Record ID: ACT-0002
Handle(s): @unixpill, Neptunian, unixpill(ed), UNIX
Status: Active
Classification: Telegram com security/privacy actor; “threat-actor” designation unsubstantiated
First Observed: 2024-12-30; 2025-01-19 as “Neptunian”
Last Observed: 2026-06-04

Neptunian, commonly associated with @unixpill, is a Telegram-com personality centered around privacy, cryptography, Monero/XMR, OSINT-adjacent argumentation, and the ancient art of making every technical disagreement feel like a knife fight in a whitepaper footnote. The supplied logs show a technically literate, unusually prolific participant in Monero and privacy communities. His strongest documented contributions are not “owning” people in chat, despite his obvious fondness for the pastime, but concrete technical participation: opening a Monero Research Lab discussion on PQ-DSA, writing privacy-theory material, evaluating trust models for XMR-related swaps/bridges, and repeatedly pushing projects toward open code, audits, threshold signatures, better documentation, and less marketing fog. The term “threat actor” should be used carefully here. The logs place him in and around breach/security/com spaces and include claims of OSINT competence, chain-analysis familiarity, and prior contracting work. They do not, on their own, prove intrusion activity, extortion operations, malware deployment, or a named malicious campaign. In less dramatic English: the receipts support “sharp privacy gadfly with com proximity” more strongly than “confirmed operator.” The difference matters. His persona is abrasive, theatrical, and often needlessly cruel. He can write like a cryptography grad student, a forum goblin, and a caffeinated prosecutor occupying the same trench coat. Still, the technical signal is real. The clown horn is loud, but there is a machine room behind it.

• @unixpill — public/social handle referenced in the logs
• unixpill(ed) — self-described recurring handle family
• Neptunian — primary Telegram-com name in the supplied material
• UNIX — self-described alias/nickname
• neptunian@tempest — observed alias-style string; context unclear
• neptunian@airgapped — observed alias-style string; context unclear
• Ray — self-described nickname; not treated here as a legal identity

No formal group membership is established by the supplied logs. The following are better read as observed communities, recurring venues, or self-claimed associations:

• Monero Society — recurring technical participation around Monero, XMR privacy, bridges, swaps, and research discussions
• te.mpe.st — self-referenced writing/audit circle; used for privacy-theory writing and offered code-audit work
• THORChain Community — observed technical inquiry regarding FROST for XMR and strong cryptography
• DarkFi Chat — observed participation; claimed SimpleX-related work via Evgeny Poberezkin
• DWCusers Chat — observed debates involving OSINT, cryptography, Signal/Session, and chain analysis
• AE Chat / Anti-Extortion-adjacent spaces — recurring presence in com-adjacent chat logs
• Osint Lovers — observed participation; hostile tone and OSINT-adjacent claims
• BreachForums Chat — observed presence; not sufficient by itself to establish operational affiliation

• 2024-12-30 — Earliest activity in the supplied dataset appears in Com Web Chat. Context is sparse and should not be over-weighted.
• 2025-01-19 — Earliest explicit “Neptunian” references in the dataset; also discusses puzzles and basic OpSec concepts.
• 2025-03-29 — Active in OSINT-adjacent and com-adjacent chats; remarks include anti-pedophile positioning but also hostile, abusive language.
• 2025-04-06 — Discusses a concept for a CLI-based hardware wallet / cold-storage-style project using Curve25519/SNTRU-Prime-style cryptographic language. Interesting idea; not evidence of completion.
• 2025-06-06 — Claims prior activity under a different alias and describes AE as “anti-extortion community.” Treat as self-report, not verified history.
• 2025-06-14 — Self-identifies as “Neptunian, UNIX, or Ray.”
• 2025-07-11 — Observed using alias-style strings neptunian@tempest and neptunian@airgapped; also gives the blunt but useful career advice that people care more about results than raw cleverness.
• 2026-02-16 — Argues Signal/Session/SimpleX threat models, saying Signal has PFS, PCS, and repudiation while Session lacks comparable properties; also claims prior contracting with an entity associated with a federal agency. Self-claim only.
• 2026-03-27 — States the handle pattern has “always been unixpill(ed), neptunian, or some reference to philosophy.”
• 2026-04-23 — Pushes transparency, architecture, and ethos as evaluation criteria for Monero-related tools; criticizes Wagyu’s trust model while still saying it could be improved.
• 2026-05-02 — Critiques Miradex/Eigenwallet trust-model claims, focusing on metadata exposure, node selection, WASM/server trust, and the difference between browser-mediated swaps and local peer discovery.
• 2026-05-12 — Engages in a major Wagyu decentralization dispute, calling for FROST or similar Schnorr threshold signatures, open-sourcing, non-domain-dependent access, validators, DKG, and external audit. This is one of the cleaner technical episodes in the logs.
• 2026-05-16 — Asks THORChain whether it will implement FROST for XMR; argues Schnorr schemes are attractive for XMR relative to DKLs and says he often works for free when strong cryptography is involved.
• 2026-05-18 — Publishes or announces an introduction to privacy theory on te.mpe.st.
• 2026-05-19 — Discusses OSINT and chain analysis; challenges others to trace a BTC address he says belongs to a recent THORChain exploiter. This shows claimed methodology, not independently validated success.
• 2026-05-21 — Opens or announces opening Monero Research Lab issue #159 concerning PQ-DSA, after saying Tevador had indicated it was fine to post.
• 2026-05-23 — Looks into XMR-SOL bridging, trust models, HTLC/atomic swap feasibility, and wrapped-token risk.
• 2026-06-04 — Latest observed activity in the supplied dataset.

• Wagyu decentralization / trust-model dispute
• Miradex / Eigenwallet trust-model critique
• Monero Research Lab PQ-DSA Issue #159
• THORChain XMR FROST inquiry
• Signal / Session / SimpleX protocol debates
• XMR-SOL bridge trust-model research
• THORChain exploiter chain-analysis challenge

The “threat actor” label is not well supported by the available data. There is com proximity, security literacy, hostile rhetoric, OSINT posture, and exposure to breach-adjacent spaces. That is not the same thing as evidence of a specific malicious operation. Classifying him as a confirmed threat actor from these logs alone would be lazy analysis wearing a trench coat. His technical strengths are clearer than his operational history. He repeatedly returns to cryptographic properties, threat models, transparency, audits, open source, post-quantum concerns, XMR bridge design, and the limits of decentralization claims. His best moments are when he stops trying to win the room and starts threat-modeling the thing in front of him. His public style is a liability. The logs contain slurs, violent rhetoric, personal insults, and theatrical hostility. Some of it is scene-posturing; some of it is just ugly. Either way, it undermines otherwise serious technical criticism. The man often brings a scalpel and then insists on swinging it like a chair. The strongest accomplishment shown is the Monero Research Lab PQ-DSA issue reference. Close behind are his Wagyu and Miradex trust-model critiques, which show a useful instinct: attack the custody, metadata, update path, node-selection, and audit assumptions rather than letting projects hide behind “decentralized” glitter. Open questions remain: whether any claimed audit work was completed; whether any SimpleX-related work via Evgeny Poberezkin is independently verifiable; whether the OSINT and chain-analysis claims produced reliable outputs; and whether any “threat actor” classification is based on evidence outside the supplied evidence.

Record created: 2026-06-09.