DadeKuma

Independent Security Researcher |
Collaborating with @zenith256 @cyfrin @PashovAuditGrp |
Available for private audits, Solana/Rust & EVM 🗓️

[DadeKuma @DadeKuma]

Note: I just made this repo public, so it would be awesome if you could star it 🌟

I've also included an audit template that you might find useful for creating your own!

⬇️
https://t.co/F9aJaxafXf

[DadeKuma @DadeKuma]

Blackhats: get instant 20% reward, no max cap.

Whitehats: usually get 0% after months of waiting. If feeling generous, 10% with a ridiculously low max cap.

[DadeKuma @DadeKuma]

@Jhoe0x Certora

[DadeKuma @DadeKuma]

@WhiteHatMage Yes, but a small minority. Some people are solely motivated by money; a top SR was even caught scamming during a contest a few years ago.

[DadeKuma @DadeKuma]

Please, don't let C4 die 🙏

[Sock @sockdrawermoney]

Or that contests remain the most effective form of audit when it comes to finding more bugs faster per dollar than any other method.

@zellic_io should open source the @code4rena platform and operational manual so projects or foundations or VCs or @ethereum or @_SEAL_Org can run these as I always felt they were: public goods. cc @samczsun

[DadeKuma @DadeKuma]

Another day, another million-dollar hack.

[DadeKuma @DadeKuma]

@WhiteHatMage In my experience, you need a very fast tool. Valid bugs are submitted a few minutes (1-10) after a BB starts now.

I think it's better to focus either on speed or depth/edge cases, doing both doesn't work well since AI is in play IMO.

[DadeKuma @DadeKuma]

@0xMorph @ScrewCopper @bytes032 @0x3b33 I meant "bounty" style contests. C4 did not utilize a granular severity based unlock criteria. They refunded the clients only if zero bugs were found.

[DadeKuma @DadeKuma]

@rosarioborgesi I don't want to be a doomer, but it seems the industry as a whole is struggling hard🥲

[DadeKuma @DadeKuma]

2026 is officially the worst year for web3 ever 🥲

[Code4rena @code4rena]

After careful consideration, we’ve made the decision to wind down @code4rena. This community has meant a great deal to everyone who has been part of building it, and sharing this news is not easy.

[DadeKuma @DadeKuma]

@ScrewCopper @bytes032 @0x3b33 They introduced conditional pots, which significantly reduced profitability for both platforms and auditors

[DadeKuma @DadeKuma]

@0x3b33 Tragedy of the commons

[DadeKuma @DadeKuma]

AI is crazy good, but once the devs realize they can run the tools themselves for a fraction of an audit's cost, the value of AI findings will quickly drop to the average token cost.

Before, it was more difficult; you had to build a good harness / agent orchestration to have something usable. Now, you can do the same with a good prompt, context management, and SOTA models.

There are still bugs that AI can't find, so to be 'future-proof' you have to focus on these edge cases.

I tested this in a BB: I found a bug in March 2026 on a top protocol that was introduced back in June 2025. No AI found it, and I'm pretty sure the project was scanned many, many times.

You can still be very successful with AI only for now (you're living proof), but I don't think this will last...

[DadeKuma @DadeKuma]

@lonelysloth_sec They are cooked

[DadeKuma @DadeKuma]

"Non-technical teams are now shipping production code"

Next news:
Coinbase gets hacked.

[Brian Armstrong @brian_armstrong]

This is an email I sent earlier today to all employees at Coinbase:

Team,

Today I’ve made the difficult decision to reduce the size of Coinbase by ~14%. I want to walk you through why we're doing this now, what it means for those affected, and how this positions us for the future.

Why now
Two forces are converging at the same time. We need to be front footed to respond to both.

First, the market. Coinbase is well-capitalized, has diversified revenue streams, and is well-positioned to weather any storm. Crypto is also on the verge of the next wave of adoption, with stablecoins, prediction markets, tokenization, and more taking off. However, our business is still volatile from quarter to quarter. While we've managed through that cyclicality many times before and come out stronger on the other side, we’re currently in a down market and need to adjust our cost structure now so that we emerge from this period leaner, faster, and more efficient for our next phase of growth.

Second, AI is changing how we work. Over the past year, I’ve watched engineers use AI to ship in days what used to take a team weeks. Non-technical teams are now shipping production code and many of our workflows are being automated. The pace of what's possible with a small, focused team has changed dramatically, and it's accelerating every day.

All of this has led us to an inflection point, not just for Coinbase, but for every company. The biggest risk now is not taking action. We are adjusting early and deliberately to rebuild Coinbase to be lean, fast, and AI-native. We need to return to the speed and focus of our startup founding, with AI at our core.

What this means
To get there, we are not just reducing headcount and cutting costs, we’re fundamentally changing how we operate: rebuilding Coinbase as an intelligence, with humans around the edge aligning it. What does this mean in practice?

- Fewer layers, faster decisions: We are flattening our org structure to 5 layers max below CEO/COO. Layers slow things down and create coordination tax. The future is small, high context teams that can move quickly. Leaders will own much more, with as many as 15+ direct reports. Fewer layers also means a leaner cost structure that is built to perform through all market cycles.

- No pure managers: Every leader at Coinbase must also be a strong and active individual contributor. Managers should be like player-coaches, getting their hands dirty alongside their teams.

- AI-native pods: We’ll be concentrating around AI-native talent who can manage fleets of agents to drive outsized impact. We’ll also be experimenting with reduced pod sizes, including “one person teams” with engineers, designers, and product managers all in one role.

In short: AI is bringing a profound shift in how companies operate, and we’re reshaping Coinbase to lead in this new era. This is a new way of working, and we need to leverage AI across every facet of our jobs.

To those who are affected
I know there are real people behind these decisions — talented colleagues who have poured themselves into this company and our mission. To those of you who will be leaving: thank you. You’ve helped build Coinbase into what it is today, and I am sincerely grateful for everything you've done.

All impacted team members will receive an email to their personal account in the next hour with more information, and an invitation to meet with an HRBP and a senior leader in your organization. Coinbase system access has been removed today. I know this feels sudden and harsh, but it is the only responsible choice given our duty to protect customer information.

To those affected, we will be providing a comprehensive package to support you through this transition. US employees will receive a minimum of 16 weeks base pay (plus 2 weeks per year worked), their next equity vest, and 6 months of COBRA. Employees on a work visa will get extra transition support. Those outside of the US will receive similar support, based on local factors and subject to any consultation requirements.

Coinbase prides itself on talent density. Our employees are among the most talented people in the world, and I have no doubt that your skills and experience will be highly sought after as you pursue your next chapters.

How we move forward
To the team that is staying, I know this is a difficult day. We’re saying goodbye to colleagues and friends you've been in the trenches with. But here’s what I want you to know as we move forward together:

Over the past 13 years, we have weathered four crypto winters, gone public, and built the most trusted platform in our industry. We’ve made it this far by making hard decisions and by always staying focused on our mission. This time will be no different – nothing has changed about the long term outlook of our company or industry. And most importantly, our mission has never been more important for the world. Increasing economic freedom requires a new financial system, and we’re building it.

The Coinbase that emerges from this will be more capable than ever to achieve our mission.

Brian

[DadeKuma @DadeKuma]

Pro tip for the future

Never do bug bounties or audits where you will be paid with the project's own token

If there is zero or low liquidity, you are fucking cooked

[DadeKuma @DadeKuma]

@GalloDaSballo North Korean hackers don't want you to know about this one simple trick

[DadeKuma @DadeKuma]

@0xcastle_chain Thank you, mate! I appreciate what you're doing with the Solana Audit Arena. Respect! 🫡

[DadeKuma @DadeKuma]

LFG 🔥

[DadeKuma @DadeKuma]

@gjaldon Yessir! They invalidated it at first, but luckily they understood it was real 🙏 It took 1 month of back and forth.

[DadeKuma @DadeKuma]

They are all good depending on your personality and goals.

Bug Bounty: You must have very good skills, and you can handle rejection after rejection / unfair situations. Potentially it's the best ROI.

Engagements with Firms: You have freedom, but work is capped by availability and your daily rate.

Looking for full-time: I guess good stability, but hard capped earnings and limited opportunities.

Solo audits: You have to market hard. Mid-revenue, big protocols usually don't care about spending a lot, so they go directly with firms.