V12 @v12sec · Twitter · 2026-09-02 19:22 UTC XSS to full account takeover and wallet drain in Ditto. V12 found a deeplink parser bug that steals Nostr private keys with just one click. Here's how. 🧵
