A former Coinbase employee has been accused of stealing code and using ChatGPT to illegally change the licensing of another open-source AI coding firm to create PearAI.

Matthew Duke Pan, known as ‘Frying Pan,’ claims to have made $270,000 a year working for the crypto exchange before quitting to make PearAI. Last Friday Pan announced the AI firm had secured $500,000 in funding from the startup accelerator program YCombinator (YC).

However, after Pan promoted PearAI at the YC event on X (formerly Twitter), users criticized the firm for “stealing” the code of fellow open-source AI code editor Continue.dev and passing it off as its own.

Someone also claimed they illegally relicensed PearAI to an enterprise license. In response, Pan said, “Dawg i chatgtp’d the license.” He added that he would change the license if there was a problem and claimed ”We busy building rn can’t be bothered with legal.”

President and CEO of YC, Garry Tan, responded to the backlash by defending Pan. He repeatedly noted that Continue used an open-source Apache license and that he didn’t “understand why people are dragging a new project.”

However, the conversion of Continue’s Apache licensing to enterprise was repeatedly called out for its illegality and Tan has since changed his stance, noting that the relicensing was “clearly a mistake,” and that it has been fixed now.

Read more: Binance says GitHub data leak could cause ‘severe financial harm’

Pan’s X post received a community note over this period that said PearAI “mass-replaced” all references of ‘Continue’ to ‘PearAI’ and used its code. But this note was taken down and for the past 24 hours, Pan has been out on damage control.

He called the note “objectively false” and claimed, “We are way too open and honest for this slander.”  Pan noted that PearAI’s GitHub “About” section states it is a fork of VSCode and Continue and claims that he has publicly credited Continue for months on GitHub and in various YouTube videos. 

Protos has reached out to Frying Pan for comment. 

Got a tip? Send us an email or ProtonMail. For more informed news, follow us on X, Instagram, Bluesky, and Google News, or subscribe to our YouTube channel.

Edit 16:55 UTC, Oct 1: Corrected Garry Tan’s role at YC to president and CEO rather than founder.

The post Former Coinbase employee accused of ‘stealing’ code for PearAI appeared first on Protos.

CoinDesk initially reported, and a Protos review has confirmed that the Ethereum Foundation removed a ‘warrant canary’ from its website on February 26, according to a commit to its GitHub repository. 

A warrant canary is a symbol or piece of text that states the entity has not received a certain type of inquiry. By removing the canary, the entity can signal that it has received outreach from authorities. The text that was removed from the Ethereum Foundation website appears to have said:

“The Ethereum Foundation (Stiftung Ethereum) has never been contacted by any agency anywhere in the world in a way which requires that contact not to be disclosed. Stiftung Ethereum will publicly disclose any sort of inquiry from government agencies that falls outside the scope of regular business operations.”

The merge request corresponding to this change on GitHub further notes that the foundation “received a voluntary enquiry from a state authority that included a requirement for confidentiality.”

Read more: Ethereum’s Dencun causes ‘Blast’ layer 2 outage

It is important to note that the request is explicitly described as a ‘voluntary enquiry,’ and it’s not clear what ‘state authority’ may have sent in this request. 

The regulatory status of Ethereum in the United States has been thrust back into the spotlight with the United States Securities and Exchange Commission (SEC) considering the applications for various spot ether Exchange Traded Products (ETPs).  

Got a tip? Send us an email or ProtonMail. For more informed news, follow us on X, Instagram, Bluesky, and Google News, or subscribe to our YouTube channel.

The post Ethereum Foundation ditches ‘warrant canary’ appeared first on Protos.

Binance says leaked passwords and site code that were viewable on GitHub for months before being taken down last week could cause “severe financial harm,” reports 404 Media.  

The exchange, which recently saw its US arm booted from Alaska and Florida, appealed to GitHub and successfully took down the leaked data last week. In its takedown request, Binance said the upload wasn’t authorized and that the data posed a “significant risk to Binance,” may cause “severe financial harm,” and could confuse or harm its users.  

404 Media saw the data before it was taken down, and claimed it could’ve been beneficial to hackers looking to compromise Binance’s systems. 

The outlet claims the leaked data included:

• code relating to Binance’s implementation of passwords and multi-factor authentication;
• diagrams detailing the interlocking of Binance’s dependencies;
• supposed passwords for systems labeled “prod” which 404 says may relate to the live site.  

Read more: Did Binance ex-chief CZ really come to the US voluntarily?

The leaks were shared by an account called ‘Termf’ and were reportedly viewable for months. When 404 Media questioned Binance on January 5, a spokesperson said, “​​We are aware that there’s an individual online claiming to have sensitive Binance information.”

The spokesperson said its security team assessed the data and found it did “not resemble what we currently have in production.” They added, “Users should rest assured that their data and assets remain safe on our platform.”

404 Media noted there is no evidence to suggest that the data was accessed or used by a malicious party. It is also unknown if the data was leaked accidentally or if it was leaked by a Binance employee or someone outside the company. 

Got a tip? Send us an email or ProtonMail. For more informed news, follow us on X, Instagram, Bluesky, and Google News, or subscribe to our YouTube channel.

The post Binance says GitHub data leak could cause ‘severe financial harm’ appeared first on Protos.

A mysterious automated crypto mining operation has been caught using more than 30 free GitHub accounts to produce a raft of obscure tokens in a suspected dry run before it turns its attention to more well-known currencies.

According to a report from The Register, the operation, dubbed Purpleurchin, has been using the GitHub accounts, alongside more than 2,000 Heroku and 900 Buddy devops accounts to power its mining efforts.

The tactic is called “freejacking,” and involves taking over the computing power allocated for free trial accounts on continuous integration and deployment (CI/CD) service platforms.

Researchers say the team responsible has so far only mined a handful of little-known tokens, including Sugarchain, Tidecoin Onyx, Yenten, Sprint, and Bitweb, and as such will only have seen very low profit margins.

However, it’s suspected that they’re just warming up and using the relatively small-scale scheme as a smokescreen for something far more lucrative — possibly even an attack on the underlying blockchain that could, in theory, net millions in bitcoin or monero.

“We can say with a medium amount of confidence that the actor has been experimenting with different coins,” researchers told The Register (our emphasis).

“This large-scale operation could be a decoy for other nefarious activities.”

Read more: This Bitcoin Core update will protect full node operators from hacks

Purpleurchin’s plot could leave real users out of pocket

Despite providers like GitHub using a number of tactics — including increasingly complicated CAPTCHA forms and requiring credit card information — to combat attacks like these, this team is thought to be particularly sophisticated.

According to researchers, each of the free GitHub accounts is costing the platform’s owner, Microsoft, $15 per month, with the free accounts from Heroku and Buddy costing around $10.

“At these rates, it would cost a provider more than $100,000 for a threat actor to mine one monero (XMR),” experts told The Register.

Unfortunately, for legit cloud service users, these costs will likely be passed onto them by GitHub et al. to cover the shortfall at their end. Illegal mining operations could also take up resources that reduce the performance afforded to paying customers.

For more informed news, follow us on Twitter and Google News or listen to our investigative podcast Innovated: Blockchain City.

The post Stealthy crypto miners loot altcoins with GitHub trial accounts appeared first on Protos.