tchkvsky

Happy Birthday, Ethereum! 🎉 The best birthday gift? More valid bugs submitted 👇

🚨Blockaid's exploit detection system has identified an ongoing exploit on @summerfinance_. ~$6M drained so far. More details in 🧵

Aftermath Postmortem On April 29th, Aftermath experienced an isolated security incident in the integrator feature of AF Perps. All other products (afSui, Pools, Farms, Agg, SOR) are completely unaffected & all users will be made whole. This has been a scary week for crypto. AI tooling is developing rapidly, and we were among the almost a dozen protocols affected by hacks. We’re hopeful that by sharing our experience, we can help the broader crypto community learn and build back stronger. Root Cause The root cause was a signed integer issue in the integrator accounting logic. A malicious user was able to create their own integrator with a negative taker fee. This negative fee is then credited to a newly created account, which can be freely withdrawn from the vault. This issue was introduced as part of a diff on August 29, 2025. The changes were audited by @osec_io in Nov 2025, but the issue was unfortunately missed. Timeline The attacker (suivision.xyz/account/0x1a65…) was first funded on 04-28 22:02:07 UTC with 405.24 SUI. At 04-29 08:21:48 UTC, the attacker swapped 300 SUI for ~278 USDC via the SOR to obtain seed collateral for opening perp positions. From 04-29 08:55:50 UTC to 09:31:49 UTC, the attacker drained ~1,139,927 USDC from AFperps across 17 attempts (11 successful, 6 failed). Each of the 11 successful transactions was a single PTB that opened two accounts, registered the attacker as their own integrator with a negative 100,000 taker fee, executed a market order that crossed against a real counterparty’s maker order, then withdrew the resulting synthetic collateral as real USDC. From 04-29 09:22:23 UTC to 10:45:22 UTC, the attacker laundered the proceeds through fresh single-use wallets and DEX swaps before depositing to Binance (suivision.xyz/account/0x9350…) (~$250K USDC), KuCoin (suivision.xyz/account/0x13c0…) (~$400K USDC), Huobi (suivision.xyz/account/0xe5c0…) (HTX) (~150K SUI), and HitBTC (suivision.xyz/account/0x8612…) (~$150K USDC). Next Steps Out of an abundance of caution, we’re conducting an additional audit before relaunching AFperps with a separate company. That being said, we also recognize that manual review alone is insufficient in 2026. We are investing heavily to improve our AI-security workflows. AI tooling is developing rapidly, and we were among the almost a dozen protocols affected by hacks this week. We’re thankful to all of our partners for their rapid response and help. In particular, Blockaid, ZeroShadow, OtterSec, Sui Foundation, and Mysten Labs.

Update: We've been working with professional security teams including @SEAL_911 and @blockaid_. Further updates will be shared as soon as they are available. Do not interact with Wasabi contracts until further notice.

🚨 Blockaid's exploit detection system identified an on-going admin-key compromise exploit on @wasabi_protocol across Ethereum and Base. The Wasabi: Deployer EOA was used to grant ADMIN_ROLE to an attacker helper contract, which then UUPS-upgraded the perp vaults and LongPool to a malicious implementation that drained balances.

Syndicate Labs experienced a security incident. A private key compromise enabled malicious upgrades to bridge contracts on two chains, moving ~18.5M SYND and ~$50,000 of tokens from customer chains. All impacted parties are being made whole. Details below ↓

As more and more admin keys are compromised to drain protocols, here's your check list if you are running one: 1) Learn as much as you can about your external dependencies. Once you learn about them, monitor their setup for upgrades 24/7. It's ridiculous to rely on an audit to tell you "hey, the doors to your house are locked, we checked it on 23rd of March". Today the external token that you may depend on could be L0 4/4 DVN; tomorrow, it may be 1/1 DVN. You should get an alert of a change and react to the news 2) As you should monitor your external dependencies, anyone relying on you should monitor you - for them, you are their external dependency. They should monitor every single MultiSig that you run, every single EOA that you set up - it's potentially their liability. Once an unsafe setup is detected, they may (and frankly should) refuse to use your protocol. So make sure you don't have these freaking EOAs that you set up just for operational efficiency 3) The first people spotting your weak points will be hackers. Then, external teams. Finally, your internal ops team. You need to reverse that order 4) Don't rely on AI slop for risk analysis. This current trend, where we see dozens of "risk-mgmt dashboards that I vibe-coded over the weekend" is frankly beyond scaring and outright irresponsible. You will get beautiful-sounding report, but you will never be sure if it is correct or bullshit or something in between The above you should do on top of code audits of your protocol and impeccable internal opsec, circuit-breaker infra, and whatnot. If you think that's frankly too much or too expensive - gtfo of DeFi And if you are overwhelmed with the complexity of the task - talk to @l2beat 💕

$86M lost in Q1 2026. +213% YoY. Most of it didn't come from novel exploits. It came from the same gaps repeating across teams. We mapped them. Get a free blueprint: hackenio.cc/sc-security-bl…

Big news for Rektoff students: [Training meets placement.] We're officially partnered with @SuperteamTalent, a community-powered recruiting agency building careers in the Solana ecosystem, backed by @SolanaFndn and @superteam. From now on, beyond the top-notch training in Rust and Solana security, every Rektoff student now gets a direct pipeline into the best jobs the Solana ecosystem has to offer.

When an incident happens, a lot of people rush to make a "spicy" tweet. Worth remembering: - You do not have all the information - Security is hard, and pointing fingers is always easier after the fact - If you run a high TVL protocol, assume you are next The best thing to do right now: review your signing configuration, and the ones of the protocols you integrate with

You can’t have a lasting competitive advantage if LLMs are in your critical cognitive path. Whatever you do will be at best limited to the same capabilities and constraints as what everyone else is doing. You’ll find the same bugs as everyone else, build the nth clone of the same app, trade using the same strategy. Using an llm while keeping it out of the critical path isn’t easy. If your bug leads are LLM generated — you will be constrained by the bugs that can be found by LLMs. No amount of prompting or composition will give you more than a small margin over your competitors that tends to collapse to zero. If all your code is LLM generated you are constraining your product to the universe of code LLMs can write — which is the same code your competitors can easily write. Even adding human input and review doesn’t necessarily change the picture. No amount of context, human generated hints, or iteration, can force a model to produce something that diverges too much from it’s training data. The cost of doing something through an LLM scales exponentially as you move further away from sample. That’s not something the next model will fix. **It’s a mathematical necessity** Past a certain level of novelty making the model do the work requires more human mental work than just doing it yourself. But you take a long time to notice it, because the LLMs nudges you back to doing what it’s good at. For coding it just keeps writing something that isn’t exactly what you asked and you keep telling yourself it’s close enough. For finding bugs the cost shows up as not finding the bugs as the model keeps looking for typical vulnerabilities. For s bug hunter it means spending compute without revenue. For a protocol it can mean getting rekt. You have a brain evolved over millions of years with priors that match the real world in a way a statistical model of text cant. Your brain can legitimately extrapolate beyond what others thought in the past in a way that is impossible **even for an LLM with arbitrarily large compute power** Use it.

It's time to change how we think about web3 security. Most security reviews in Web3 still focus on the state of the code at a specific commit. They ask: “Does this implementation behave as expected under the documented assumptions?” That is necessary, but it is no longer sufficient. Recent incidents have made one thing painfully clear: attackers do not respect audit scope. They do not limit themselves to the commit that was reviewed. They do not care whether an exploit path involves a “trusted role,” an admin key, a governance process, a relayer, an oracle, a bridge dependency, or an operational assumption buried in the docs. They attack the system as it exists in production. And that is where the industry has a serious gap. Very few teams invest the time to map their entire threat model: who can do what, which roles are trusted, what happens if those roles are compromised or malicious, how dependencies interact, where privilege is concentrated, and what the true blast radius is if a single assumption fails. This is not just a problem for early-stage protocols. Even top-tier ecosystems with mature engineering, audits, and bug bounty programs still depend on complex trust assumptions that are often not fully modeled, documented, or tested under adversarial conditions. Bug bounties have the same issue. Researchers often submit findings around unsafe feature design, excessive privilege, dangerous trust assumptions, or catastrophic failure modes, only to be told that the behavior is “intended,” “requires a trusted role,” or is “out of scope.” That approach is becoming dangerous. A badly designed feature can be just as damaging as a traditional code bug. A privileged role with unchecked power is not automatically safe because it is labeled “trusted.” A governance or admin path that can drain, freeze, upgrade, or misconfigure a protocol is part of the attack surface. A cross-chain dependency that can create systemic risk is not outside the threat model; it is the threat model. The next generation of Web3 security cannot be limited to point-in-time audits. We need security reviews that include protocol-level threat modeling, role and permission analysis, upgrade-path review, oracle and bridge dependency analysis, governance failure scenarios, operational key compromise assumptions, and clear blast-radius mapping. Teams should be able to answer, plainly: - What can each privileged actor do? - What happens if that actor is compromised? - What assets are at risk? - What downstream systems are affected? - What assumptions must remain true for the protocol to be safe? - Where are the emergency brakes, and who controls them? If the answer to a serious bug report is “this requires a trusted role,” the next question should be: “What is the impact if that trust assumption fails?” The industry is at a breaking point. We cannot keep treating audits as a checkbox and bounties as narrow code-defect programs while ignoring design-level risk. The most damaging failures are often not isolated bugs. They are unmodeled assumptions, excessive privileges, unclear dependencies, and underestimated blast radius. It is time for protocols, auditors, and bounty platforms to evolve from code review to system security. Because users do not lose funds based on whether something was technically “in scope.” They lose funds when the system fails.

This is not a leaderboard. It is a pattern. $137.7M exploited in DeFi already in 2026 Only $9M recovered Compromised keys Broken logic Failed validation Unchecked inputs Oracle weakness @Hashlock_ helps break that pattern with manual reviews, pen testing, bug bounties, on-chain monitoring, and recurring security support. Build trust before attackers test it. #⃣ 🔒 Source: Rekt, BlockSec.

and there you go, LLMs have now made progress in doxing pseudonymous identities basically all chains (btc, eth, sol) rely on pseudonymous identities everything you do onchain now will be linked to your IRL identity in the future this is not a drill. encrypt your money

Introducing EVMbench—a new benchmark that measures how well AI agents can detect, exploit, and patch high-severity smart contract vulnerabilities. openai.com/index/introduc…

Our intern program is back, now with the option to work in-person in NYC or Zurich. We're looking for security research types who are curious, skilled, and ready to work on security challenges that matter. Apply below ↓

Spend the summer in NYC (we cover rent). Work alongside our team on audits and tooling, learn how we actually do security research, and get support for your own projects. Apply below ↓

Can you tell if a ZK circuit is sound, or just correct? Hiring: ZK/Cryptography Auditor Review zkVM guest code + ZK circuits Evaluate soundness, completeness, privacy leakage Skills: Proficiency in Rust + proof systems. Bonus points if you know Noir. jobs.ashbyhq.com/nethermind/cb4…

Finding bugs is an arms race. If AI can find bugs humans can’t then black hats will use it against you. But if humans can find bugs AI can’t then black hats will use manual review against you. And if paying 1M in AI costs reveal a bug that can be used to steal 10M — black hats will do it too. Each new tool just adds to the escalation. Just another layer you *have* to add. The fact that most primitives are now hardened doesn’t matter much. Now “innovation” means you have to combine the primitives in novel ways that create even more attack surface. It’s a dark forest and there’s no such thing as “solving security”. The dreamland of low barrier to entry innovation is impossible — at least if your hopes are based on someone finding bugs before the bad guys. And why framing it as if **audits** are the barrier when the barrier is the **criminals**? Audits are just a way of dealing with the problems posed by criminals. The probem you want to solve isn’t audits being expensive — it’s criminals being able to find bugs and stealing user funds. If your code isn’t almost certainly bug free to start with — from design, language, and development methodology — no amount of AI or tooling will make it cheap to ship it safely. And designing almost certainly bug free code will never be fast or cheap either. Life isn’t fair.