NZ Darknet Market Forums

hondafit

Member

Registered: 2026-01-12

Posts: 23

Warehouse got Hacked

Unsuprisingly the warehouse got hacked. This is all that is on the onion:
"This is why you don't vibe code a marketplace !
No nftables, passwords stored in plaintext, admin panel exposed,
wallet key in .env
Retarded admin used same password for everything SSH, marketplace, Dread"

If this is true then your password is exposed, which you shouldn't be using across multiple places anyway.

WaltDisney

Moderator

Registered: 2026-01-11

Posts: 105

Re: Warehouse got Hacked

I called him out on his AI market, and then look what happened he got hacked. Using AI to build a darknet marketplace is basically asking to get hacked into. Same goes for the people who defend him.

In the end, I was right. I knew that UI was way too smooth to have been built in just a few months like they claimed.

Last edited by WaltDisney (2026-06-09 15:15:23)

---

Find Us on Blackops WaltDisney
Just Sign Up Here

Xar777

Member

Registered: 2026-01-13

Posts: 25

Re: Warehouse got Hacked

Ironically it was probably hacked with the assistance of AI which is one thing it is actually fairly good at (in the hands of someone that knows some shit).

If you are running a darknet site you should be getting AI to hack your stuff now before someone else does it. almost all large security orgs and gov agencies now have access to the (likely over-hyped) "mythos" LLM which is allegedly very good at hacking.

Time to lock that shit down as things are getting ugly out there.. it's always been a wild west but these days it's insane seeing the sheer volume of constant attacks and penetration/exploits bots running in the wild is unrelenting. Constant streams of advanced level recon and exploits coming from all over the place likely a mixture of rouge hackers and gov agencies. I am not just talking smack here as I actually run some large scale infra and there is no room for amateur mistakes anymore, the ones that understand security and systems hardening will rise to the top the others will be taken out sooner rather than later.

kiwismurf

Member

Registered: 2026-04-19

Posts: 22

Re: Warehouse got Hacked

Ironically it was probably hacked with the assistance of AI which is one thing it is actually fairly good at (in the hands of someone that knows some shit).

If you are running a darknet site you should be getting AI to hack your stuff now before someone else does it. almost all large security orgs and gov agencies now have access to the (likely over-hyped) "mythos" LLM which is allegedly very good at hacking.

Time to lock that shit down as things are getting ugly out there.. it's always been a wild west but these days it's insane seeing the sheer volume of constant attacks and penetration/exploits bots running in the wild is unrelenting. Constant streams of advanced level recon and exploits coming from all over the place likely a mixture of rouge hackers and gov agencies. I am not just talking smack here as I actually run some large scale infra and there is no room for amateur mistakes anymore, the ones that understand security and systems hardening will rise to the top the others will be taken out sooner rather than later.

Hey mate i've been taking a nosey into this.  Any LLM recommendations?  I've been messing around with hackerai.co but am reluctant to subscribe to it as i already do others which have tighter guardrails.

Xar777

Member

Registered: 2026-01-13

Posts: 25

Re: Warehouse got Hacked

heya kiwismurf, I am actually quite anti AI in general so I don't have much experience with many different LLMs (as someone who has been coding since nappies they still write shitty mid tier code IMO but I have to admit they are excellent at anything that requires a certain level of fuzzy logic).

But, I have used the claude code CLI tool to run a full security audit on a bunch of production code and it found quite a few relatively minor bugs and couple more serious ones on a very mature codebase in a statically typed and memory safe language. Most of the bugs it found were logic based (makes sense given the language and maturity). I signed up for what ever the pro/unlimited plan was at the time, spun up a debian VM and installed the claude CLI tool then just let go nuts with the "full audit" command on all my source. I would recommend this if you have non-audited code running in the wild as it most likely will find something.

As for pen tests, I have not tried this yet (using AI tools) as my stuff is already well battle hardened and is holding up fine so far against the bots. But I have heard others say that the Chinese tool calling LLMs shine here as they have less "ethical guard rails" when it comes to hacking (makes sense) so I would give one of those a try personally (kimi perhaps?).

One other thing to consider, if you use the free plans on any major LLM they will use any data you send to them as training material.. so I always recommend paying for at least a small plan and checking the privacy settings do not allow training on your data. Also maybe off topic slightly but also beware of "SynthID" that shit is being injected by all the major gen AI now so anything generated can possibly be linked to your account directly, the SythID system can store an arbitrary array of integers which is more than enough for a uniq ID...

james.earl.whitaker

Member

Registered: 2026-04-01

Posts: 16

Re: Warehouse got Hacked

Hard agree on paid plans. If you are pasting real source into an LLM, check the data settings. Do not assume the default is private enough for production code.

Also worth saying that the person using it still needs to understand the output. LLMs can find real issues, but they also hallucinate, overstate risk, and suggest fixes that look fine until you trace the code properly. If someone blindly copies the output and ships it, they have probably just moved the bug somewhere else.

On the Claude yarns, since it was mentioned above, the Claude Mythos/Fable release and pullback is probably the signal. Not "AI writes secure code now". More that models at that level are getting useful for chewing through whole systems and finding boring process failures. Enough that the US government treated access as a national security issue, restricted foreign national access and Anthropic ended up pulling user access entirely.

Auth gaps, exposed admin paths, secrets in the wrong place, bad deploy habits, weak firewalling, unsafe state changes, reused credentials. That sort of thing.

If the Warehouse claims are true, that was not just an AI problem. That was basic engineering discipline missing. A stronger model might have caught a lot of it, but only if someone used it properly, understood the findings and actually fixed them.

The win is not AI replacing security skill. It is making dumb mistakes harder to miss before someone else finds them.

Last edited by james.earl.whitaker (2026-06-15 10:56:58)