Altumptic
Contact

Altumptic

Security research, done in the open.

An independent lab studying how the software that guards keys and servers breaks under attack — and building open tools that don't.

Flagship releasesResearch log

01Flagship artifacts

Two releases, written up like research.

Each ships with its source, its threat model and the limits we know about. Read how it works before you run it.

ALT-01Release · Self-custody walletv4.10.0-beta.5

Phobia Wallet

A self-custody wallet for Windows, Linux and Android that holds keys for 18 chains and nothing else of yours — no account, no telemetry, Tor inside the binary.

Runs on
Windows · Linux · Android 7.0+
Built with
C# · .NET 8 · Avalonia
Tests
1,860+ offline, on every push
Verify
SHA256SUMS · attestations · SBOM
Audit
None yet — planned
License
MIT

Problem

Most wallets trade privacy for convenience without saying so. Exchange wallets hold your keys and know who you are; private wallets usually cover one chain; Tor support usually means a setup guide that most people never follow.

Approach

One vault for every chain, sealed on the device, and a wallet core that never touches the network. Everything that does talk to the outside goes through one Tor-aware client, and a kill-switch turns “not over Tor” into “not at all”.

Your device
Public network

1VaultArgon2id → AES-256-GCM

The 24-word seed is generated on the device (BIP39, 256 bits from the OS random generator) and sealed with your password: Argon2id at 64 MiB, then AES-256-GCM. It is decrypted only in memory, only when needed.

Fig. 1 What stays on the device, and the one way out of it. Select a component for details.

Known limits

  • No external security audit yet. It is planned; until then, treat the wallet as beta software.
  • Installers are not yet reproducible byte-for-byte; the assemblies that derive keys and sign are.
  • The Windows signing certificate is self-signed, so Windows shows no publisher name.
  • Linux cannot hide key screens from screen capture; the wallet says so.

ALT-02Release · Security operationsv3.0.0

LemonSees

An agentless security operations console — SIEM, EDR, file integrity, NDR, threat intel with MITRE ATT&CK, SOAR and GRC — over plain SSH.

Runs as
Web app · Windows .exe · Linux AppImage · Docker
Built with
Node.js · React · TypeScript · Electron
Footprint
One Node.js process, ~100 MB
Standards
CIS · NIST · ISO 27001 · GDPR
License
MIT

Problem

Agent-based monitoring is heavy: an agent on every host, an indexer cluster, a dashboard stack and days of tuning. Every agent is one more privileged process to patch, update and trust.

Approach

Treat the SSH session as the agent. One multiplexed connection per host collects telemetry, file-integrity baselines and auth logs in a single round-trip per poll — and nothing keeps running on the server in between.

Your machine
Your servers

1Interfacebrowser · Electron

A React interface in a browser or an Electron window on Windows and Linux. Pages load on demand, and live updates that change nothing are dropped.

Fig. 2 Everything the console knows comes through one SSH session per host. Select a component for details.

Known limits

  • Monitoring is only as wide as the SSH account you grant — give it the least privilege that still reads what you want watched.
  • Serving the web interface on a network needs a long random token and TLS in front of it.
  • SSH keys are recommended over passwords; credentials stay on the machine running LemonSees.

02Research & engineering log

Everything we publish, in one register.

Releases, specifications, analyses and policies, newest first. Identifiers are permanent — cite them.

Research and engineering log, newest first
DateIDTitleCategoryStatus
ALT-10Two billion downloads a week: the npm attacks of September 2025AnalysisPublished
ALT-09The xz backdoor: the attack that waited two yearsAnalysisPublished
ALT-08Bybit, $1.5 billion: the keys held, the screen liedAnalysisPublished
ALT-07The ATB website attack: what is known, what is notAnalysisPublished
ALT-06Japan's cyber emergency, in numbersAnalysisPublished
ALT-02LemonSeesReleaseStable · v3.0.0
Open the full log — 10 entries

03The lab

One principal researcher. Full ownership.

thefear

thefear

Founder & Principal Researcher

Altumptic is an independent research and engineering lab, founded in 2025 by thefear. It is not an agency and has no sales team: it exists to study how security-critical software fails, and to publish what it builds and finds under one name.

Every entry in the log is designed, written and maintained here — from the first disassembly to a signed release.

Focus
Applied cryptography · Reverse engineering · Security operations
Publishes
Releases · Specifications · Incident analyses

04 Manifesto

Understand it. Break it. Build it better.

A lab, not an agency. Everything here is published with its sources and its limits — what is finished, what is not, and what we do not know yet.

05Principles

Rules the lab does not bend.

  1. 01Understand it before building it.
  2. 02Security from the first commit.
  3. 03Evidence over assumptions.
  4. 04Authorized work only.
  5. 05Responsible disclosure, always.
  6. 06Privacy is the default, not a feature.

06Engagements

Outside work, taken selectively.

The lab takes a few outside engagements, only in areas it already publishes on. Each starts with a written scope and ends with a report you can check line by line.

How an engagement runs

  1. 01ReconMap the system and the threats that actually matter.
  2. 02AnalyzeRead the code, reverse what has none, test the rest.
  3. 03BuildFix in small reviewed slices, boundaries built in.
  4. 04HardenRe-test and document until it holds on its own.

07Contact

Write to the lab.

A question about a release, a correction to something we published, or an engagement. Every message is read by a person and answered in plain language.

  • Emailthefear078@gmail.com

    Releases, reports, engagements and anything detailed.

  • Telegram@thefear078

    Quick questions and direct messages. Usually the fastest reply.

Found a security issue? Write to thefear078@gmail.com, encrypted with our PGP key if you can. Scope, timelines and safe harbor are in ALT-03, the disclosure policy.