Kais Tlili

Web3 Security Researcher

[Kais Tlili @ktl_____]

"Since blackhats didn't have enough incentives already, we gave them the opportunity to bet on their own exploits and effectively hack protocols on leverage"

[DefiLlama.com @DefiLlama]

You can now trade protocol revenue and exploit odds. We're partnering with Trueo to launch new prediction markets that settle based on DefiLlama data.

Revenue Markets
If you follow the revenue meta, you can now trade that directly on Trueo. We launched markets for Hyperliquid, Pump, Aero, Uniswap, Collector Crypt, and Papertrade revenue.

Exploit Markets
Hedge against exploit risk by trading the odds of total DeFi hacks and exploits of specific protocols. We have markets for whether there will be exploits of Aave and Morpho this month. We also have weekly and monthly markets for the size of the largest hack.

Other Onchain Metrics
Robinhood Chain RWA mcap, Robinhood Chain DEX volume, and whether Solana or Base ends the week with higher TVL.
https://t.co/To5jNeNDDj

[Kais Tlili @ktl_____]

@0xmishoko @MartinMarchev @immunefi

[J4X @J4X_Security]

Got targeted today by what looks like a fake audit/recruitment campaign.

They opened the conversation by linking my Cantina profile and asking if I was looking for new opportunities.

At first it looked like a normal audit lead. They said they were building an RWA protocol and needed a smart contract auditor.

I asked what chain.

“EVM”

I told them I mainly audit Solana/Rust, so I probably wasn’t a good fit.

A minute later it became “actually multi-chain,” and they sent me a tech stack full of Solana/Rust, Anchor, SPL, PDA/CPI, Metaplex, etc.

They were also very pushy about getting on a call immediately, followed by NDA signing and private GitHub access.

I kept asking for the company/project details first.

Eventually they gave me https://t.co/X0wIVUL4nG.

ChainVisita has already been publicly documented in a fake developer recruitment campaign where targets were given malicious repositories that downloaded a second-stage stealer targeting browser credentials and crypto wallets.

So if you get a similar audit offer, especially one tailored around your public security profile and quickly leading to a private repo, be careful.

https://t.co/pHb9rBjQVr

[Dexerto @Dexerto]

StarCraft 3 is reportedly on the table after more than a decade

Developer Nexon is pursuing an agreement with Blizzard that would allow it to develop a sequel

[Kais Tlili @ktl_____]

@immunefi @skydev0h Congrats @skydev0h !

[Kais Tlili @ktl_____]

No, memcoins and 'speculative use cases' are not the same as gambling, the former is a game based on deception and the latter is a game known upfront, like anyone can look up the odds for roulette or blackjack on google. It's not about game theory, it's about ethics

[vibhu @vibhu]

I’ve become ultra bearish on anti-memecoin/anti-speculative-use-cases doomers (I used to be one myself)

Being a gambling doomer is low-cost status

All of finance sits somewhere on the speculation spectrum

Young people take more risk and older people take less, this is simply how human brains work

If only the lowest risk use cases but none of the highest risk use cases for digital money move onchain, it isn’t possible to win because technology revolutions are led by young people

The kids that grow up with crypto are the ones that will make it the default in society

We need to meet these young people where they are, not force upon them a vision for what we think is dignified

[Kais Tlili @ktl_____]

@adeolRxxxx Man I wish there was some app where I can just hire some nerd with legal background to argue on behalf on bbp and contests

[Kais Tlili @ktl_____]

@hrkrshnn @COLDCARDwallet It seems there is more to this than just AI: https://t.co/AXYbu0u019

[James O'Beirne @jamesob]

Very interesting. Looks like strong possibility that `switck`, the account writing the buggy libngu library that caused all this, was actually Peter Gray (@DocHex), CTO of Coinkite.

This is the same guy that shrugged off my report of the possibility of the defect in May 2025.

[James O'Beirne @jamesob]

Very interesting. Looks like strong possibility that `switck`, the account writing the buggy libngu library that caused all this, was actually Peter Gray (@DocHex), CTO of Coinkite.

This is the same guy that shrugged off my report of the possibility of the defect in May 2025.

[Kais Tlili @ktl_____]

@0xRajeev That's kinda misleading, check their github it just collects some bls signatures to agree on some state, there is no LLM on-chain

[Kais Tlili @ktl_____]

@bbl4de_xyz @AnthropicAI @OpenAI @GeminiApp Nokia

[Kais Tlili @ktl_____]

@theBliz_ @yassine3eth

[Kais Tlili @ktl_____]

@nnwakelam No you can't scale this with subagents but you can scale up with some coffee

[Kais Tlili @ktl_____]

@kamensec Congrats !

[Kais Tlili @ktl_____]

Submitting a medium after failing to escalate it to crit for days feels like confessing to a crime

[Kais Tlili @ktl_____]

@windhustler @ParlayItGG I'd bet all in on @Haxatron1

[Kais Tlili @ktl_____]

@joxegr @infosec_us_team For the delivery, mail is my preferred but I'm old school I guess, I bet many whitehats would appreciate webhooks for their automated flows