InfyniSec

Gm gm.. web3 Engineers, devs, Time is closing up, just a few weeks to go Blockchain Devfest Kampala 2026, 5 th, come discover what has been transpiring over the last editions.. Visit: devfestkampala.com to register, apply to speak..

Because every passing day brings us closer to the #BlockchainDevfestKampala2026, are we ready? Proudly brought to you by @Infynisec. We are devfestkampala.com😉

AI makes the attack surface wider. The same AI makes the safety mechanisms much easier. Choose the latter now with infynisec.xyz

@DevDacian bring it on.

Do you want this ?

🔥 Mythos might be launching today 🔥 We recommend revoking every approval across every wallet you own. That old wallet, the newest QR scan and every previously done sign request on an old connection or website. You wanna review that now. Better safe than sorry.

Every day we see new people finding bug bounty vulnerabilities on web3 security platforms like Immunefi and HackenProof of $10k, $50k or more Web3 security really going through huge changes & great things are happening, the whitehats are becoming stronger than ever, beautiful🔥

Truly legendary, only legends can relate.

What are activists up to in Logos Circles? Circles are grassroots meetups in cities worldwide, solving real issues at the intersection of activism + tech. They don’t wait for permission; they see a problem and act. Here are highlights from Circles initiatives last month ↓

@BChainDevFest Together we can redefine how communities can be introduced, onboarded and participate into web3 #EduCreds #EduTech #TrustLayer

🎉🎉 we honor the partnership,

🤯CODE4RENA SUNSETTING. THE END OF AN ERA Thank you for everything, code4rena, forever in our hearts <3

Africa has massive talent. Nigeria leads Solana devs globally in some metrics, and hubs in Kenya, South Africa, Uganda & beyond are rising. But myths hold many back. Here's the truth. 🧵 Myth 1: "Blockchain = Crypto speculation & scams. It's not for real developers." (Beginner)

Ethereum security is a public good. The people protecting the ecosystem — researchers, auditors, and builders — play a critical role in its long-term resilience. 🧵

This is the sort of madness that makes hackers run mad.

4 steps to find bugs faster. Eliminate ideas. The typical audit flow is: • Understand the code • List observations • List suspicious parts Then, come up with all possible ideas based on it. Research every ideas deep. Ensure that idea is a dead end

Hyperbridge rekt The Hyperbridge attack, which occurred on April 13, 2026, was a major security breach involving a cross-chain interoperability protocol built on Polkadot. While initial estimates placed the loss at roughly $237,000, subsequent forensic analysis revealed the actual damage was approximately $2.5 million across multiple chains. The incident is particularly notable because Hyperbridge marketed itself as a high-security, proof-based bridge designed to avoid the “multisig” vulnerabilities that led to previous historic hacks. ## The Technical Vulnerability The root cause was a flaw in the cryptographic verification logic within the protocol’s HandlerV1 smart contract. Forged Merkle Proofs: The VerifyProof() function failed to perform essential input validation (specifically checking if the leaf_index was less than the leafCount). The “Proof Replay”: This oversight allowed an attacker to submit a forged ISMP (Interoperable State Machine Protocol) message. By recycling data from previous legitimate transactions, they tricked the protocol into accepting a malicious state change without a valid cryptographic link to the source chain. Disabled Safety Nets: A built-in “challenge period” (designed to give “fisherman” nodes time to dispute forged state commitments) was set to zero on the Ethereum host, allowing the attack to execute instantly. ## How the Attack Unfolded The exploit was executed in two distinct phases: Phase 1: Liquidity Extraction (The “Quiet” Phase) The attacker first extracted nearly 245 ETH from incentive pools on Ethereum, Base, BNB Chain, and Arbitrum. This part of the attack went largely unnoticed for the first hour. Phase 2: Administrative Takeover & Minting Using the forged proof, the attacker triggered a ChangeAssetAdmin action. This granted them administrator and minter privileges over the bridged DOT token contract on Ethereum. The Mint: The attacker minted 1,000,000,000 (1 billion) DOT tokens out of thin air. The Dump: They immediately swapped these tokens through decentralized exchanges (DEXs). Because the supply was 2,800 times the legitimate circulation, the price of bridged DOT on Ethereum collapsed to nearly zero. ## Impact and Recovery Total Loss: Revised to $2.5 million, including the stolen ETH and the drained liquidity pools. Scope: The attack was limited to Hyperbridge’s gateway. Native DOT on Polkadot and other bridge protocols (like Snowbridge) remained completely secure. Current Status: Hyperbridge operations for the Token Gateway remain suspended. The team has committed to a recovery plan using native BRIDGE tokens to reimburse affected users if stolen funds (some of which were traced to Binance) cannot be recovered.

@RaveDAO , how come someone who submitted their address on plvr in the January airdrop can't see any of their tokens/points that were promised? For extra context: its a @coinbase wallet and its secure.

|￣￣￣￣￣￣￣￣￣￣￣￣| Ai will NOT protect your smart contracts |＿＿＿＿＿＿＿＿＿＿＿＿| \ (•◡•) / \ / —— | | |_ |_

@chrisdior777 Truly legendary

Web3 Security Nostalgia (2022):

@pashov InfyniSec

Say the name of a web3 security company and I will say 1 good and 1 bad thing about it