Konstantin Lomashuk cyber/acc

Habibis, @xomarket just closed a $6M seed to build permissionless conviction markets anyone can spin up a Yes/No market on any belief in seconds. Led by @20vcFund and @picuscap , with @cbventures, and others along with 30+ angels including @patcummins30 Prediction markets cracked this open. We're opening the rest.

We got a lot of requests to bring this back to life, and as promised, it's live now! #nodecore" target="_blank" rel="nofollow noopener">drpc.org/docs/gettingst… If you build a mission-critical dApp, or if part of your functionality is super fragile to RPC poisoning, please use the Verification feature from dRPC via NodeCloud or NodeCore; there is no excuse not to use it, and you can't say, after yet another hack, that you were not aware of this.

In dRPC you can run a quorum of data providers, including internal nodes, with custom rules for quorum. We made it in 2023: #why-use-verification" target="_blank" rel="nofollow noopener">drpc.org/docs/gettingst…. For a mission-critical application like a bridge or oracle, there's no excuse not to set it up. But they didn’t. The framing of the recent KelpDAO and LayerZero incidents as some novel attack vector, or the work of meaningfully smarter attackers, is mostly wrong. The actual failure mode - applications trusting a single RPC endpoint to return honest data - has been discussed openly for years, by @VitalikButerin, @lomashuk, @MicahZoltu, @wagmiAlexander, @ChainLinkGod, @banteg, and many others. It is neither new nor subtle. A closely related failure happened in 2022 with the Ankr DNS hijack on Polygon and Fantom: x.com/Mudit__Gupta/s… The point here isn't ideological. In a 24/7 market where automated systems act on RPC responses in real time, assuming one provider will always return correct data is a system-level risk. There is no T+2 window in which a human notices the error and reverses it. When we launched dRPC, cross-verification across a permissioned set of RPC providers was the core idea. The original repo and docs are still up (although outdated since then): -#why-use-verification" target="_blank" rel="nofollow noopener">drpc.org/docs/gettingst… - github.com/drpcorg/drpc-s… We used a simple quorum rather than zk-based verification, partly to test real demand before overbuilding. Two observations from that period: 1. The demand was not there. In public, everyone agreed with the thesis. In private, the responses were "we are not ready to pay more for quorum," or "yes, we could apply it to sensitive paths only, but it's not a priority." 2. The risk was real. The market is now discovering this at a cost of roughly $250M. Because full cross-verification on every request is overkill for most workloads, we eventually shifted toward shadow checks — randomized background comparisons across providers that detect and eject unhealthy nodes before they serve meaningful traffic. This is a reasonable compromise for general workloads. It is not a substitute for quorum on sensitive paths. So the practical rule, for anyone building infrastructure whose failure mode is user funds: 1. Use at least 3–5 independent, reliable RPC providers. 2. Do not build your load balancer on training wheels. Something like drpc.org/nodecore-open-… is open source, free, and almost certainly better than what you would build in-house. Contributing to it is a better use of time than reinventing it. You cannot defend against every possible attack. But this particular class is avoidable at low cost, if you are willing to treat RPC as a system-level dependency rather than a commodity input. That is a reasonable bar for anything meant to serve more than a narrow circle of users. We will update the dRPC NodeCore (drpc.org/nodecore-open-…) with strict rules for quorum on your side in the near future, stay tuned. If you have more sophisticated requirements for security, we are fully open for your requests - feel free to each me our via DM here or by email kz@drpc.org

Public RPC gateway provided by Ankr for Polygon (polygon-rpc.com) and Fantom (rpc.ftm.tools) were comprised via DNS hijack earlier today. Polygon and Fantom foundation have no control over services provided by others. Use Alchemy or others while this is fixed.

x.com/i/article/2044…

New episode of the Cybereconomy Podcast is live! We sat down with @matthew_d_white, Global CTO of AI at the Linux Foundation, to discuss the explosive growth of AI Agents and Open Source AI. If you're building in the AI space, this is a must-listen: youtube.com/watch?v=SiR184…

x.com/i/article/2042…

The financialization of compute is here. Architect has launched 24/7 perpetuals on Nvidia H100 GPU prices — the first regulated futures contracts on compute, built with @OrnnExchange’s live market indices. The AI economy has its first exchange-traded futures market.

We are thrilled to welcome our new CTO @Dmitriy17042471 to our team! We have been working closely together with Dima over the years in his role as co-founder of @MixBytes . For the past 5 years Dima bootstrapped the team at MixBytes and helped to deliver 200+ audits.