DadeKuma

878 posts

DadeKuma banner
DadeKuma

DadeKuma

@DadeKuma

Independent Security Researcher | Collaborating with @zenith256 @cyfrin @PashovAuditGrp | Available for private audits, Solana/Rust & EVM 🗓️

Book an audit ⇢ Katılım Mart 2014
299 Takip Edilen2.1K Takipçiler
Sabitlenmiş Tweet
DadeKuma
DadeKuma@DadeKuma·
Note: I just made this repo public, so it would be awesome if you could star it 🌟 I've also included an audit template that you might find useful for creating your own! ⬇️ github.com/DadeKuma/audits
English
0
1
17
3.4K
DadeKuma
DadeKuma@DadeKuma·
Another day, another million-dollar hack.
DadeKuma tweet media
English
0
0
9
648
DadeKuma
DadeKuma@DadeKuma·
@WhiteHatMage In my experience, you need a very fast tool. Valid bugs are submitted a few minutes (1-10) after a BB starts now. I think it's better to focus either on speed or depth/edge cases, doing both doesn't work well since AI is in play IMO.
English
1
0
7
405
WhiteHatMage
WhiteHatMage@WhiteHatMage·
I'm changing my strategy on new BBPs. I used to speedrun them because I'm pretty good at it. I now think that's better suited for an automated tool. I’m also afraid of getting duped by some clunky report that only flags weird behavior, missing the impact. Worst-case scenario.
English
7
2
80
2.8K
DadeKuma
DadeKuma@DadeKuma·
@0xMorph @ScrewCopper @bytes032 @0x3b33 I meant "bounty" style contests. C4 did not utilize a granular severity based unlock criteria. They refunded the clients only if zero bugs were found.
English
0
0
2
38
Pyro
Pyro@0x3b33·
Contests are dead, cantina killed them
Pyro tweet media
English
20
10
242
15K
DadeKuma
DadeKuma@DadeKuma·
@rosarioborgesi I don't want to be a doomer, but it seems the industry as a whole is struggling hard🥲
English
1
0
4
91
DadeKuma
DadeKuma@DadeKuma·
AI is crazy good, but once the devs realize they can run the tools themselves for a fraction of an audit's cost, the value of AI findings will quickly drop to the average token cost. Before, it was more difficult; you had to build a good harness / agent orchestration to have something usable. Now, you can do the same with a good prompt, context management, and SOTA models. There are still bugs that AI can't find, so to be 'future-proof' you have to focus on these edge cases. I tested this in a BB: I found a bug in March 2026 on a top protocol that was introduced back in June 2025. No AI found it, and I'm pretty sure the project was scanned many, many times. You can still be very successful with AI only for now (you're living proof), but I don't think this will last...
English
2
0
9
606
LonelySloth
LonelySloth@lonelysloth_sec·
@DadeKuma not even hacked. production system randomly sends all ETH to 0xdeadbeef.
English
2
0
18
577
DadeKuma
DadeKuma@DadeKuma·
"Non-technical teams are now shipping production code" Next news: Coinbase gets hacked.
Brian Armstrong@brian_armstrong

This is an email I sent earlier today to all employees at Coinbase: Team, Today I’ve made the difficult decision to reduce the size of Coinbase by ~14%. I want to walk you through why we're doing this now, what it means for those affected, and how this positions us for the future. Why now Two forces are converging at the same time. We need to be front footed to respond to both. First, the market. Coinbase is well-capitalized, has diversified revenue streams, and is well-positioned to weather any storm. Crypto is also on the verge of the next wave of adoption, with stablecoins, prediction markets, tokenization, and more taking off. However, our business is still volatile from quarter to quarter. While we've managed through that cyclicality many times before and come out stronger on the other side, we’re currently in a down market and need to adjust our cost structure now so that we emerge from this period leaner, faster, and more efficient for our next phase of growth. Second, AI is changing how we work. Over the past year, I’ve watched engineers use AI to ship in days what used to take a team weeks. Non-technical teams are now shipping production code and many of our workflows are being automated. The pace of what's possible with a small, focused team has changed dramatically, and it's accelerating every day. All of this has led us to an inflection point, not just for Coinbase, but for every company. The biggest risk now is not taking action. We are adjusting early and deliberately to rebuild Coinbase to be lean, fast, and AI-native. We need to return to the speed and focus of our startup founding, with AI at our core. What this means To get there, we are not just reducing headcount and cutting costs, we’re fundamentally changing how we operate: rebuilding Coinbase as an intelligence, with humans around the edge aligning it. What does this mean in practice? - Fewer layers, faster decisions: We are flattening our org structure to 5 layers max below CEO/COO. Layers slow things down and create coordination tax. The future is small, high context teams that can move quickly. Leaders will own much more, with as many as 15+ direct reports. Fewer layers also means a leaner cost structure that is built to perform through all market cycles. - No pure managers: Every leader at Coinbase must also be a strong and active individual contributor. Managers should be like player-coaches, getting their hands dirty alongside their teams. - AI-native pods: We’ll be concentrating around AI-native talent who can manage fleets of agents to drive outsized impact. We’ll also be experimenting with reduced pod sizes, including “one person teams” with engineers, designers, and product managers all in one role. In short: AI is bringing a profound shift in how companies operate, and we’re reshaping Coinbase to lead in this new era. This is a new way of working, and we need to leverage AI across every facet of our jobs. To those who are affected I know there are real people behind these decisions — talented colleagues who have poured themselves into this company and our mission. To those of you who will be leaving: thank you. You’ve helped build Coinbase into what it is today, and I am sincerely grateful for everything you've done. All impacted team members will receive an email to their personal account in the next hour with more information, and an invitation to meet with an HRBP and a senior leader in your organization. Coinbase system access has been removed today. I know this feels sudden and harsh, but it is the only responsible choice given our duty to protect customer information. To those affected, we will be providing a comprehensive package to support you through this transition. US employees will receive a minimum of 16 weeks base pay (plus 2 weeks per year worked), their next equity vest, and 6 months of COBRA. Employees on a work visa will get extra transition support. Those outside of the US will receive similar support, based on local factors and subject to any consultation requirements. Coinbase prides itself on talent density. Our employees are among the most talented people in the world, and I have no doubt that your skills and experience will be highly sought after as you pursue your next chapters. How we move forward To the team that is staying, I know this is a difficult day. We’re saying goodbye to colleagues and friends you've been in the trenches with. But here’s what I want you to know as we move forward together: Over the past 13 years, we have weathered four crypto winters, gone public, and built the most trusted platform in our industry. We’ve made it this far by making hard decisions and by always staying focused on our mission. This time will be no different – nothing has changed about the long term outlook of our company or industry. And most importantly, our mission has never been more important for the world. Increasing economic freedom requires a new financial system, and we’re building it. The Coinbase that emerges from this will be more capable than ever to achieve our mission. Brian

English
3
0
23
1.5K
DadeKuma
DadeKuma@DadeKuma·
Pro tip for the future Never do bug bounties or audits where you will be paid with the project's own token If there is zero or low liquidity, you are fucking cooked
English
0
0
20
803
DadeKuma
DadeKuma@DadeKuma·
@GalloDaSballo North Korean hackers don't want you to know about this one simple trick
English
0
2
37
3.6K
DadeKuma
DadeKuma@DadeKuma·
@0xcastle_chain Thank you, mate! I appreciate what you're doing with the Solana Audit Arena. Respect! 🫡
English
1
0
5
178
DadeKuma
DadeKuma@DadeKuma·
@gjaldon Yessir! They invalidated it at first, but luckily they understood it was real 🙏 It took 1 month of back and forth.
English
1
0
2
311
g
g@gjaldon·
@DadeKuma Bounty incoming... Congrats ser Dade! 🫡
English
1
0
1
369
DadeKuma
DadeKuma@DadeKuma·
They are all good depending on your personality and goals. Bug Bounty: You must have very good skills, and you can handle rejection after rejection / unfair situations. Potentially it's the best ROI. Engagements with Firms: You have freedom, but work is capped by availability and your daily rate. Looking for full-time: I guess good stability, but hard capped earnings and limited opportunities. Solo audits: You have to market hard. Mid-revenue, big protocols usually don't care about spending a lot, so they go directly with firms.
English
0
0
2
182
Al-Qa'qa'
Al-Qa'qa'@Al_Qa_qa·
What is the best Option for a senior Independent Security Researcher?
English
3
0
10
1.9K
DadeKuma
DadeKuma@DadeKuma·
@MartinMarchev No way, so that was you lmao. Got duped here last month by a single day. Can I DM to be sure?
English
1
0
3
450
Martin Marchev
Martin Marchev@MartinMarchev·
Just trying to make web3 a bit safer. One finding at a time.
Martin Marchev tweet media
English
12
2
111
4.8K
DadeKuma
DadeKuma@DadeKuma·
@real_philogy New models = training costs. Even if the inference API is profitable, most people use the subscription, which is definitely not.
English
0
0
0
114
philogy
philogy@real_philogy·
@DadeKuma This is not true, inference is already profitable. Not to mention the OS models are getting smarter and can run on roughly the same hardware
English
1
0
1
145
DadeKuma
DadeKuma@DadeKuma·
I hate this dumb AI timeline. Within a few years, 80% of current security auditors will be gone, and not for the reason you think. People don't realize that AI costs are actually increasing with each new model, not decreasing. Companies are selling at a loss just to capture the market; they'll pull the rug once we're all fully dependent by massively increasing prices. Those who rely entirely on AI have already stopped thinking for themselves. When this system eventually collapses, they will be left completely helpless.
English
13
4
79
4.5K