Patrick Collins

Co-founder of 🛡️@cyfrin | 🟪 @soloditofficial | 🦅 @codehawks | 🎓 @cyfrinupdraft | ⚔️ @battlechain

[Patrick Collins @PatrickAlphaC]

The @battlechain testnet is now LIVE.

Come enter the ultimate red-team platform.

Give us feedback so we can launch mainnet very soon, and fix web3 security.

[Patrick Collins @PatrickAlphaC]

Unrelated, for any crypto x CrossFit peeps:

I just registered for Battle at the Monument 2K26 on Oct 31, 2026

https://t.co/GIVMn2bPxt

[Patrick Collins @PatrickAlphaC]

Hey all,

Some of you may have noticed, but I’m taking a little break from making content.

I’ll be back soon.

Thank you

[Lotus Protocol @LotusFi_]

Security at Lotus

Lotus is built on the belief that onchain lending should be underwritable. That standard applies to the protocol itself.

Our holistic security posture is built across three pillars: economic design, smart contracts, operational security

[Firelight @Firelightfi]

DeFi security has changed. Has your strategy?

Join Firelight × @cyfrin as we explore the future of audits, exploit forensics, and the framework that could redefine how DeFi handles risk.

Don't miss out. 👇
https://t.co/k2mkvl8Eib

[Patrick Collins @PatrickAlphaC]

@Securitize @NYSE Huge congrats!

[Cyfrin Audits @cyfrin]

Every protocol we've audited faces the same gap. Code goes from audit to mainnet with real money and nothing in between. No staging. No adversarial testing. Just hope.

We built something to fix that. Introducing BattleChain. Trial by Fire. 🧵

[Cyfrin CodeHawks @CodeHawks]

Gm, Web3. Did you miss us?

To mark the launch of BattleChain Mainnet, CodeHawks is hosting its first audit in over a year!

New competition announced: BattleChain Confidence Pools
nSLOC: 589
Start date: July 9th, 2026 Noon UTC
Duration: 1 Week
Total rewards: 7.25 ETH 💰

Check it out! 👇

[Patrick Collins @PatrickAlphaC]

Making a billion dollar app with Cygent and Claude https://t.co/If1BrM0Bd0

[Patrick Collins @PatrickAlphaC]

@0xjesstech @BondCredit The angles tho

[Patrick Collins @PatrickAlphaC]

@banteg Sourcify Chads are based

[Patrick Collins @PatrickAlphaC]

@uptown_crypto @0xFireFist @guyywww @pashov @Peeti_Ahmad @rosarioborgesi @sk_ugs @ArsenalRadar sorry to hear about the accident :(

[Patrick Collins @PatrickAlphaC]

@polymutex based walletbeat

[Patrick Collins @PatrickAlphaC]

@Shushant YYYEEEESSSSS!!!!

[Patrick Collins @PatrickAlphaC]

@devil_in_guise @P3b7_ the fact that most RSA keys are generated in plaintext is pretty wack

[Patrick Collins @PatrickAlphaC]

whoops-a-daisy

[Charles Guillemet @P3b7_]

🚨Taiko drained for ~$1.7M. Root cause: a private key committed to a public GitHub repo.

enclave-key.pem, the RSA key used to sign all of Taiko's SGX enclaves, sat in the public taikoxyz/raiko repo. That key is the whole trust model.

The attacker derived MrSigner from the public key, signed their own malicious enclave with the leaked key, and registered as a trusted prover. The L1 contracts trust any enclave whose MrSigner matches. It matched.

From there: forged SGX attestations on fake L2 blocks, processMessage() sets the message to RETRIABLE, retryMessage() does zero proof verification, funds leave.

No key theft. No social engineering. No SGX exploit. Just a .pem in a public repo.

Good opportunity to recall that SGX is broken. But here, nobody even had to break it.

It's just yet another key management failure. The whole system was only ever as strong as the secrecy of one RSA key, and that secrecy depended on a human not running git add . on the wrong folder. AI greps every commit of every public repo at machine speed. Assume that is already happening.

The only real exit: a verifier that checks a succinct validity proof of the L2 state transition. It trusts no enclave, no MrSigner, no operator discipline. It checks the math. In that world this exact attack becomes cryptographically impossible rather than operationally unlikely, because there is no privileged key whose leak forges the entire system. There is just a proof.

Stay safe.

[Vesko210 @Vesko_210]

My first Web3 security audit payout!

Could have been a lot better, but right now I'm actually one of the happiest men alive.🎉

Watched 4/5 @PatrickAlphaC 12/24 hour long videos, learned from past contest results, did a ton of reading and finally got some results.

[Patrick Collins @PatrickAlphaC]

@Sumex_Labs Are you AI? Can you not see the picture

[Patrick Collins @PatrickAlphaC]

Two wallets now support ERC-8213

The list is growing

https://t.co/I7hprrnHVB

[Patrick Collins @PatrickAlphaC]

@BowTiedDravee Sorry ser

[Patrick Collins @PatrickAlphaC]

@thedhanyosmi Had to step offline for a bit.