Norman

2025年末你只需要一个人不到100美元就能开一个硅谷级的初创公司： 免费用Gemini 3开发并部署一个产品级的网站 免费用 @0xinfini business 注册企业级收单 2美元从namecheap买一个域名 8美元注册一个带蓝标的x账号 60美元从looka买logo和brand kit That's all. 甚至加起来只有70美元。 然后你就可以开始做市场营销，内容宣发，找客户开始赚钱了。

@MrRyanChi @insidersdotbot 恭喜Ryan！

Yes, $IN is officially live today. From day one of @insidersdotbot, every user has been a major shareholder. And I mean that literally, back in November last year, our entire launch capital came from our first batch of subscribers. It's thanks to those early Pro users who believed in us that we evolved from a simple signal bot → copy-trading bot → the super platform we are today: AI, smart money explorer, trading terminal, and everything in between. Those subscribers still enjoy ever-improving signals and a growing list of member-exclusive features. They are, quite literally, our shareholders — and they always will be. Powered by community alone, we've out-shipped and out-performed products that raised millions in VC money, on product, features, and user activity. That's exactly the logic behind the $IN TGE. Bring more people in. Grow together. Build in public, for real. Over the past two years, I've watched projects TGE for all kinds of reasons: marketing, flywheel narratives, "product utility," fundraising, you name it. For $IN, it comes down to two things: 1️⃣ Product. 2️⃣ Ecosystem. On the product side, $IN gives users more ways to participate, more crypto-native ways. In our first year post-launch, I personally spent a lot of time doing customer support. Roughly 10% of that time was spent explaining how to buy Pro, how Agent credits work, and how fees and gas are handled. $IN changes that. It introduces staking- and swap-based access to memberships, trading, copy-trading, and Agents, so DeFi-native users can jump into prediction markets directly through our Agent interface. More flexibility, and a better insiders.bot for everyone. Then there's the ecosystem side. To me, the reason prediction markets still have serious staying power after the World Cup is simple: they're essentially high-granularity options products. But for prediction markets to truly merge with financial markets, we need something more DeFi, more AI-driven, a model that can actually tame this asset class. That requires exposure within the DeFi ecosystem. And the $IN TGE delivers exactly that. TL;DR, with $IN, we're putting insiders.bot in front of far more people, and helping them do more than just trade prediction markets: we're helping them find real, long-term +EV strategies. Let's Lock $IN.

@Tronn_lyu 感谢Tronn！

很开心和大家分享我加入了BNB Chain，担任 APAC BD，主要负责 BNB Chain 全球的隐私生态建设，推动新项目与各个成熟的Ecosystem Partners的合作。 过去几年， 我尝试过不同的工作： 相信好的设计能够真实地改变人的感受和生活，所以我在浙大读了建筑设计； 相信好的产品能够服务更多的人，所以我在NUS学产品设计； 相信区块链可以带来未来世界的金融改变， 所以我和队友在黑客松做了人生第一个Dapp，获得了 Franklin Templeton 的 Grant； 相信长期的公共物品和隐私、开源项目可以为行业带来长期正向影响，所以我加入了一个支持公共物品的捐赠基金； 不同的经历让我意识到，把一个项目做出来，和判断一个方向为什么值得做、应该在什么时间做，是两种不同的能力。于是我加入了美元 VC 做投资研究，围绕交易所、公链和稳定币等方向，逐渐建立起对行业更系统的认识 在研究的过程中，我发现，许多真正推动行业长期发展的工作——例如开源工具、底层研究、隐私与安全基础设施——都具有很强的公共物品属性。它们在很大程度上支撑着整个行业的发展，却很难从传统价值投资的角度被直接定价，也未必能在短期内形成清晰的价值捕获。 作为行业领先的公链生态， 我们有责任也有义务推动行业的健康发展，我相信BNB Chain 能够成为更多机构、项目和用户进入 crypto 世界的重要入口，我也很乐意成为一个协调者，在技术、项目、机构和真实需求之间，让好的技术找到场景，让值得建设的事情获得支持，也推动更多合作真正发生。欢迎大家随时联系我，一起建设 BNB Chain 生态。 一路走来，我始终希望尽自己所能做成一些事情，创造一些真实的价值。如果一定要给自己一个标签，我想应该是 Builder：从构筑空间、打磨产品，到建设项目、支持项目，再到今天参与一个更大的生态。感谢@nina_rong、@v_bnbchain、@Lukexiao0 和 @cydeologie 的认可与信任，让我有机会加入 BNB Chain，在一个拥有广泛用户基础、充足流动性和丰富应用场景的生态中继续建设。 BNB — Bring the Next Billion on chain 💛 I'm glad to share that I've joined BNB Chain as APAC BD, where I'll be building out BNB Chain's privacy ecosystem globally and driving collaboration between new projects and our Ecosystem Partners. Over the past few years, I've tried quite different kinds of work: Believing good design could genuinely change how people feel and live, I studied architecture at Zhejiang University. Believing good products could serve more people, I studied product design at NUS. Believing blockchain could reshape the financial world to come, my teammates and I built our first Dapp at a hackathon, which earned a grant from Franklin Templeton. Believing that public goods — along with privacy and open-source projects — can bring lasting, positive impact to the industry, I joined an endowment fund dedicated to public goods. These experiences taught me that shipping a project and judging why a direction is worth pursuing, and when, are two different skills. So I joined a Venture Capital firm as an investment researcher, covering exchanges, L1s, and stablecoins, and gradually built a more systematic view of the industry. The research led me to a realization: much of the work that genuinely moves this industry forward — like open-source tooling, foundational research, and privacy and security infrastructure — has the character of a public good. It underpins much of the industry's progress, yet it's hard to price through a traditional value-investing lens and rarely captures clear value in the short term. As a leading public-chain ecosystem, we have both the responsibility and the obligation to advance the industry's healthy growth. I believe BNB Chain can become a major entry point for more institutions, projects, and users coming into crypto, and I'm glad to serve as a coordinator — sitting between technology, projects, institutions, and real demand, helping good tech find its use case, helping work that deserves support get it, and making more collaboration actually happen. Feel free to reach out anytime — let's build the BNB Chain ecosystem together. Looking back, I've always hoped to get things done and create real value, to the best of my ability. If I had to pick one label for myself, it would be Builder: from building spaces and refining products, to building and supporting projects, and now to helping build a larger ecosystem. I'm grateful to @nina_rong , @v_bnbchain , @Lukexiao0 and @cydeologie for their trust, and for the chance to keep building in an ecosystem with a broad user base, deep liquidity, and applications people actually use. BNB — Bring the Next Billion on chain 💛 @BNBCHAIN @BNBCHAINZH @heyibinance @cz_binance

谢谢 Winchman，也很高兴这次我们能帮助 Renaiss 发现 Buyback Flow 中的授权逻辑问题，并协助团队快速完成修复。 行业里一直有一个问题：为什么项目已经做过多轮安全审计，协议上线后仍然可能出现漏洞？ 一个重要原因是，传统安全审计本质上是对某一特定时点代码状态的审查。它能够确认当时提交的代码已经过检查，但随着新功能上线、产品持续迭代和代码不断更新，新的风险也会随之产生。 根据我们审查过的案例，超过 80% 的漏洞来自规模不大、却没有经过充分安全审查的代码更新。真正决定项目长期安全性的，不只是“是否做过审计”，而是每一次代码变化能否被持续发现、分析和验证。 因此，我们认为，动态安全能力比一次性的审计结果更能反映一个项目真实的安全水平。这也是我们持续投入 AI Security Layer 的原因：人的带宽终究有限，而 AI 可以持续、不间断地扫描代码、监控链上状态，并审查每一次产品变化。 它不是要替代专业安全人员，而是将专业能力扩展到传统审计难以持续覆盖的地方，让安全从一次性的检查，变成贯穿产品生命周期的基础设施。

@0xRickyW thank you Ricky！

Great work guys 🫡

@raylin51 我们做了反编译 可以看看 x.com/zerodriftsec/s…

你们是不是真以为台子的币迁移到 uniswap 以后就跟台子没关系了？加池子的 LP 还在台子的 LaunchLocker 合约里，合约又不开源，你们这帮不会反编译的 sb 连 LP 能不能抠出来给池子撤了都不知道。就算不能撤 LP 的 1% 手续费也不停给已经 rug 的团队，你告诉我这币的前景还好吗？

针对最近社区对 @Noxa_Fi 和 cash-cat:native 的机制问题，我们团队通过链上反编译确定了： 1. Noxa Dev确实可以收到5%的LP 手续费，这部分的fee本身也是属于1% uni手续费池子里的。 2. Noxa dev无法撤池，无法移走用户本金，也没有增发权限。 3. Noxa现在的factory，Locker，Feerouter都是一个钱包地址掌控，中心化风险很高。 至于说CashCat本身还不存在蜜罐之类的风险。

"of the 533 traced bugs, 72% were introduced after launch, in an upgrade or a feature commit, not on day one." 其实这就是为什么我们需要持续性的安全审查，因为项目的很多升级，新功能和产品事实上并不会做安全审计，漏洞就随着代码悄悄上线了。

@GustavHartz Great analysis! thats exactly we need AI to implement the continuous review

@Hexen1337 @Mudit__Gupta @hexens nice writeup

@Mudit__Gupta @hexens Btw, we wrote a kick-ass article about the vulnerability. A very interesting read: hexens.io/research/aptos…

An arbitrary state write bug in Aptos chain was disclosed by @hexens today. This is the worst kind of bug possible on a chain. Why? Not only everything on the affected chain can be stolen but also most assets across all chain can be stolen. Your stablecoins, LSTs, everything

This thread by @ZeroDriftSec caught our eye. When users have access to live code, they should have a reasonable expectation that someone is continuing to verify whether it remains appropriate to use. Why is the burden of verification falling on users?

@ohyishi 支持onekey这样的开源精神

信任从来不会凭空产生。 它来自一家公司愿不愿意把代码公开，愿不愿意让所有人检查，愿不愿意把最核心的东西交给时间验证。 从 2019 年创立第一天起，OneKey 就选择全开源。从 App 到固件，任何开发者、安全机构，甚至 AI，都可以独立检查。基于 OneKey 代码 Fork 的钱包我见过不下十个。 我们最早从 Trezor 的开源方案出发，随后一步一步完成自主研发，建立自己的硬件、固件与软件体系，掌握核心技术，也拥有完整的自主知识产权。 这些年，OneKey 成为第一个，也是目前唯一一个被 bitcoin[.]org 收录的亚洲硬件钱包品牌。销量做到亚洲第一，全球第三。 但真正让我们珍惜的，从来不只是这些排名和记录。 是几轮牛熊过去，用户逐渐学会自托管，把资产存在自己的 OneKey 钱包；是行业最混乱的时候，还有人相信我们会把安全放在第一位；是很多人买下第一台 OneKey 后，又把它推荐给家人和朋友。 六年过去，我们越来越确信，安全要靠公开证明，信任要靠时间积累，口碑要靠每一台产品慢慢赢回来。 OneKey 不辜负每一份托付。

很荣幸签下OPSeC的协议，时至今日，我们需要更可持续，agentic，operational的安全来为整个行业保驾护航。

新的一天，新的废弃合约被盗，闪电贷操纵价格盗走了26万美元。

@ChanniGreenwall @jaredsmev exactly，higher complexity，higher risks

@Normanxbt @jaredsmev As systems become more autonomous, the attack surface shifts from code execution to decision manipulation.

前两天 @jaredsmev 的mev bots被攻击导致损失超过750万美金大家应该都看到了。 简单来说攻击者提前部署了一批假 token、假 pool、假交易路径，让这些路径看起来像有利可图的 MEV 机会。 bot 按自己的策略去执行时，给了攻击者控制的 helper contract 一些 ERC-20 授权。后面攻击者调整路线，让授权没有被立刻消费或撤销，于是留下 open allowance，最后用 transferFrom 把 bot 合约里的 WETH、USDC、USDT 盗走了。 但这并不是个例，事实上Sen Yang团队在去年发表的论文里就做了针对mev bots被攻击的研究。一些数字： 他们收集了 6,554 个 MEV bot 地址。 SKANF 发现 1,030 个合约有潜在漏洞。 其中 394 个可以自动生成 exploit。 这些漏洞潜在损失约 $10.6M。 他们还回溯发现 104 起真实 MEV bot 被攻击事件，总损失约 $2.76M 论文里最有意思的概念是 MEV phishing attack。 简单讲就是： 攻击者不是直接去黑 bot，而是先造一个“看起来有利润的 MEV 机会”。Searcher 看到机会后，用自己的 bot 去执行套利/夹子/回补路径。结果这个路径里藏了恶意 token、恶意 pool 或恶意 callback，bot 自己在执行过程中把危险函数调用了，或者把资产授权/转走了。 mev bots已经是一个很成熟的技术和产品了，我觉得现在更危险的反而是trading agents/agentic wallets。包括 @DonutAI @byreal_io @wallet @BitgetWallet 。因为agents不仅要面对传统的phishing attacks，还有prompt inejctions等AI面的风险。 大家以为AI很聪明，但事实上AI远比我们想象的容易操纵和攻击

@joezhoublack 非常好的文章，不过有一处错误，后面喜欢的创始人特质“第二类”重复了

alright guys this jared account is fake，sorry for tagging the wrong account

@3heeeeee @jaredsmev 不要用 tx.origin 做授权；对 callback/caller 做精确验证，例如 Uniswap V3 pool 要按 factory + CREATE2 反推合法 pool 地址

@Normanxbt @jaredsmev open allowance 算是 MEV bot 的共性风险了，searcher 执行完一轮后有自动 revoke 的标准做法吗？

@francoscandizzo @humafinance @Scallop_io @Raydium thanks buddy, more research and analysis are coming!

@Normanxbt @humafinance @Scallop_io @Raydium Nice work!

我们最近发现一个新的攻击面：废弃合约。最近 @humafinance @Scallop_io @Raydium 都因为已经废弃的合约被攻击，40天类似的case累计损失了超过1700万。 过去废弃合约属于三不管地带，用户交互不了，项目方不维护，安全团队也不看。但是现在有了AI，黑客可以大规模地在链上去攻击，经济成本大大下降。 任何有废弃合约的项目方，特别是链上还有流动性的建议都自己查一查，或者也可以找我们帮忙。DM随时开放

@francoscandizzo @humafinance @Scallop_io @Raydium this is fantastic, thanks bro, never thought we'd have Spanish version

@Normanxbt @humafinance @Scallop_io @Raydium criptonoticias.com/seguridad-bitc…