InfyniSec

Safeguarding onchain assets by keeping your favourite protocol off

[pashov @pashov]

Every day we see new people finding bug bounty vulnerabilities on web3 security platforms like Immunefi and HackenProof of $10k, $50k or more

Web3 security really going through huge changes & great things are happening, the whitehats are becoming stronger than ever, beautiful🔥

[InfyniSec @InfyniSec]

Truly legendary, only legends can relate.

[chrisdior @chrisdior777]

🚨😱From zero Solidity knowledge to a $135,000 confirmed critical bounty in 2.5 months.

Here is the story:

Before Web3 security, he was a software engineer building AI agents, with a strong JS background.

That helped him pick up Solidity fast.

He started learning Solidity at the end of November 2025.

By mid-February 2026, he had already found his first critical bug on Immunefi.

AI helped him move faster too:

understanding protocols, brainstorming attack paths, reviewing assumptions, and figuring out where bugs could hide. But the real separator was still the mindset.

It was grinding 12–14 hours a day, 6 days a week, switching from “developer” to “attacker” mindset, and refusing to quit during the hard phase.

For new Web3 bug hunters:

You do not need 5 years before you find real bugs.

But you do need obsession, consistency, protocol understanding, attack intuition, and the ability to keep going when nothing clicks yet.

The learning phase ends when the real hunting starts.

Beast!👏 @Omisanin0

[Logos @Logos_network]

What are activists up to in Logos Circles?

Circles are grassroots meetups in cities worldwide, solving real issues at the intersection of activism + tech.

They don’t wait for permission; they see a problem and act.

Here are highlights from Circles initiatives last month ↓

[EduCreds @EduCreds_cert]

@BChainDevFest Together we can redefine how communities can be introduced, onboarded and participate into web3
#EduCreds #EduTech #TrustLayer

[Blockchain Developer Festival 2026 ✨ @BChainDevFest]

🎉🎉 we honor the partnership,

[pashov @pashov]

🤯CODE4RENA SUNSETTING. THE END OF AN ERA

Thank you for everything, code4rena, forever in our hearts <3

[Blockchain Developer Festival 2026 ✨ @BChainDevFest]

Africa has massive talent. Nigeria leads Solana devs globally in some metrics, and hubs in Kenya, South Africa, Uganda & beyond are rising. But myths hold many back. Here's the truth. 🧵

Myth 1: "Blockchain = Crypto speculation & scams. It's not for real developers." (Beginner)

[CertiK @CertiK]

Ethereum security is a public good.

The people protecting the ecosystem — researchers, auditors, and builders — play a critical role in its long-term resilience. 🧵

[InfyniSec @InfyniSec]

This is the sort of madness that makes hackers run mad.

[0xasen @asen_sec]

Proud to have placed 2nd in the @code4rena Monad competition.

1,614 wardens, 164K SLOC of Rust and C++.

Submitted the most valid findings in the contest.

Shoutout to @monad for putting this one up.

Huge respect to everyone who competed!

[Arsen @arsen_bt]

4 steps to find bugs faster.

Eliminate ideas.

The typical audit flow is:
• Understand the code
• List observations
• List suspicious parts

Then, come up with all possible ideas based on it.

Research every ideas deep.

Ensure that idea is a dead end

[InfyniSec @InfyniSec]

Hyperbridge rekt

The Hyperbridge attack, which occurred on April 13, 2026, was a major security breach involving a cross-chain interoperability protocol built on Polkadot. While initial estimates placed the loss at roughly $237,000, subsequent forensic analysis revealed the actual damage was approximately $2.5 million across multiple chains.

The incident is particularly notable because Hyperbridge marketed itself as a high-security, proof-based bridge designed to avoid the “multisig” vulnerabilities that led to previous historic hacks.

## The Technical Vulnerability
The root cause was a flaw in the cryptographic verification logic within the protocol’s HandlerV1 smart contract.

Forged Merkle Proofs: The VerifyProof() function failed to perform essential input validation (specifically checking if the leaf_index was less than the leafCount).

The “Proof Replay”: This oversight allowed an attacker to submit a forged ISMP (Interoperable State Machine Protocol) message. By recycling data from previous legitimate transactions, they tricked the protocol into accepting a malicious state change without a valid cryptographic link to the source chain.

Disabled Safety Nets: A built-in “challenge period” (designed to give “fisherman” nodes time to dispute forged state commitments) was set to zero on the Ethereum host, allowing the attack to execute instantly.

## How the Attack Unfolded
The exploit was executed in two distinct phases:

Phase 1: Liquidity Extraction (The “Quiet” Phase)
The attacker first extracted nearly 245 ETH from incentive pools on Ethereum, Base, BNB Chain, and Arbitrum. This part of the attack went largely unnoticed for the first hour.

Phase 2: Administrative Takeover & Minting
Using the forged proof, the attacker triggered a ChangeAssetAdmin action. This granted them administrator and minter privileges over the bridged DOT token contract on Ethereum.

The Mint: The attacker minted 1,000,000,000 (1 billion) DOT tokens out of thin air.

The Dump: They immediately swapped these tokens through decentralized exchanges (DEXs). Because the supply was 2,800 times the legitimate circulation, the price of bridged DOT on Ethereum collapsed to nearly zero.

## Impact and Recovery
Total Loss: Revised to $2.5 million, including the stolen ETH and the drained liquidity pools.
Scope: The attack was limited to Hyperbridge’s gateway. Native DOT on Polkadot and other bridge protocols (like Snowbridge) remained completely secure.
Current Status: Hyperbridge operations for the Token Gateway remain suspended. The team has committed to a recovery plan using native BRIDGE tokens to reimburse affected users if stolen funds (some of which were traced to Binance) cannot be recovered.

[InfyniSec @InfyniSec]

@RaveDAO , how come someone who submitted their address on plvr in the January airdrop can't see any of their tokens/points that were promised?

For extra context: its a @coinbase wallet and its secure.

[Shieldify Security @ShieldifySec]

|￣￣￣￣￣￣￣￣￣￣￣￣|
Ai will NOT protect
your smart contracts
|＿＿＿＿＿＿＿＿＿＿＿＿|
\ (•◡•) /
\ /
——
| |
|_ |_

[InfyniSec @InfyniSec]

@chrisdior777 Truly legendary

[InfyniSec @InfyniSec]

@pashov InfyniSec

[pashov @pashov]

Say the name of a web3 security company and I will say 1 good and 1 bad thing about it

[pashov @pashov]

Web3 Security Horror Story Time

A protocol gets reported a Critical vulnerability. They immediately patch it with a code fix and push it on-chain to their upgradeable contracts.

A MEV bot picks up the "code fix" transaction before it is validated into a block, re-engineers the vulnerability with AI and front-runs the upgrade patch with an exploit.

Upgrade passes successfully, the exploit before it as well. You just exposed the fix of a Critical vulnerability to an untrusted actor. AI allowed seconds to be enough to deduct a vulnerability from a patch.

You can argue AI is dumb, sure. But you can't argue AI is not fast - and that it can't be even faster. Upgradeability and MEV bots become an attack vector with time.

I challenge you to say how this can be safely secured.

[InfyniSec @InfyniSec]

https://t.co/THytqasUux

[InfyniSec @InfyniSec]

The $50M to $36K Aave Swap Disaster: A Brutal DeFi Lesson
On March 12, 2026, a trader attempted to swap ~$50.4 million in aEthUSDT (Aave's yield-bearing USDT) for AAVE tokens via the official Aave interface.
Result? They received just ~324–327 AAVE tokens worth roughly $36,000 — a ~99.9% loss in seconds.
No hack. No exploit. The transaction executed exactly as signed.
Here's what happened:

The swap routed through CoW Swap → redeemed USDT → swapped to WETH on Uniswap (fine) → then dumped into a SushiSwap AAVE/WETH pool with only ~$73K–$75K liquidity.
The massive order crushed the price in that thin pool.
Multiple red-flag warnings appeared: "extraordinary slippage," ~99% price impact, manual confirmation required.
The user (on mobile) set low slippage tolerance (1.21%) and approved anyway.

MEV bots pounced — one reportedly extracted millions in profit by back-running the distorted trade.
Aave's post-mortem confirmed: everything worked as designed. They’re refunding ~$600K in fees and rolled out Aave Shield — auto-blocks swaps with >25% price impact (users can disable it).
Key takeaways for DeFi users & builders:

Your keys, your responsibility — even slick UIs can't stop bad decisions.
Warnings exist for a reason; size matters more than interfaces suggest.
Shallow liquidity + large orders = catastrophe.
MEV turns mistakes into someone else's payday.

DeFi offers freedom — but zero safety nets when you ignore the math.
One click. $50M gone. $36K left.
Always simulate big trades first. DYOR. Stay vigilant.

[Blockchain Developer Festival 2026 ✨ @BChainDevFest]

@rkukiriza @UnlockProtocol @AnalyticSages @dev3pack @_one_dev @TheSafariDAO @InfyniSec The energy continues.. with responsible defi