The way they "prove" that aegis-ln belongs to the perp is also interesting. They mark this as "proven" and give two reasons in the "how we know" section: the first is that this node showed up as the "node pubkey" in an ln invoice they paid, but that is no proof at all, because proxies exist to disrupt the assumption that "node pubkeys" belong to the recipient. They can be faked, and if that was their only reason, they wouldn't know. Maybe aegis-ln is really just a proxy.
Their second reason is stronger, and involves address reuse by the perp. Allegedly he opened a channel from aegis-ln to someone else using funds deposited to aegis-ln from an address he previously used in preparation for the theft. If that is true it's a much bigger mistake by the perp, and suggests that LN privacy devs still have a lot of work to do. Privacy tools need to automate this stuff so that addresses are not reused. But I haven't verified the site's "proofs" yet so I'm really not sure they are all as certain as they claim to be.
Super Testnet
npub1yx…c399s
2026-10-08 22:16:42 UTC
in reply to nevent1q…25vs
Author Public Key
npub1yxp7j36cfqws7yj0hkfu2mx25308u4zua6ud22zglxp98ayhh96s8c399sPublished at
2026-10-08 22:16:42 UTCEvent JSON
{
"id": "d49db8afa76dc936159cbb68dd4d6d8f7a560f0692fcf0e78643c562529210db",
"pubkey": "2183e94758481d0f124fbd93c56ccaa45e7e545ceeb8d52848f98253f497b975",
"created_at": 1791497802,
"kind": 1,
"tags": [
[
"e",
"a1cb750f09593d57a9724612f2eecd4d0cd05d213f9583aa21efcf35a752807f",
"wss://nostr.oxtr.dev/",
"root",
"2183e94758481d0f124fbd93c56ccaa45e7e545ceeb8d52848f98253f497b975"
],
[
"e",
"969717b582c5735ef7f511a396d44bafcc3fa4e29fba57924e0463019524e917",
"wss://nostr.mom/",
"reply",
"68240d4932950242924434c5b118035a92448a9570caf1fde7aeca77afbc80e4"
],
[
"p",
"2183e94758481d0f124fbd93c56ccaa45e7e545ceeb8d52848f98253f497b975",
"wss://relay.damus.io/"
],
[
"p",
"68240d4932950242924434c5b118035a92448a9570caf1fde7aeca77afbc80e4",
"wss://relay.ditto.pub/"
],
[
"client",
"Amethyst"
]
],
"content": "The way they \"prove\" that aegis-ln belongs to the perp is also interesting. They mark this as \"proven\" and give two reasons in the \"how we know\" section: the first is that this node showed up as the \"node pubkey\" in an ln invoice they paid, but that is no proof at all, because proxies exist to disrupt the assumption that \"node pubkeys\" belong to the recipient. They can be faked, and if that was their only reason, they wouldn't know. Maybe aegis-ln is really just a proxy.\n\nTheir second reason is stronger, and involves address reuse by the perp. Allegedly he opened a channel from aegis-ln to someone else using funds deposited to aegis-ln from an address he previously used in preparation for the theft. If that is true it's a much bigger mistake by the perp, and suggests that LN privacy devs still have a lot of work to do. Privacy tools need to automate this stuff so that addresses are not reused. But I haven't verified the site's \"proofs\" yet so I'm really not sure they are all as certain as they claim to be.",
"sig": "8a9a34786fbb7cd37e1977f0da2876898529bd993c4d931034ab3d7d60d2648d750ba3a8a603308af8937b0ae2ec8fc87e66cb5025dcba681fd1a01e7921d157"
}