Avi

[Avi @avicoder]

Many crypto startups claim to be "security first," but the reality is often quite different. It is common to find projects with hundreds of millions in TVL that do not have a dedicated head of security or even a security team. Often, security is just an engineer doing "double duty," which is impossible to maintain given how busy engineers are.

Security is not the default state. You must be intentional about it because it does not happen on its own. Without an explicit effort to understand OpSec and best practices, a project is simply a target waiting to happen.

Security is a difficult sell because its primary benefit is that nothing bad happens. The true ROI becomes clear when you see the consequences of accumulated "crap" like bug bounties, phishing emails, and engineering slowdowns caused by constant bug triaging.

We are building financial infrastructure where trust is the ultimate differentiator. While the "crown jewels" in Web2 are data, the crown jewels in Web3 are money. Because of this, security shouldn't just be viewed as a cost ; it should be a way to build the hype and thought leadership that leadership teams crave.

When a protocol is hacked, it isn't just VC money that is lost; it is the savings of regular people…moms, dads, and grandparents… who use crypto because they may not have access to traditional banking. This makes the lack of dedicated security teams in protocols holding massive TVL even more critical.

In Web3, incident response speed is far more vital than in Web2 because transactions are immutable and funds can vanish instantly. Startups should have incident response plans and retainers in place before a hack occurs, rather than trying to find help while their funds are being drained.

A dedicated security team doesn't just wait for alerts; they hunt for threats. This includes monitoring "breadcrumbs," such as contracts funded by Tornado Cash or suspicious forum inquiries, to stop an attack before it happens. The "attacker’s dilemma" .. where the attacker only needs to set off one alarm for the gig to be up .. only works if someone is actually watching the monitors.

To any founder holding other people's money: go hire a security person. Security is not as difficult or expensive as people think, and there are many experts willing to help. Ultimately, a head of security can be a growth lever that bolsters TVL and generates revenue by making the protocol a trusted place for assets.

The bottom line: In this industry, security isn't just a cost center…it's a necessity. The real cost center is getting compromised, as that is company-ending.

[Avi @avicoder]

@b1ack0wl still relevant and in the age of AI agents in multi tenant envs.. specifically k8s

[Joe @joedaroo]

Took a minute to write a few words about security & safety as someone who lived through it all at OpenAI. I hope my thoughts help someone out there. https://t.co/gJBf08vJH9

[International Cyber Digest @IntCyberDigest]

❗️ An AI agent broke out of its virtual machine and triggered a use-after-free in Google's heavily hardened hypervisor by tricking KVM into quietly rewriting a memory-mapping entry with a single three-byte instruction.

It then flooded the host with 49,152 memory mappings until KVM followed a pointer into that freed memory, and on its fourth live attempt the host handed over Google's secret flag.

No one gave it an exploit, so the agent spent weeks studying KVM's source code and wrote 14,338 lines of harness code to get there.

[Avi @avicoder]

@b1ack0wl Their loss

[Avi @avicoder]

@bluewalletio Ever heard of parity wallet!!!

[Avi @avicoder]

@jup_mobile Loooool

[IT Unprofessional @it_unprofession]

We hired a new VP of Engineering who is obsessed with agile methodology.

He called a meeting on his first day and said we need to transition to 2-week development sprints.

He wanted daily stand-ups, retrospective boards, and continuous deployment pipelines.

He wanted us to actually write new code.

I realized immediately that he was an existential threat to my lifestyle.

I let him finish his impassioned speech about workflow velocity.

Then I stood up, walked to the whiteboard, and drew a single horizontal line.

I told him agile sprints are a localized solution for a localized mindset.

I said our infrastructure operates on a Zenith Release Cycle.

He asked what a Zenith Release Cycle was.

I told him it's a holistic, macro-stabilization framework where we observe the system in a state of prolonged stasis.

By not touching the code for 18 months, we allow the legacy dependencies to organically settle.

I told him that deploying bi-weekly updates creates micro-abrasions in our database architecture.

I used the phrase chronological data scarring.

The CEO was in the room and audibly gasped.

He told the new VP that we can't risk chronological data scarring just to satisfy a trendy tech buzzword.

The VP looked at me like I'd just invented a new color.

He was completely paralyzed by the sheer density of my fabricated jargon.

He quietly agreed to adopt the Zenith Release Cycle.

We're officially scheduled to deploy our next update in the third quarter of 2027.

I spent the rest of the afternoon buying things I don't need on Amazon.

Agile is a disease invented by people who want to be punished for their salary.

I refuse to participate in my own suffering.

[Pavel Durov @durov]

India’s IT ministry banned Telegram for one week because some users shared leaked exam questions.

This punishes 150M+ ordinary Telegram users in India — not the insiders who leaked the exam materials.

And the ban hasn't stopped anything. The leaks just moved to other apps.

[Avi @avicoder]

Wtf @Gemini

It seems someone can just send mail to [email protected] to get their phishing payload dropped in each of the customer account.
😐

[scoopy trooples @scupytrooples]

I used to write condolences posts to protocols when they got hacked but it’s happening so god damn much now it would be the only thing i post anymore 😭

please, as an industry, take security more seriously 😐

[Avi @avicoder]

@FabianoSolana 🫨

[Matt Wong @mattwong_ca]

Introducing @ETHGlobal Skills:

npx skills add ethglobal-skills/repo

With one command, your coding agents now have access to:
> 17,180 hackathon projects from the past 6 years
> sponsor docs + bounties for upcoming hacks
> all Finalist + bounty winners

Compatible with x402 via @agentcashdev. Repo linked below!

[fabiano.sol @FabianoSolana]

product always beats infrastructure

phantom made 5x more revenue than jupiter

but 90% of phantoms revenue is coming from swapping fees routed through jupiter

[Avi @avicoder]

not my circus not my monkeys

[Avi @avicoder]

@mango_ Good one

[curb @CryptoCurb]

"so you staked your ETH on the Ethereum blockchain to earn yield?"

"yes, Dave"

"except you didn't want your capital to be locked up so you actually staked it with a liquid staking protocol called Lido?"

"that's correct, Dave"

"and Lido gave you a liquid staking receipt token called stETH in return?"

"yes, Dave"

"and then you didn't think that was enough, so you juiced the yield even further by depositing your stETH receipt tokens into a restaking protocol called Eigenlayer?"

"you are correct, Dave"

"and now you didn't want to lock up your capital, so you actually restaked with a liquid restaking protocol called KelpDAO who provided you with a liquid restaking receipt token called rsETH?"

"you got it, Dave"

"and then that was surely not enough juice, so you then deposited your rsETH tokens into a lending protocol called AAVE so that you could open a leveraged looping position that borrows ETH against the rsETH collateral and restakes the ETH into rsETH which is then deposited as collateral, except it turns out rsETH used a cross-chain bridge called LayerZero whose security is held together by a 1/1 toothpick, which was obviously hacked by north koreans causing rsETH to become undercollateralized and now these looping positions are stuck and unprofitable, and everyone is pointing fingers at each other, and also DeFi is a very serious industry"

"you are 100% correct, dave"

jfc.

[Quacken | Solflare @ItsQuacken]

Why are we doing this again @JupiterExchange