V
3.5K posts
i found chain halting bug on a network carrying $120M in stablecoins and $1.85B in market value. anyway, good morning! @HackenProof #HackenProof
English
@aviggiano @HackenProof If someone can halt a chain from that tweet alone then tweet isnt the problem + the vulnerability itself was cleared for disclosure. I still didnt anything operational. Thank you btw (:
English
@kxrd36 @HackenProof congrats! but if this was meant to protect the chain id, you gave up too much info
English
@Chimajax @HackenProof Yess just with the obvious limits, ill write it up soon
English
@kxrd36 @HackenProof Niceee
are you allowed to write about the bug? for explanation...
English
🚨: According to Philosophy, the highest form of peace is to have zero desire to be understood, admired, pitied or even known.
English
This is exactly how you push whitehats to switch sides.
f4lc0n@al_f4lc0n
I Saved Injective's $500M. They Pay Me $50K. I like hunting bugs on @immunefi . I'm decent at it. - #1 — Attackathon | Stacks - #2 — Attackathon | Stacks II - #1 — Attackathon | XRPL Lending Protocol - 1 Critical and 1 High from bug bounties (not counting this one) Life was good. Then I found a Critical vulnerability in @injective . This vulnerability allowed any user to directly drain any account on the chain. No special permissions needed. Over $500M in on-chain assets were at risk. I reported it through Immunefi. The next day, a mainnet upgrade to fix the bug went to governance vote. The Injective team clearly understood the severity. Then — silence. For 3 months. No follow up. No technical discussion. Nothing. A few days ago, they notified me of their decision: $50K. The maximum payout for a Critical vulnerability in their bug bounty program is $500K. I disputed it. Silence again. No explanation for the reduced payout. No explanation for the 3 month ghost. No conversation at all. To be clear: the $50K has not been paid either. I've seen others share bad experiences with bug bounty payouts recently. I never thought it would happen to me. I can't force them to do the right thing. But I won't let this be forgotten. I will dedicate 10% of all my future bug bounty earnings to making sure this story stays visible — until Injective pays what I deserve. Full Technical Report: github.com/injective-wall…
English
Major DDoS Attack Averted (Feb 15–16, 2026)
We have successfully mitigated a highly coordinated DDoS campaign targeting the Runaki portal on 15–16 Feb 2026, with around 10 consecutive attack waves peaking at ~180 Gbps each, generated from thousands of globally distributed IPs and millions of automated requests. DIT activated its incident response immediately, applying layered defenses (real-time detection and filtering, rate limiting and geo-controls where applicable), coordinating upstream blocking with the ISP, and routing the service behind cloud DDoS protection (including a public IP change) to sustain availability throughout the incident.
English
🚨: A man was discovered with 90% of his brain mass missing, and yet he was living a perfectly normal life.
English
CLAUDE CODE but for HACKING
its called shannon, you point it at website and it just... tries to break in... fully autonomous with no human needed
i pointed it at a test app and it stole the entire user database, created admin accounts, and bypassed login, all by itself, in 90 minutes
GIF
English
honored to be on this month’s board and congrats to the other researchers.
HackenProof@HackenProof
❄️January payouts to hackers totaled $594,280 Huge thanks to every hacker with a valid find — you’re absolute legends. Keep hunting! 🏆 Top Bug Bounty Payouts: JRHL — $112,000 chaitealatte — $100,000 @kxrd36— $100,000 nk11 — $75,000 @VulsightSec — $50,000 @0xvivekd — $20,000 ..And speaking of remarkable community wins in December’25, researcher Jinxorder has now crossed $1,100,000 in a single reward on HackenProof — a milestone backed by consistent performance across programs. 🙌 More targets, more bugs, more wins — see you in the next month.
English
@windscribecom Great job! x.com/intcyberdigest…
International Cyber Digest@IntCyberDigest
‼️Meet the man who ran "CrazyRDP," the largest bulletproof hoster ever seized, where criminals hosted malware and scams, and pedophiles hosted CSAM. His name is Mohammad Tareq Sahebzadah, a Dutch national of Afghan descent.
English
THIS IS NOT A DRILL: The Dutch authorities, without a warrant, just seized one of our VPN servers saying they'll give it back after they "fully analyze it".
Windscribe uses RAM disk servers so the only thing the authorities will find is a stock Ubuntu install. The bigger worry is the unredacted Epstein files we had on there...
English