The Finale: What Happened to Dread.
Oct 11, 2026
Written by Scott Wright
About a year ago, I discovered a vulnerability in software that Dread recommended to its users.
Paris’s explanation of the vulnerability, after consulting AI, was basically correct. The root cause was that I failed to account for mathematical bit width.
All this time, I proxied the traffic and collected the sessions of people who reached my Tor descriptors, proxying the main domain to the premium one and vice versa, replacing content where necessary. This wasn’t magic, just a simple technical task. The lack of JavaScript on the site made it much easier—without JS, there isn’t even a chance to detect this kind of attack. Any phisher will tell you that the hardest part is picking apart all those hashes in JavaScript.
Unfortunately, I never obtained any admin sessions because it depends on chance—or, more likely, the admins don’t use public domains.
There’s nothing truly valuable in your private messages, so don’t worry :) Except for a few chats—I’ll contact those users directly later.
After collecting information for several months, I got tired of it and decided to bring this case to public attention. The way it was carried out was deliberately designed to generate maximum publicity.
So you can continue assuming that there was no hack and that the keys simply leaked.
About a year ago, I discovered a vulnerability in software that Dread recommended to its users.
Paris’s explanation of the vulnerability, after consulting AI, was basically correct. The root cause was that I failed to account for mathematical bit width.
All this time, I proxied the traffic and collected the sessions of people who reached my Tor descriptors, proxying the main domain to the premium one and vice versa, replacing content where necessary. This wasn’t magic, just a simple technical task. The lack of JavaScript on the site made it much easier—without JS, there isn’t even a chance to detect this kind of attack. Any phisher will tell you that the hardest part is picking apart all those hashes in JavaScript.
Unfortunately, I never obtained any admin sessions because it depends on chance—or, more likely, the admins don’t use public domains.
There’s nothing truly valuable in your private messages, so don’t worry :) Except for a few chats—I’ll contact those users directly later.
After collecting information for several months, I got tired of it and decided to bring this case to public attention. The way it was carried out was deliberately designed to generate maximum publicity.
So you can continue assuming that there was no hack and that the keys simply leaked.