Field Report: Post-Conference Release + Attack Thwarted at Tether

To our community — Most of you are coming off Abu Dhabi Finance Week and Solana Breakpoint. If you weren't on the road, you probably still felt the ripple effects: faster message volume, higher stakes conversations, and a very real "do not drop the ball" operating tempo.

We built Pantheon for exactly this environment — when your network is moving faster than your tools can keep up.

This post is a long-form field report and release update. It covers what shipped, what broke (and why), what we rolled back mid-flight, and the security incident we had to triage in real time.

If you felt delays in comms: that's on us. The truth is we were simultaneously battle-testing the product and fighting an active security fire.

---

The Week We Didn't Expect

Token weeks are already intense. But this one hit differently.

1) A real battle-test… with a rollback mid-week

During peak travel and peak usage, we pushed a major upgrade. The release performed in some areas and regressed in others. We made the call to roll back portions of the deployment while users were literally:

• in transit
• on bad WiFi
• switching devices
• dealing with high-volume DMs

If you felt frustration: you weren't wrong.

We care more about trust than velocity. That rollback was us choosing reliability, even if it temporarily felt messy.

2) A client was hacked - and we dropped everything

Unexpectedly, one of our users was personally hacked.

It was unfortunate - and it consumed our bandwidth - but it also validated why Pantheon exists. This is exactly the type of moment we built MILO for: preserving your operating surface area when the worst happens.

What we can share right now:

• We had already backed up the user's data and preserved ~1,500 contacts.
• We triaged an active impersonation attempt.
• We mass-messaged several affected users and began actively putting out fires across the user's network.
• The impacted set ranged from everyday crypto professionals up to senior people at Tether.
• Known loss currently sits around $175,000, and we believe we prevented further losses through early discovery of the malware path and interruption of spread.

This appears to be part of a broader wave of masked malicious links designed to look legitimate (e.g. "Zoom" prompts / fixes) that ultimately attempt to:

• steal Telegram sessions
• compromise accounts
• drain wallets / private keys
• impersonate the victim and propagate inside their network

If you want the deeper incident notes:

If you click the button circled in red, your computer is completely compromised. No matter what the alert says. You run the script, you die, the end. If you clicked it before, disconnect your computer from the internet and secure your assets and protocol ASAP. — Tay 💖 (@tayvano_) September 25, 2025

We'll also be publishing more material on the incident soon - including what we observed, the patterns that repeated, and what operators should be watching for. The goal isn't fear. It's preparedness.

---

What We Shipped (and Why It Matters)

Nobody cares about lines of code. The only metric that matters is:

Does MILO make you faster, safer, and more organized in Telegram — without trust violations?

This release pushed hard on three themes:

• Privacy control
• Speed at operator tempo
• Reliability across real-world conditions (airplanes, bad WiFi, restarts)

---

1) Update: Per-Contact Privacy Control (/exclude)

You've always had blunt controls:

• you can start/stop tracking directly in MILO
• you can remove MILO from a chat entirely

/exclude is the precision tool for when you want MILO enabled overall, but need to carve out specific contacts without changing your broader setup.

With /exclude, you can toggle message content tracking per contact:

• When a contact is excluded:
  • we may keep high-level counts/metadata for continuity
  • message content is dropped
• You can toggle it on/off anytime
• It supports fuzzy search + disambiguation (so you don't need perfect spelling)

Use it for:

• client conversations
• sensitive counterparties
• compliance-heavy workflows
• any contact you want to keep "in the book" without retaining content

How to use it

• /exclude (instructions)
• /exclude John
• /exclude @username

---

2) Notes That Work Like Operators Actually Work

Notes are only useful if they're frictionless at speed.

We rebuilt the notes workflow so you can log context without losing the thread of your day.

What's new

• After you save a note, you get a 📋 View Notes button.
• You can reply directly to the notes card to add follow-up notes.
• Works across three contexts:
  • /note command
  • business messages
  • reply-to-bot flows

Data quality upgrade: deduplication

We've seen people accidentally save the same note twice (especially under travel fatigue). Now:

• duplicate notes are detected (case-insensitive, whitespace normalized)
• old duplicates are auto-cleaned during save

Net effect: cleaner exports, cleaner memory, less noise.

---

3) Business Commands Are 2–3x Faster

This one you should feel.

We optimized routing so commands get processed immediately (instead of waiting for slower resolution paths), which improves:

• speed
• reliability
• UX smoothness under load

Impact:

• faster command detection
• faster command deletion
• smoother response loop

---

4) Blacklist Monitoring (Non-Blocking Security)

Security isn't just preventing bad actors — it's building visibility and audit trails without breaking legitimate ops.

We added a monitoring system where:

• business messages from blacklisted users are logged
• admins get alerts with sender + recipient context
• we retain an audit trail for investigation

This helps us spot patterns early, identify coordinated attacks, and keep the system safe while avoiding false positives.

---

5) Reliability Hardening You'll Notice Indirectly

Some improvements aren't flashy — they just reduce "WTF moments."

Notification formatting is more stable

Certain usernames and formatting patterns used to break notifications. That should now be significantly reduced. There may still be edge cases — if you notice formatting issues, please alert admin ASAP so we can patch quickly.

Contact actions are more reliable

Buttons failing is unacceptable in a Telegram-native product. We hardened link resolution so actions work across:

• restarts
• older contexts
• messy edge cases from travel-week usage

Result: things "just work" far more often.

---

Important Nuance: Long-Living /note in Business Messages

A critical privacy note — please read carefully.

Some users experienced a scenario where a business note command persisted longer than expected.

Example:

• you send a /note or inline business note
• the recipient disconnects (flight, bad WiFi)
• Telegram delays delivery
• deletion doesn't happen instantly because it relies on successful delivery + state progression

Result:

• the note can remain visible longer than intended
• the recipient may see/read it

This is rare, but it happened this past week under real travel conditions.

Best practice right now:

• For non-confidential / non-internal notes, business dm'ing strangers with /note is fine.
• For confidential or internal-only notes, chat with MILO directly (so it never enters the recipient channel).

We're actively hardening this edge case further.

---

Exports + Tier Confusion

We also heard frustration around:

• exports not arriving fast enough
• confusion about user tier / what's included

That should now be significantly improved. During this phase we're still operating white-glove, but:

• export requests should route cleanly
• outcomes should be consistent
• comms will be clearer going forward

If you're still blocked, email support@pantheonops.com and we'll prioritize it.

---

Security, Data Handling, and Preferences

We're building MILO for people whose network is their net worth.

A few direct points:

• You can granularly configure which chats MILO is enabled in via your Telegram Business settings
• We do not sell contact books
• Each user's data is isolated
• If you request deletion, we act on it

Deletion request:

• Email support@pantheon.xyz
• Subject line: Deletion Request

Security-minded users who want to contribute:

• security@pantheonops.com

---

What's Next

We're closing this release cycle with a renewed focus on stability, onboarding, and the next layer of utility:

• White-glove onboarding (for power users + teams)
• contact tagging
• contact-aware GPT prompts ("ask about my contact book")
• import/export self-serve
• weekly summaries tailored to you
• stronger safety rails around delayed delivery edge cases

This is the work that turns a promising alpha into a durable operating system.

---

Closing

If the last two weeks felt intense — they were.

We pushed hard, learned fast, rolled back when needed, and responded to a real security incident in the wild. That's not an excuse for delayed comms, but it is the reality of building an operator-grade system under real conditions.

Thank you for trusting us while we harden this.