Blockian

@immunefi Elite All Star | Currently, an alter-ego of @ControlZ_1337 (previous member @pwnmansh1p) |

[Blockian @_blockian]

Just reached rank 30 on @immunefi all-time!

This also marks the halfway point on the road to $1 Million!

▓▓▓▓▓░░░░░ $527k / $1M

[ControlZ @ControlZ_1337]

And here I am, having reported vulnerabilities throughout my career that could have resulted in a total of several billions (yes, with a B, > $2B) being *stolen*, while my total earnings are around $2M.

So what's the lesson the industry is teaching researchers?

That next time we should steal the funds first, then negotiate a "responsible disclosure," return 80–90%, and walk away with 10–20%?

Obviously, no. But it's insane that the incentives can make that rhetorical question even possible.

The bounty world is broken.

Blackhats exploit a protocol and get treated like kings in negotiations. Meanwhile, whitehats disclose the exact same kind of vulnerability privately, prevent any damage from happening, and then spend months arguing with projects that try to downgrade the finding and pay the bare minimum.

I'm fighting several cases like this right now. Millions of dollars protected, vulnerabilities responsibly disclosed, and yet projects still don't want to pay the amounts they themselves advertised.

We should be making responsible disclosure the overwhelmingly obvious choice.

Instead, the current state of Web3 is doing its absolute best to discourage whitehats while creating increasingly attractive incentives for blackhats and "grayhats".

Those incentives are backwards, and eventually the ecosystem pays the price.

[ControlZ @ControlZ_1337]

I read KiiChain’s postmortem and realized something pretty crazy. About 3 weeks ago, we privately reported a critical exploit chain to another Cosmos-based project that reached the same unsafe StateDB subtraction through a completely different path. Thankfully, they confirmed and fixed it really quickly.

These weren’t the exact exploit chain, but they shared the same unsafe StateDB balance primitive: a native balance subtraction that could wrap around in `uint256`. Letting it underflow is an important primitive, but the subtraction alone isn’t enough to steal anything.

Normally, the EVM checks that an account has enough balance before subtracting. To exploit this, you still need another state or accounting bug that breaks that assumption, and then a way to turn the broken balance into real money.

So this does NOT mean every Cosmos EVM chain was exploitable. It depends on the implementation and how each chain keeps its Cosmos and EVM balances in sync.

Sadly, we made a mistake: we didn’t go looking through every other chain that might have had the same primitive.

I tried to understand why, and I think there are 2 main reasons:

1. We focus our research on targets that have bug bounty programs. We didn’t even know some of these other chains existed, and we weren’t aware of a bounty program for projects like KiiChain. Blackhats don’t have that restriction.
2. The underflow primitive on its own isn’t enough to steal funds. An affected project would also need a separate bug that makes the underflow reachable and exploitable. This made us wrongly assume the issue was specific to the project we were reviewing.

I’m genuinely sad that we didn’t connect the dots before real users got hurt.

But on the bright side, our report helped protect literally tens of millions of dollars (no exaggeration) on the chain we reviewed (though we haven't gotten paid for this one yet).

I think this incident shows why bug bounty programs and responsible disclosure matter. It also shows why security updates need to be coordinated between upstream maintainers and the downstream projects using their code.

[HackenProof @HackenProof]

$30,000 in bounty rewards goes to @_blockian!

One more achievement, and certainly not the last.

Well deserved. Congratulations from HackenProof! 🏆

[Blockian @_blockian]

Our open-source project is out! Go check it out 🥳

[Kritt @Kritt_AI]

We’re releasing the first open-source version of Open-Kritt!

Open-Kritt helps security researchers use AI for vulnerability hunting like never before.

It’s a battle-tested system that has already helped us earn multiple six-figure bounties.

Read our launch article, where we explain how Open-Kritt works and share the research tricks behind it: https://t.co/UJBMaJ4cyk
Open-source (don't forget to ⭐): https://t.co/rAUz22i4OO

Join our Discord community: https://t.co/WzXMUKWxcR

[Blockian @_blockian]

Confession time:

@ControlZ_1337 didn't manually review a single line of code in this competition.

Everything was done through custom AI workflows that we built and orchestrated using our own platform: open·kritt.

And as the name suggests, we're open sourcing it. @Kritt_AI

We're planning to release it this week (hopefully), so if you don't want to miss it, go follow @Kritt_AI for updates.

Our hope is that open·kritt helps more researchers build powerful AI-assisted security workflows and ultimately makes the Web3 ecosystem more secure :)

[Immunefi @immunefi]

🚀 The @jump_firedancer Audit Competition is a wrap!
🔥 $500k in reward pool has been paid out!

🏆 Top Winners:
🥇 @_blockian - $78,150
🥈 @al_f4lc0n - $57,778
🥉 @Haxatron1 - $57,558
4⃣ @innertia_jp - $39,485
5⃣ @pks_eth - $27,535

[Blockian @_blockian]

@mrhamzoz @immunefi If someone uses AI to submit slop, then sure - ban them.

But if AI is used to produce valid findings, with real PoCs that actually prove the issue, why would you ban someone for that?

[ControlZ @ControlZ_1337]

I think this might be the largest bounty so far for an AI-assisted finding.

And yes, confession time: I used the AI tools I’ve been working on over the past few months to help find this bug. I’d love to say it was all me, but that wouldn’t be honest. The world is changing, and AI is clearly becoming a big part of it.

[Blockian @_blockian]

I think this might be the largest bounty so far for an AI-assisted finding.

And yes, confession time: I (@ControlZ_1337) used the AI tools I’ve been working on over the past few months to help find this bug. I’d love to say it was all me, but that wouldn’t be honest. The world is changing, and AI is clearly becoming a big part of it.

[Immunefi @immunefi]

Just a few days ago, the legends behind @_blockian found a max critical that earned them $250,000.

Merry Christmas!

[Blockian @_blockian]

@WhiteHatMage @akki_pujari @immunefi I hope so as well 🙏
But if I had to put my money on someone, I’d bet on @lonelysloth_sec taking the throne.

[ControlZ @ControlZ_1337]

How did I do on my 2025 New Year’s resolutions?

❌ $1M in revenue -> Failed
Total revenue this year across all platforms + audits: $907K

❌ $1M in a single bounty -> Failed
Biggest single bounty: $250K on Immunefi

✅ Top #30 on @immunefi -> Success
Reached rank #22 just yesterday

✅ Full planche -> Success
Can hold a full planche for ~4 seconds

Some accomplishments that weren’t on my original list:

✅ Top #10 on @HackenProof
At the start of the year I’d never even tried HackenProof, but after @WhiteHatMage went on a journey to other realms, I decided to give it a shot. Had a lot of fun and reached #7 all-time.

✅ Snowboarded for 4 months
Took a much-needed break at the start of 2025 to snowboard. Best trip of my life.

✅ Had fun
Beat Silksong, E33, and generally learned to slow down a bit. This year taught me that taking breaks and enjoying life actually matters.

So while I technically failed most of my 2025 resolutions, it was still a great year overall. Here’s hoping 2026 will be just as good -
and that I’ll do a better job sticking to my resolutions this time 😄

[Blockian @_blockian]

@WhiteHatMage @carlos__alegre @therealgregoAI @ZeroCool_AI But, we still have a long way to go before it’s 100% pure AI with no human in the loop and zero missed bugs.

So for now, SR's are safe.

[ControlZ @ControlZ_1337]

Ok, here are the statistics for confirmed and paid findings from the past ~2 months, assisted by the AI tools I’ve been working on:

@immunefi :
2 Criticals
1 High
1 Low (marked as Critical but should be downgraded due to default configuration restraints)

@HackenProof :
1 High

@Hacker0x01:
1 High

Private Bug Bounties:
2 Critical
1 Low

Total payouts are expected to be roughly ~$400K. Payouts tend to move slowly, so more of the results should become public over time.

[Blockian @_blockian]

@PratikHunter01 @MitchellAmador @infosec_us_team @WhiteHatMage @lonelysloth_sec @Ehsan1579 @yeandamen Go with whatever you find more fun. If you don’t enjoy what you’re doing, you’ll burn out quickly and stop. Stick to the path you can actually sustain.

[Art Of Auditing @ArtOfAuditing]

🧙‍♂️Wise sage @_blockian once sad:

🧠 DEBUG

📜 "Don’t underestimate the importance of a working debug setup"👇

https://t.co/xHEzaTL8SP

[ControlZ @ControlZ_1337]

Assume you find a High/Critical vuln in a library forked by many projects. The bug exists in their code right now, and can be exploited against them.

Who should pay the bounty?

[ControlZ @ControlZ_1337]

I think it’s fair to say me and @Schnilch share the first place, only $800 difference, now that’s a close one!

Great job my friend! And thanks to @HackenProof and @Somnia_Network

[Blockian @_blockian]

Nicely done @ControlZ_1337

[ControlZ @ControlZ_1337]

So apparently I won the @Somnia_Network contest on @HackenProof - which honestly came as a surprise 😅

I joined only in the last 10 days of a month-and-a-half-long contest, so I thought I didn't have enough time to cover everything (huge codebase) while others had a head start. When the contest ended, I was kinda mad at myself for joining so late and not finishing my TODO list.

But I gave it everything I had in those 10 days - and apparently, that was enough to win 😁
I'm really glad I did, but it's still not enough - next time, I'll make sure to give myself enough time to finish my TODO list 😅

[ControlZ @ControlZ_1337]

Ok, I think I’ve got it done.

Rank 7 @HackenProof all time leaderboard 🤘🏻

[Blockian @_blockian]

@wipernation1 Thanks 🙏

[Blockian @_blockian]

Noice

[HackenProof @HackenProof]

Weekly Leaderboard 🏆

🥇@_blockian
🥈 mzfr
🥉 @kxrd36

Congrats to our top hunters! Big props to everyone pushing quality.