PANDAPALS ROUNDTABLE: Digital Safety

Host: Panda (@PandaPals__) with cohosts Waldo (@waldoforrealz) and Curtis Gore (@curtisgore) · Mon, 28 Sep 2026 · 9:37:19 across 3 parts · ~25 speakers

TL;DR

• VEXE (@vexe_5), a cybersecurity pro since 2012 and certified ethical hacker, co-hosted a two-hour security deep dive built around the recent Magic Eden / Limit Break payment-processor exploit. Core takeaway repeated all night: disconnecting your wallet is not the same as revoking approvals — use revoke.cash (or Base Rooms, Rabby, Phantom's native tool) and do it monthly.
• Practical checklist that emerged: segregate wallets (vault / daily / burner), separate email for crypto and banking, device-specific 2FA over SMS, no public Wi-Fi, no browser extensions if you can avoid it, no QR codes, and pen-and-paper backup codes. VEXE offered free one-on-one basics in her Discord and monthly first-Sunday sessions, plus a virtual-machine workshop.
• ThatOneKitty revoked her approvals live on the Space and reported it took about two minutes — the most quoted proof-of-concept of the night.
• The room then spent hours on the philosophical follow-on: should NFT contracts have freeze/suspend functions? Opinions split between full self-custody purists and those who watched one founder save a whole collection. Nobody landed on a clean answer.
• Community business: Pengy Peng pitched a daily copy-pasta around Panda's national-day posts (tomorrow: National Coffee Day), staking is targeted for the coming weekend, and cross-mint from Solana is next on the roadmap.
• Capstiller demoed "My Wally," a 3D Waldo model whose NFT unlocks downloadable OBJ/FBX/STL files, built after he taught himself Blender from scratch.

Highlights

[P1 10:29] Waldo's "how to actually get our attention" PSA. When Curtis Gore flagged that Ousman Jallow had been in his DMs and trying to call him, Waldo turned it into a teaching moment rather than a callout: come to spaces, be genuine, build relationships over time. "We'll teach you over time, you know, how to fish on your own." Ousman took it well and said he'd rather learn to fish than ask for a feast.

[P1 27:44] Curtis Gore premieres "Digital Degree." Curtis wrote and produced a song for the community; after a rough first playback attempt, he piped it through himself. The chorus — "No professors, everybody teaches... come earn your digital degree" — landed hard enough that Panda pulled out the exact line he loved: nobody has all the answers, and that's the entire point.

[P1 37:43] "First of all, this is the most sexiest occupation out there." Panda introduced VEXE by apologizing that security isn't the sexiest topic. She immediately corrected him, and the bit ran all night. She then walked through her actual résumé — master's in information security in 2014, GRC and audit work, ethical hacking cert in 2018, turning down C-level seats because she'd rather stay technical.

[P1 43:00–52:57] The Magic Eden / Limit Break post-mortem. Panda laid out the mechanics carefully: the marketplace itself wasn't hacked, an old payment processor was, and approvals live at the wallet level so they survive long after a platform stops using a provider. VEXE confirmed stale approvals are among the most common attack vectors and delivered the line she's been repeating for three years. Panda's analogy: you gave a contractor a key two years ago and never took it back.

[P1 1:06:00] Kitty does it live. ThatOneKitty.base.eth went to revoke.cash mid-conversation, did Ethereum and Base, select-all, revoke — "it was done in like two minutes, maybe maybe less." The single most actionable moment of the night, and the one Panda kept referencing for the next seven hours.

[P1 1:24:14–1:26:52] Public Wi-Fi, USB chargers, and the one VEXE couldn't answer. She's blunt on public Wi-Fi ("10 out of 10 times there's probably something on there") and on public charging cables carrying malicious payloads. Pengy Peng asked about wireless charging and she declined to bluff: "I'm not gonna lie. If I don't know, I don't know." She promised to research it and report back — same for Kerry's question about Tangem wallets, where the one flaw she knew of was the lack of firmware patching.

[P1 1:52:00] OneEyedWillie's bull-market warning. He popped in mid-IRL to say he'd been pulling into dormant wallets and found piles of permissions going back to 2022–2023, some with no limits at all. Curtis Gore gently noted he'd said he couldn't join the space; OneEyedWillie took the hit — "calling me out, calling me out" — and kept going anyway.

[P1 3:47:00–3:50:00] The Armageddon barter economy. What started as gold-vs-silver hedging with WRXcryptominer spiraled: Waldo declared he'd stock swords and pickaxes, trade a paperclip up to a horse, and defend his camp with a Home Alone trap setup and flaming bags of dog shit. Pengy Peng, deadpan: "In an Armageddon situation, I'm not buying bullets from a person who doesn't have a gun. I'm taking it."

[P2 1:06:40–1:19:25] Capstiller's "My Wally" build. He turned his Waldo #8 into a 3D model, then built a foundry where you can recolor glasses, hair and skin and mint it — the NFT gates access to the actual OBJ, FBX and STL files. Changes cost a quarter's worth of Freels token, which gets burned. He learned Blender entirely on his own ("the AI didn't help me with Blender"), and Waldo said watching it go from Nifty Island character to on-chain asset had him genuinely blown away.

[P3 0:58:00] Peanut brings the uncomfortable angle. On the white-hat rescue everyone praised, Peanut relayed a since-deleted post comparing it to a murder scene: how did one person know exactly what to do, that fast? He was careful to say he's not a hater and that the rescue genuinely saved people's weeks — but that it's worth digging rather than jumping on the glaze train. It reframed the whole trust conversation.

[P3 2:19:00–2:42:00] The sugar refinery saga. Winding down, Capstiller told the story of his 89-day stint at a sugar refinery: spilling roughly ten wheelbarrows of raw sugar while tracking a conveyor belt, getting written up for cleaning it up (union work), having his parked truck dragged and ripped apart by the sugar train, and finally being fired minutes after visibly geeking out over a wrecked gearbox in front of a room of executives. Curtis Gore's running commentary ("you wrecked the sugar train... I kind of felt bad for you at first, but the more the story develops, the more I think it was justified") had Panda in actual tears.

Topic timeline

Notable quotes

"You come here in space and you just be genuine with us. You build up relationships over time. It takes time to build genuine relationships." — Waldo [P1 10:29]

"First of all, this is it is the most sexiest occupation out there. What are you talking about?" — VEXE [P1 37:43]

"Disconnecting your wallet is not the same as revoking permissions... I've been harping this for the last three years. Revoke your permissions." — VEXE [P1 48:00]

"The more layers you have, the harder you make it for a hacker... Time has to justify the payout, they're not gonna continue." — VEXE [P1 52:57]

"We're at the time that everybody's gonna get hacked. There's nobody that's not gonna get hacked, you will get hacked sooner or later... what I look at is how did they respond?" — VEXE [P1 59:00]

"There's more than enough food at the table for all of us. There's no reason that we got to get the knife and you know, stab the person at the next to you and take their fucking plate." — Waldo [P1 14:02]

Called out for Re:Cap

• [P3 1:57:19] I'm here by myself. There ain't nobody here. Actually, there is one dude here, but he's like all the way down on the other end… asked: Recap that.
  ▶

  0:38
• [P3 2:17:55] Like, this guy came in today. He came on stage. And literally the second he came on stage, like Curtis is like, I don't know… asked: Maybe that'll make the recap.
  ▶

  0:38

Who said what

• Panda (host) — drove the security agenda, translated VEXE's technical points into plain analogies, and spent the back half stress-testing the ethics of freeze/suspend functions on himself and the room. Also gave product updates: 342 pandas minted, staking targeted for the weekend, cross-mint next.
• VEXE (@vexe_5) — the specialist co-host and the backbone of the first two hours. Practical, unshowy, and willing to say "I don't know" and promise follow-up. Offered free one-on-one onboarding and monthly basics sessions, and plugged a virtual-machine workshop for safely clicking sketchy links.
• Waldo (@waldoforrealz) — cohost, room energy, chief bamboo-waterer (relentless about reshares and comment counts), and author of the evening's Armageddon barter doctrine.
• Curtis Gore (@curtisgore) — opened with the Digi Blunts parallel on founder liquidity, premiered "Digital Degree," warned about SEO'd fake bank phone numbers and sponsored search links, and served as straight man to Capstiller's closing saga.
• Pengy Peng (@YesImPudgy) — proposed the daily national-day copy-pasta and pushed to make it a real habit; also asked the wireless-charging question and staked out a clear position: mark assets as stolen, yes; reverse transactions or remint, no.
• All Your Base Are Belong To You (@AllYourBase_AYB) — walked through Base Rooms as an OS with built-in revoke, journaling and smart-contract explainers, and the on-chain interactive "buddy" NFTs; argued the real precedent for stolen-asset flagging comes from the traditional art market.
• WRXcryptominer (@wrxcryptominer) — the long-memory voice: lost 100 BTC on a USB drive and ~20 more to defunct exchanges, hence his preference for hot wallets he actually uses, plus physical gold and silver as diversification.
• BillabongMonkey (@BillabongM) — bullish on ETH and L2s, dug into tokenized-stock volume and LP fee farming, and flagged the dilemma of a founder who can edit contracts also being able to turn everyone's NFT into a unicorn.
• Capstiller (@capstiller) — demoed "My Wally," self-taught Blender, favors keeping trade inside communities over secondary marketplaces, and closed the night with the sugar refinery.
• Peanut (@peanutt) — brought the contrarian read on the white-hat rescue, made the case for "online hygiene" as routine maintenance, and is hosting a distillery tour in an old Cabarrus County prison.
• Röcky (@Rockchilld3) — on Verge's optional Tor, bail-in risk, and his own Moth launch as Sonic wound down; website rollout targeted for the weekend.
• Kerry (@kerrymcook) — asked the sharpest hardware question of the night (Tangem's NFC card with no visible seed phrase) and urged anyone holding over a thousand dollars on an exchange to get a cold wallet.
• ThatOneKitty.base.eth (@ThatOneKitty__) — revoked live and reported back in two minutes flat.
• OneEyedWillie (@WilliamPordobel) — minted a panda, then popped in to warn about 2022–2023 permissions lurking on older chains.
• WAGBi (@WAGBi_) — on AI video tooling (Seedance 2.5, Higgsfield) and credit burn rates; also the room's early-warning system for trolls.
• Unc Huff, ThatOneKitty, Ousman Jallow, Bankyo, Chérie, Mari, SLAVA and others added check-ins, questions and encouragement across the night.

Worth a full listen

[P1 43:00]–[P1 1:10:00] — The core security segment. Panda and VEXE work through the exploit, stale approvals, cold-wallet misconceptions, wallet segregation and multi-sig in one continuous arc, with Kitty's live revoke at [P1 1:06:00] as proof it takes minutes. This is the part to send to anyone new.

[P1 3:22:00]–[P1 3:50:00] — Self-custody philosophy dissolving, gradually and delightfully, into a full Armageddon economics debate: gold vs. silver vs. seeds vs. bullets vs. Waldo's sword-and-pickaxe arbitrage scheme. The summary cannot carry the escalation.

[P3 2:19:00]–[P3 2:42:00] — Capstiller's sugar refinery story with Curtis Gore's running commentary. Ten wheelbarrows of sugar, a truck versus a train, and a firing timed to one moment of genuine mechanical enthusiasm. Panda was crying by the end, and the timing is everything.