Daniele

Building @Immunefi Studio.

On a mission to 10x hunting productivity & impact.

[Daniele @danielem33]

Since August, here's how the beta researchers who checked most of their reports with Studio Review did against comparable researchers:

- Their valid rate was 2.5x higher.
- Their reports were closed as duplicates 63% less often.

This is exactly why we built Studio: fewer reports thrown away, more that count.

[Daniele @danielem33]

Exciting weeks ahead on @immunefi

[Immunefi @immunefi]

The @plether_fi audit competition launches in less than 3 days.

💰 $80,000 reward pool

📅 Runs Nov 2 – Nov 15.

Open to all registered researchers who meet the eligibility rules.

Program details, and when it goes live: https://t.co/tdOFwkUqnZ

[Daniele @danielem33]

@_0xarno_ @immunefi Well done ser!

[Immunefi @immunefi]

PARENTS: Please check your kids’ candy this Halloween! I just found an unaudited smart contract in my son's Snickers bar.

Absolutely sickening.

Be safe 🎃

[Mitchell Amador @MitchellAmador]

How many times have I warned Binance that they need to do more?

So many times.

We will do what we can to help them regardless.

[Immunefi @immunefi]

September was the worst month of 2026 for crypto hacks: $742.5M lost across 35 incidents, per @DefiLlama

Two incidents accounted for 95% of those losses. Bitget lost about $388M due to stolen credentials, while Liquid Network lost about 4,000 BTC through a flaw in its node software (3,400 BTC was later returned).

Meanwhile, in September, protocols on @immunefi paid $801,562 to researchers who found critical bugs.

Our breakdown of the month and the year so far: https://t.co/YmkvSia8rl

[Yassine @yassine3eth]

Proxy upgrade in a live bounty program

@Lombard_Finance (Ethereum)
4 proxies upgraded, including the LBTC token (5 hours ago)
Tx: https://t.co/myvoMoiiH8

Scope and rewards: https://t.co/P0MQTD4nJ7

[Daniele @danielem33]

@Cryptor256 Hey @Cryptor256 , the team is looking into this matter.

We expect to push a program update shortly.

[Daniele @danielem33]

@Piki_eth Hey @Piki_eth , the team is looking into this matter.

We expect to push a program update shortly.

[Immunefi @immunefi]

34 researchers have now earned $1M+ in bug bounties on @immunefi

4 of them crossed the mark in 2026 alone, and another is $82K away from becoming a millionaire.

There’s more than one way to get there. 7 reached seven figures with a single report. Another got there with 106 reports.

The best security researchers go where serious money is on the table. When a single critical finding can pay five, six or even seven figures, the people capable of finding those bugs keep showing up and keep looking. That’s the pool of talent a protocol taps into the moment it launches a bug bounty.

It keeps researchers looking after launch, through every upgrade and integration, for as long as the program runs.

Every payout rewarded a verified vulnerability sent to the protocol team - never an attacker.

[Daniele @danielem33]

New day, new crit paid 🔥

[0xb0k0 @bo4ka7a]

I just found a confirmed bug on @immunefi #immunefitribe https://t.co/hyfsjXsAzj

[Daniele @danielem33]

@bo4ka7a @immunefi Well done ser! 🔥🔥🔥

[Daniele @danielem33]

@0xpiramide @immunefi Well done!

[Immunefi @immunefi]

This security researcher just earned $15,000 for a critical bug in a blockchain/DLT project.

This bring his total earnings to $133,126 🔥

He’s submitted 8 paid bug bounty reports so far:
✦ 1 critical
✦ 3 high
✦ 4 medium

Over the last 90 days he ranks 33rd on the leaderboard.

Researchers have now been paid nearly $145M on @Immunefi across 10,173 paid reports.

Each payout like this one is for a bug that got fixed before anyone could exploit it.

[Daniele @danielem33]

@demicannon001 @immunefi Well done!

[Immunefi @immunefi]

In August, @ensdomains handed 137,845 lines of code and a $70,000 USDC reward pool to security researchers on @immunefi and asked them to break its new Manager and Explorer apps. They found 23 unique critical vulnerabilities.

Smart contracts aren’t the only place users lose funds. The app that builds a transaction can put users at risk just as easily.

Over four weeks, 186 researchers submitted 538 confirmed reports.

Those reports resolved into 74 unique vulnerabilities:
✦ 23 critical
✦ 15 high
✦ 22 medium
✦ 14 low
✦ plus 14 insights

43 researchers found at least one unique bug, and more than 90 found the same one independently.

The critical findings unlocked the full $70,000 pool, and every one of the 74 vulnerabilities was found before the apps reached users.

Shipping a new app? Put it in front of hundreds of security researchers before it goes live. Link below

[Immunefi @immunefi]

On Sept 24, someone stole $1.92M from a protocol by forging a zero-knowledge proof.

Here's how Payy Network's bridge got drained.

Payy is a privacy-focused stablecoin network built as a ZK rollup on Ethereum. USDC deposits sit in a bridge contract on L1. On Payy, balances are private notes, and transactions publish only note commitments.

A withdrawal to Ethereum is a "burn." The circuit enforces that input value equals output value plus the withdrawal amount.

Payy's node verifies each transaction proof, aggregation circuits re-verify them recursively, and the final proof is posted to the bridge via verifyRollup. The contract pays out the burns.

No layer can see note values, so none can redo the balance check. Every layer trusts the proof below it.

That only holds if the verifier is sound: it must never accept a proof of a false statement.

The attacker submitted a 1,828,589 USDC burn backed by four empty padding notes. No value behind it.

Payy's circuit rejects that transaction when run directly. But the forged proof passed the verifier, the aggregation layer re-checked it with the same verifier, and the bridge paid out. Two more forged burns followed, bringing the total to $1.92M across three fraudulent withdrawals and two Ethereum settlements.

Payy's postmortem points to a soundness bug in Barretenberg, Aztec's proving backend for Noir, in its small-subgroup IPA check.

The prover commits to a running sum that should start at zero and end at the claimed total. The "starts at zero" constraint was merged with the first-step constraint into one equation.

The flaw allowed a malicious prover to offset the starting value, cancel the error in the first step, and manipulate the claimed total. Payy's postmortem identifies this as the likely cause, although the exact method used to forge the attacker's proof remains unconfirmed.

Aztec committed the fix on May 14 and released it on July 13. Payy was still running an October 2025 build when the attack happened, 73 days after the patched version was released.

Remember your attack surface includes code you didn't write, and it keeps changing after your audit is done. An audit examines a system at a point in time. It doesn't automatically protect you when vulnerabilities are discovered in dependencies months later.

Continuous security means someone is always looking: at your contracts, your dependencies, and the gap between them. And getting paid to tell you.

[Yassine @yassine3eth]

Proxy upgrade in a live bounty program

@moneyonchainok (Rootstock)
1 proxy upgraded (6 days ago)
Tx: https://t.co/GDoFLwCxnk

Scope and rewards: https://t.co/nq1qnYYC94

[Yassine @yassine3eth]

Proxy upgrade in a live bounty program

@ParallelMoney (Ethereum, Base, HyperEVM)
1 diamond proxy changed its facets on 3 chains (5 days ago)
Tx: https://t.co/Qi6GJf04Do

Scope and rewards: https://t.co/ZrkP9OWD0Q

[Yassine @yassine3eth]

Proxy upgrade in a live bounty program

@maplefinance (Ethereum)
2 proxies upgraded (1 day ago)
Tx: https://t.co/Cfkys0luOF

Scope and rewards: https://t.co/99W8X09nrI

[Immunefi @immunefi]

Security team @bluethroat_labs just earned a whopping $50,000 bounty for finding a critical vulnerability!

In just four months, they've submitted 19 reports that have been confirmed, with 3 already paid and 16 awaiting payment.

They're now ranked #17 on the 90-day @Immunefi leaderboard.

With 16 confirmed reports still awaiting payment, we could see them climb even higher once those rewards come in.

Great work, @bluethroat_labs! 🚀