanation of the new schedule.

Worth a full listen

• [33:56] – [38:38] — the heart of the episode: Val's suggestion to bring security discussions back, CEELOS's extended call to action, and the birth of "did you revoke today?" as a standing greeting. It builds naturally and the energy doesn't survive summarizing.
• [38:38] – [45:12] — the Pocket Universe research bit collapsing into an astronomy app, CEELOS getting rugged by the App Store mid-sentence, three overlapping conversations and a crouched Minecraft character. Chaos best experienced in real time.
• [59:00] – [1:02:26] — the most genuinely useful technical stretch: hot vs cold wallets, Ledger/Trezor, firmware updates, and Ghostin's warning that approvals outlive your migration to cold storage.

* some voices are identified from context; those names are marked as likely.