Jack Xu

CTO: Chief TheFinals Officer @Sign

[Jack Xu @headcpx]

Our LZ receiving libraries have been pinned. Thanks for the heads up @EbisuEthan. Also, the same pinning should be done for every network that the OFT supports, not just Ethereum.

Lost aura, gained security, A-OK.

Updated our tooling to detect pinning. https://t.co/vR1AJq3zdD

[banteg @banteg]

layerzero solosig dependency check in

if you haven't hardened your config, you are sitting on an unnecessary dependency on layerzero 3/5 solosig.

if it gets compromised, it could instantly drain all the adapters that rely on the default receive library. after the kelp exploit, the vulnerable adapters tallied to $3.13 billion. after some outreach, the number has dropped to $178 million.

good progress, but still not enough. there is still a long tail of projects that have ignored this advice.

i will make this simple for you. here is a full list with exact calls for how to pin the default library.

https://t.co/diEyhgheRB

[Sign @Sign]

https://t.co/4IKLF9J8rL

[Michael Saylor @saylor]

#Bitcoin days are numbered. It seems like just a matter of time before it suffers the same fate as online gambling.

[Jack Xu @headcpx]

Today, we are open-sourcing a toolkit ported in Go that parses and writes SWIFT MT messages as a part of our ongoing CBDC work.

Aside from being used for international wire transfers, the MT format is also core to certain RTGS systems in central banks.

https://t.co/m3z73699Q4

[Jack Xu @headcpx]

Yes, $SIGN also uses LayerZero. Our old setup was 2/2 required DVNs across all supported networks. It has since been bumped to 2/2 required + 2/3 optional.

[Jack Xu @headcpx]

In light of recent events, we are open-sourcing a local web tool that helps projects easily manage their LayerZero OFT wiring configurations, when the OFT delegate is a Safe multisig.

Configurations can be imported or exported as JSONs for convenience.

https://t.co/vR1AJq3zdD

[Talfao @talfao1]

This weekend KelpDao lost $292M. @LayerZero_Core just published their incident report.

The protocol worked as designed. The smart contracts were fine. The money left through an RPC poisoning attack on a single-DVN configuration that multiple parties had warned against.

A thread on what this teaches us about every attack surface. 🧵

[Kraken Listings @krakenlistings]

Now live: $SIGN

@Sign empowers nations to adopt blockchain and unlock crypto for all.

Start trading today → https://t.co/fGblMQzwuo

[Jack Xu @headcpx]

@realyanxin Yeah, this was built to deploy our own HL spot token. It’s a fair bit more complicated than their documented deployment due to the token being bridged, EVM decimal vs. HL decimal mismatch, etc..

[Jack Xu @headcpx]

It's open-sourcing time.

This week, we are dropping a web tool that helps projects deploy tokens to Hyperliquid spot (progress detection, error handling, etc.), as HL's existing UI omits advanced configuration options only accessible through their API.

https://t.co/Sa06fvgb0o

[Sign @Sign]

https://t.co/pVwPCq2Pkj

[Coinbase Markets 🛡️ @CoinbaseMarkets]

Spot trading for Checkmate (CHECK) and Sign (SIGN) will go live on 2 April 2026. The opening of our CHECK-USD and SIGN-USD trading pairs will begin on or after 9AM PT, if liquidity conditions are met, in regions where trading is supported.

[Xin @realyanxin]

https://t.co/EF6cdabPxl

[Jack Xu @headcpx]

We are open-sourcing 4 more repositories this week covering EVM and Solana. Built by Sign, now released to our community.

🧵👇

[Jack Xu @headcpx]

event-pattern-solana: A minimal Anchor program demonstrating an event-driven instruction pattern on Solana. https://t.co/Qj3HtAaYXP