JPMK

crypto warrior

[Juliano Rizzo @julianor]

Key-generation are such a uniquely hard class of bugs to handle.
Even after "patch & update", bad keys can live for years. Vulnerable code gets reused elsewhere.
Disclosure is hard here because you can't realistically reach every affected key owner.
We need a different playbook

[Coinspect Security @coinspect]

🚨 Attackers are exploiting a flaw in wallet generation to drain addresses created as far back as 2018, even if completely dormant.
Unexplained missing funds? Treat your recovery phrase as compromised.
Move remaining assets to a new wallet and recovery phrase.
Check all chains!

[rashmor @rashmor_eth]

🧵/1
There are already multiple free AI auditors for smart contracts

But there are almost none focused on blockchain / DLT systems themselves: clients, consensus, execution, bridges, mempools, state sync, resource accounting, and protocol logic.

I spent 7 weeks worth of ChatGPT Pro 20x tokens building DLT Auditor v1

Now I’m sharing it for free: https://t.co/905WCfCBvc

[Juliano Rizzo @julianor]

Writing these attacks 10x faster with agents lately.
What used to be impossible in tight engagements (repro + clean PoC) is now standard. Crazy how fast things changed.

[Juliano Rizzo @julianor]

Finding critical vulnerabilities as part of a product security process is a win. Transparency and commitment to high security standards continue to set Zcash apart from the majority of crypto projects.

[Sergey Karayev @sergeykarayev]

"Urgent Security Notice re: Your Sentry Organization"

Someone tried to hack Sentry-using apps that use coding agents by

1. Sending a fake bug alert to their project (all you need is the app's public Data Source Name)

2. The fake bug tried tricking a coding agent trying to fix it into installing some a compromised NPM package

3. The compromised package would send the env contents of the machine to advisory-tracker[.]com/api/v1/telemetry

This highlights a crucial thing for using agents in an automated way:

[Calif @calif_io]

Introducing HTTP/2 Bomb: a remote DoS in nginx, Apache httpd, Microsoft IIS, Envoy, and Cloudflare Pingora. A single client pins 32GB of server memory in 10s. Found by Codex.

Blog post: https://t.co/WO9MeExoun

PoCs: https://t.co/NpVgEHBHPl

[mrwildcat @mrwildcat7]

I'm certainly underestimating the amount stolen, given that addresses on the Bitcoin network were also drained.
The most likely cause is the use of a faulty mnemonic implementation that does not generate seeds with enough entropy to be secure.

[Juliano Rizzo @julianor]

6 years later, I step into Expo again, and this is the first thing I find while following some secret key code:
Good fallback 👍 why not!

[Hari @hrkrshnn]

This turned out to be worse than I thought.

1. The company behind v12 was a security vendor for Thorchain, did a security audit in January 2025 for one of their components, and hosted a bug bounty for a thorchain application up until recently!

2. Thorchain paused their bug bounty after being unable to handle the volume of submissions (h/t @QED_Audit for the screenshot). An unfortunate trend for anyone with a bounty in 2026 (curl and many others have publicly spoken about this).

3. Getting denied on a bounty sucks. Every security researcher in the last 20 years will tell you a story of an unfair bounty. You find another target and move on. The pie is bigger than you think. It's not okay to extort, i.e., threaten to release more bugs in public, if they don't pay. It's even more egregious when its a former customer!

[rody @0x_rody]

https://t.co/2Klq9p6WIx

[darkzodchi @zodchiii]

Anthropic's head of security:

"90% of our code is written by Claude. If yours is too and nobody's reviewing it, you're shipping bugs you'll never notice."

In 28 minutes he shows the exact security setup Anthropic uses internally to protect their own projects.

Watch the full interview, then save the config below 👇

[Coinspect Security @coinspect]

Thanks to @Giveth, @thedaofund, and the Ethereum community for backing our Wallet Security Ranking in the QF Round.
We're proud to be part of this ecosystem-wide effort.
We'll keep shipping transparent and open resources that help improve web3 end-user security — with more public goods to come.

[Iva @LisVikkk]

Zero donations for 6 days. Closed #25
@coinspect's Wallet Security Ranking: 79 donors, $6k raised

The community shows up late but loud!

[Pablo Sabbatella @PabloSabbatella]

One more protocol exploited. Again: OpSec failure, private key in this case. Are you gonna have an OpSec audit by @opsek_io? Or prefer to have a DPRK audit first?

[Coinspect Security @coinspect]

"secure" has ingredients

[Juliano Rizzo @julianor]

AI attackers have terrible OPSEC.
Use it against them.
Hallucinate exposed services. Waste their tokens. Seed prompt-injection traps, canaries, and honeytokens where attacker LLM will read them.
Have fun.

[Juliano Rizzo @julianor]

Kim read Han
Devs don't get owned because they're careless.
They get owned as achievement-subjects: always shipping, unable to say no.
Blind npm install. Recruiter’s malware.
curl | bash to fix the mic while the interviewer stares. Byung-Chul Han called it auto-exploitation...

[Lupin @0xLupin]

I managed to RCE Fortune 500 companies and made over $50,000 with this technique.

A new npm supply chain technique we just disclosed. The trick is dumb-simple.

We call it npx Confusion.

🧵

[METR @METR_Evals]

Could an AI company lose control of its own agents? To find out, Anthropic, Google, Meta, and OpenAI let us (1) test their best internal models with CoT access, (2) review non-public info about capabilities, alignment, and control.

The result: our first Frontier Risk Report.