Highlights
The wallet security expert is not in the building.
CEELOS opened with an intro song dedicated to Val, who then did not appear. Baked delivered the diagnosis: "Val is our wallet security specialist." CEELOS: "Bake, school me, bro. I know nothing." Baked: "Hell, me neither." The episode proceeded regardless, which turned out fine.
The basics, stated plainly.
Baked laid out what he does know: revoking approvals, a cold wallet that stays disconnected from everything and just holds things, and a separate hot wallet for minting. CEELOS added that the old hard rule of "never click a link" has loosened into "never click a link from a source you don't know" — and that the real killer isn't ignorance, it's speed.
CEELOS's own drain, replayed in slow motion.
An airdrop everyone was talking about, a link, a wallet connection, a signature — and then a gas transaction that should have stopped him cold. It didn't. The gas was paying to move the most valuable token in that wallet out of it. His accounting of the aftermath is the honest part: funny, then angry, then stupid, then "damn, I got violated" 24:40. His takeaway was that it was a Degen mint wallet that had quietly accumulated something worth having, because he'd never cleaned it out.
Glyph wallet and why visiting other rooms pays.
CEELOS explained the delegation concept — a connected wallet that reads your contracts and presents a kind of ghost profile, so the real assets never touch the site — and noted he only learned about it by sitting in other chains' Spaces full of people he didn't know. Baked had made one two months ago purely because a game required it.
The messy room analogy.
CEELOS's framing for approval hygiene: your favorite t-shirt is in there, that movie stub from ten years ago is in there, it's still your room — but it needs cleaning. Weekly, monthly, whatever pace you move at, but regularly. He extended it to space hosts as a duty: say the boring thing out loud for the half of the room that isn't rolling its eyes 26:02.
"Connect your X account" gets the side-eye.
A shared point of paranoia. CEELOS bailed on an alpha-channel link that same day the moment it asked for his X account; Baked said he understands signing a transaction far better than he understands what connecting X actually does, and has seen too many accounts hacked to find out.
Social engineering runs on patience.
Jed described people being worked for weeks or months — friendship first, trade offer later — including one case where someone spent a month on a target holding hundreds of ETH in NFTs to extract maybe 1.5 ETH. His red flag heuristic: anyone creating urgency is running a scam. Then the complementary rule, delivered as self-incrimination: don't go on OpenSea drinking, "don't do anything Jed does" 33:47. Baked confirmed he'd learned that one the hard way.
Contract-level defenses.
Jed's post-hack priority: a 721C upgradeable contract with a kill switch for transfers and the ability to retrieve an NFT while it's in transit — "every single project should have that. It's just common sense." He's also looking at multi-sigs as stronger protection than a ledger, and soft staking with a multi-sig attached rather than hard staking on Anvil.
Dedicated devices and seed phrase discipline.
Moon (@AfRedwave)*, between gutting a rental property, described a computer used for wallet transactions and nothing else — no web, no gaming. Jed runs the same setup on a dedicated MacBook with only OpenSea and MetaMask on it, and added: never connect to hotel/public Wi-Fi. On seed phrases, Jed keeps four copies in four spots; CEELOS described rewriting his original pencil-on-an-envelope-scrap in marker, numbered, and the particular dread of losing access rather than assets 49:44. Moon's cautionary tale: a Magic Eden wallet password he's certain was "Mountain Dew something" and has never recovered 52:05.
The regen think tank.
Jed used his last five minutes to float an incubator: a community-run Discord where builders come with ideas and the project supplies network, marketing, devs and small capital raises. His critique of "build with your IP" as it's usually practiced — it costs real money, and the builder ends up marketing someone else's brand for free. Under this model mints stay under $20, builders take the majority of mint funds (roughly 80/20, not 30/70), and the real goal is ecosystem depth: "think about if we had 15 people… building shit like they build." Baked backed it as giving community members control and cover under the umbrella 1:04:35.
Topic timeline
| Time | Topic |
|---|---|
| 1:10–5:20 | Intro song dedicated to the absent Val; Val is the wallet security specialist |
| 5:45–13:14 | Day-job detour: roaster filters, a plate stuck sideways, and mosquito bite inventory |
| 13:14–18:02 | Security basics; CEELOS's airdrop drain story |
| 18:38–22:00 | Glyph wallet / delegation; recent hack; why to check dormant wallets |
| 23:11–27:26 | Approval housekeeping; whose fault drains are; host responsibility |
| 27:26–29:58 | "Connect your X account" skepticism |
| 29:58–36:27 | Jed joins: CEX preference, 600 open approvals, social engineering, don't crypto impaired |
| 36:27–41:07 | Contract-level security: 721C, pause transfers, retrieval, multi-sig |
| 43:50–48:00 | Moon joins: dedicated devices, SIM swaps, public Wi-Fi, phone paranoia |
| 48:36–54:16 | Seed phrase storage, splitting phrases, AI brute-forcing a missing word |
| 54:16–56:24 | Call to space hosts to keep wallet security a weekly topic |
| 56:24–1:08:14 | Regen think tank incubator pitch and feedback |
| 1:08:47–1:11:29 | Closing remarks, Moon's regen plans, the week's schedule |
Notable quotes
Need to organize it and make sure that everything is as it should be, and anything that shouldn't be in there gets the hell out.
I wanna say 99.5% of the time is your fault. You fucked up.
It ain't that serious for me to connect my X account.
Always trust your gut. That's how I live in the space.
You wouldn't go into the bank and make a deal if you fucking were up for 48 hours.
Nobody's done this before… they all just tell people to do it, but they don't really do anything about it.
Who said what
- CEELOS (@CEELOSFIGG) — Host. Opened without his security expert, filled the gap with his own drain story, the "clean your room" framing for revoking approvals, and a charge to other space hosts to keep saying the basics out loud weekly.
- Baked (@Bakedmetax) — Cohost. Anchored the beginner end honestly: hot/cold wallets, revoke, and an open admission that he trusts his understanding of signing transactions more than he trusts "connect your X." Backed the think tank as a way to give builders room under the project umbrella.
- Jed (@jed_131)* — Brought the hardest-won material: six years without a loss until the recent hack, ~600 outstanding approvals, social engineering patterns, and the rule that drunk/tired/rushed is when people lose everything. Announced the 721C upgrade work with Chrono and pitched the regen think tank incubator.
- Moon (@AfRedwave)* — Dropped in mid-renovation with the single-purpose-machine approach to security, a SIM swap warning, and the Mountain Dew password that got away. Closing note: he's getting a regen this week.
Worth a full listen
- 15:16–18:02 CEELOS narrating his own drain beat by beat, including the exact moment he should have stopped. The emotional post-mortem at 24:40 is the part that actually sticks.
- 32:20–36:27 Jed on social engineering, urgency as a red flag, and the pattern behind nearly every big drain he's heard about. Specific, lived, and funnier than it has any right to be.
- 56:24–1:02:53 The full think tank pitch, uninterrupted. Worth hearing in Jed's own framing rather than summarized, especially the critique of how "build with your IP" usually works out for the builder.
* some voices are identified from context; those names are marked as likely.
