Jasper | Neodyme

Co-founder @Neodyme. CTF @allesctf. Algorithms and complexity theory nerd. Opinions my own.

I break blockchains for fun and profit.

[Jasper | Neodyme @JasperCPS]

@toly @redacted_noah brb gotta place some bets

[Solana Foundation @SolanaFndn]

Solana was built for security. As the ecosystem scales, so does our investment in the tools, standards, and support.

Today that commitment deepens with a new security program, active monitoring, formal verification for top protocols, and a new crisis response network.

Learn more 👇

[Solana Foundation @SolanaFndn]

Alongside STRIDE, the Solana Incident Response Network (SIRN) is now live. A membership-based network of security firms for real-time incident response across the Solana ecosystem. Available to all protocols. Prioritized by TVL.

Founding members: @asymmetric_re, @osec_io, @neodyme, @multisig and @zeroshadow_io

[Drift @DriftProtocol]

https://t.co/qYBMCup9i6

[Neodyme @Neodyme]

Small update on the unfolding Drift timeline: as surfaced in other threads (eg https://t.co/Rpv6VgfcRW), the malicious proposal and execution were nonce transactions (those can be signed offline and not immediately submitted to the network).

The thing about nonce accounts is, that they have an authority set.
So we can go look on-chain to find nonce accounts that are configured to work with any of the new and old drift multisig members. When we do that with dune, we find *three* nonce accounts:

One created March 31st, used in exploit for 6UJb, member of new multisig:
https://t.co/QvxRnvOMK1

And two created March 24th. One used in exploit for 39Jy, member of old multisig: https://t.co/ETvP0Ytb3C

And one NOT used in exploit, for a key in old multisig 45cZ...: https://t.co/AZ1GheaGt8

This can be an indication that they were prepared to attack the old multisig before the migration happened.

There are two additional nonce accounts created by the same authority as the above three, that seem also related to the attack but are not multisig members.
You also don't have to set up the nonce account before signing a transactions. It is perfectly possible to keep that also stealthy, and only create the nonce account once you are ready to submit the transaction. But it appears the attacker didn't do so, and thus "leaked" all keys he wanted to be able to create offline transactions for.

[Neodyme @Neodyme]

Drift Protocol on Solana just got drained. It's looking like a multisig member compromise -- and the story starts at least a 20 days before the attack. Here's the breakdown:

[Neodyme @Neodyme]

Excellent discussion on the current and future landscape of Solana auditing. Thank you @mikemaccana!

[Solana at Quicknode @QuicknodeSolana]

We spoke with Marius at @Neodyme - auditors for Anza, Jump, Marinade, Drift and more - on the past and future of Solana program security.

[Jasper | Neodyme @JasperCPS]

Most descriptions of the hack floating around on twitter were incorrect or incomplete. Here's what actually happened.

[Neodyme @Neodyme]

@GMX_IO V1 has been hacked. Here is how:

[Neodyme @Neodyme]

Meet our colleagues at the "Festival der Zukunft" at @DeutschesMuseum in Munich. Don't miss our talk on July 3 at 4pm!
Check it out here: https://t.co/ZNDrI2NmOj

[Neodyme @Neodyme]

Part 3 of our Riverguard series is out!
We're looking under the hood at the "fuzzcases" Riverguard uses to catch real-world bugs in Solana smart contracts.
Still shocked how often some of these pop up.
Check it out 👉 https://t.co/5WkvxEz0oU

[Neodyme @Neodyme]

From iframes and file reads to full RCE. 🔥

We found an HTML-to-PDF API allowing file reads and SSRF - then chained it into remote code execution via a Chromium 62 WebView exploit.

👉 Read the full write-up here: https://t.co/Qa5Beuuncr

[Neodyme @Neodyme]

Interested in learning about Windows exploitation?

This August, join us in Las Vegas for an intensive, hands-on 4-day DEFCON training:
Binary Exploitation on Windows, led by Felipe and Kolja!

🗓️ When: August 9–12, 2025
📍 Where: Las Vegas Convention Center

[Jasper | Neodyme @JasperCPS]

@takisoul @islandDAO_DL @solana @realmsdaos @deanslistDAO Fo Sho

[Jasper | Neodyme @JasperCPS]

About to touch some snow

[Neodyme @Neodyme]

Neodyme about to go downhill (but just on these Utah slopes) ⛷️
Catch one of these guys at mtnDAO v7 to get your Neodyme beanie.

[Jasper | Neodyme @JasperCPS]

Now I am become @metaproph3t, the destroyer of TradGov.

[Neodyme @Neodyme]

🔎Digging deeper into COM hijacking!
In Part 3, we explore two new vulnerabilities:
🗑️ Webroot Endpoint Protect (CVE-2023-7241) – SYSTEM via arbitrary file deletion
📥 Checkpoint Harmony (CVE-2024-24912) – SYSTEM via a file download primitive

Read more: https://t.co/rDNGUg89Lc

[Jasper | Neodyme @JasperCPS]

Whoops, he's at it again: How to circumvent Windows 11's BitLocker encryption, by @t_lambertz.

[Neodyme @Neodyme]

Your laptop was stolen. It’s running Windows 11, fully up-to-date, device encryption (BitLocker) and Secure Boot enabled. Your data is safe, right? Think again! This software-only attack grabs your encryption key. Following up on our #38C3 talk: https://t.co/8Wbrhqi0iG

[Jasper | Neodyme @JasperCPS]

Just @0x4d5aC and @__k0lja casually finding vulnerabilities in several well-known antivirus solutions.

Nothing to see here, move along.

[Neodyme @Neodyme]

Following our #38c3 talk about exploiting security software for privilege escalation, we're excited to kick off a new blog series! 🎊
Check out our first blog post on our journey to 💥 exploit five reputable security products to gain privileges via COM hijacking: https://t.co/5ne5FBggZl

[0x4d5a @0x4d5aC]

Slides for our talk "The Key to COMpromise" (AV/EDR privilege escalation) are on GitHub.

If you want to discuss this stuff, you can find @__k0lja or me at the CTF area of 38C3

https://t.co/tugYdK8TYa