Lithos.eth

while i was writing about the massive exploits yesterday three more protocols just got drained aftermath finance , sweat economy , and syndicate were all hit in the last twenty four hours it is exhausting watching us pour millions into audits while a single nation state bleeds us dry but there is a wild theory going around that is starting to feel terrifyingly real what if north korea hackers took ten years of stolen defi data and trained their own state funded ai we might just be watching an autonomous machine running free and cashing in until someone figures out how to stop it the lazarus group does not even need to attack your battle tested code anymore they compromise a human like we saw with bybit and slip bad code into the frontend so the screen silently lies to the signers they spend months at our conferences building trust and getting hired as full time developers under fake identities we keep trying to solve a machine speed threat with human code reviews the only real fix is removing humans from the execution layer entirely moving our critical plumbing into secure enclaves means even a completely socially engineered developer cannot extract the keys we have to use cryptography to build systems that protect us from our own tired engineers for the protocols how are you isolating your infrastructure so an automated agent cannot sink your ship and for everyday users like you, how are you verifying what you sign when the frontend itself might be lying to you

i just finished designing this hit list mapping out every major lazarus hack on record staring at the sheer volume of these exploits all in one place is genuinely sobering we are looking at billions of dollars systematically extracted from our industry the most terrifying part is that almost none of these were complex smart contract bugs they were compromised laptops fake job interviews and poisoned frontends we keep obsessing over auditing our code while a sovereign nation state is quietly hacking our humans the only way we stop the bleeding is by physically isolating the execution layer from the people building it moving critical signing infrastructure into secure enclaves means even a fully compromised developer cannot hand over the keys we have to build systems that protect us from our own tired engineers how many more protocols have to die before we realize human operational security will never be enough to fight an organized nation state

april recaped: earned $0 gained 170+ followers wrote my second article entered 1 bounty - didn't win connected with more mutuals mastered the act of serving bangers started pitching more - a couple leads didn't finish the course on AEO there's probably more I'm leaving out... let's do more in may 🙂‍↔️

yeah so this is how it’s going currently I should’ve just gone to sleep yesterday night

i found $AI before most of CT did here's the exact system i use to find projects early (bookmark this | you will need it later) -------------- the obvious methods everyone uses: - tracking fundraising sites (cryptorank/rootdata) - following big VCs on X these could work but everyone does them, you won't be early enough using only these -------------- the methods that actually give you an edge: > watch, who VCs are silently following and engaging with most investments are decided before the actual announcement, if a16z or Paradigm suddenly follows a project with 200 followers and zero funding pay attention immediately that's not random, VCs don't follow noise > crypto jobs onboards, before fundraising news : look at web3career and remote3co when a project suddenly posts 3-5 jobs in a single week, they are highly likely just raised money that's a 30-60 day window before the news hits CT most people wait for the official announcement, but you will be there before it > GitHub activity before Twitter presence : go to github(dot)com/explore and filter by crypto/blockchain/web3 projects with recent commits, growing contributors, and active issue discussions, but tiny Twitter presence this gap between tech activity and social presence is your early signal by the time they have 10K Twitter followers the GitHub was already busy for months > follow the angel investors not just the VCs this is the one that nobody talks about find 10-15 angel investors who have backed winning projects before, when they personally invest in something new that signal is stronger than any VC announcement angels bet their own money not LP money, that conviction is different -------------- what i check in the first 5 minutes: > does the branding look like someone cared about it (weak branding = team running on hype only) > does it have at least a pre-seed or seed round (no funding at all = too high risk of total time waste for me you could go before that as well) > is the tech starting a new narrative or following one (followers get paid less than starters, always) > is GitHub active with real commits (ghost GitHub on a "cutting edge tech" claim = immediate skip) > does the founding team have verifiable backgrounds (LinkedIn + previous products that actually shipped) -------------- the timing rule that changes everything : most people find a project > research it > wait to see if others are talking about it > then join late the right sequence is: find it > research it > join immediately if it passes your checklist > built conviction > let others discover it while you're already inside for a while the difference a mid cook to a high cook is usually just timing not much of contribution gap -------------- those are the ways that allows me to have a 5fig portfolio the people who ate the biggest rewards are there before the noise master It, and you will always be early what method do you use to find projects early? ( drop it below, genuinely curious 👀 )

while i was writing about the massive exploits yesterday three more protocols just got drained aftermath finance , sweat economy , and syndicate were all hit in the last twenty four hours it is exhausting watching us pour millions into audits while a single nation state bleeds us dry but there is a wild theory going around that is starting to feel terrifyingly real what if north korea hackers took ten years of stolen defi data and trained their own state funded ai we might just be watching an autonomous machine running free and cashing in until someone figures out how to stop it the lazarus group does not even need to attack your battle tested code anymore they compromise a human like we saw with bybit and slip bad code into the frontend so the screen silently lies to the signers they spend months at our conferences building trust and getting hired as full time developers under fake identities we keep trying to solve a machine speed threat with human code reviews the only real fix is removing humans from the execution layer entirely moving our critical plumbing into secure enclaves means even a completely socially engineered developer cannot extract the keys we have to use cryptography to build systems that protect us from our own tired engineers for the protocols how are you isolating your infrastructure so an automated agent cannot sink your ship and for everyday users like you, how are you verifying what you sign when the frontend itself might be lying to you

Good to see Medusa take responsibility. But creators should be very mindful of what they promote in this space. Promoting a TGE directly was a mistake in the first place, let alone a rug pull. Emerging creators like Medusa should surround themselves with OG web3 creators to learn how to use their influence to support the ecosystem. Peace!