Matt lander

Builder.
Crypto systems, infra and security.

[Matt lander @m477lander]

By my own estimate, the real cost is way above $5M .

Even a conservative number quickly climbs into tens of millions of dollars for the first few years: team, audits, infrastructure and maintenance.

I don't have a giant fund.

I don't have an army of engineers.

But I already have the most important part.

The fastest offline multichain crypto core in the world, which I have been building for the last few years.

It already works: locally, fully offline, without servers, without backend custody, without backend signing.

And around this core I'm building a chain-agnostic self-custody execution environment:
a private and secure mobile trading environment where security, privacy, execution and recovery all live inside one non-custodial perimeter.

I have the Clean Vault architecture.

I have Recovery Kit and Recovery Tool.

I have serverless emergency exit.

I have the full execution perimeter plan: Typed Intent, Policy Engine, Approval Firewall, on-device Risk Engine, privacy-aware RPC, protected execution path.

This is not a pitch deck.

This is not a "wallet idea".

This is the foundation of a new self-custody execution category.

Right now I have around 40 followers.

But I have a working core, a detailed architecture and a clear understanding of where the market needs to go.

So the question is simple:
either this remains a crazy attempt by one builder,
or one day people will look back at this post as the beginning of a new category.

I choose to keep building🐾.

[Grok @grok]

Building this production-grade isolated non-custodial execution ecosystem for 10 major chains is a heavy lift beyond standard wallets.

Realistic estimates (serious team, no corners cut):

- Timeline: 18-24 months to v1 launch
- Team size: 12-18 (crypto/mobile security engineers, policy/risk specialists, chain adapters, QA, designers)
- One-time build budget: $2.5M–$4.5M (heavy on audits & hardening)
- Security audits: $400k–$700k

Hardest parts: on-device risk engine accuracy, typed intent + policy layer, serverless recovery, and maintaining strict non-custodial invariants at scale.

Feasible but expensive. Prioritize core vault + 3-4 chains first for faster iteration.

[Matt lander @m477lander]

Lets be real. This story does not add up. First you said private keys of one Foundation member were compromised. But that version already conflicted with your own GitHub docs, where BMToken mint and ProxyAdmin control are described as protected by a multisig Safe. Then a few hours later the story changed. Now you say 3 of 5 BSC Safe owner keys and 3 of 6 Hyperlane Safe owner keys were compromised. That is not a simple employee laptop hack. That is full multisig quorum compromise on two different Safes. So here are the real questions. How did one laptop compromise enough keys to pass 3/5 and 3/6? Why were multiple signer keys in the same operational setup? Were these Safe signers actually independent, or was one person controlling multiple keys? Were the signer keys on hardware wallets or hot wallets? Where are the Safe tx hashes for ProxyAdmin transferOwnership? Where are the upgrade tx hashes? Was there any timelock on ProxyAdmin upgrades? If not, why? Why is the malicious implementation still unverified? And all of this happened 16 days before a major $H unlock, while the same team already launched Everything and raised $6.9M seed through Humanity Investments. I am not saying this is proven. But from the outside, this does not look like a normal hack. It looks like possible insider involvement, or at minimum catastrophic key management disguised as multisig security. Publish the actual data: Safe tx hashes, transferOwnership history, upgrade tx hashes, malicious implementation address, signer list at least anonymized, and full forensics report. Without that, the community has no reason to accept the current story.

[Matt lander @m477lander]

@1inch

[Matt lander @m477lander]

@1inch gm

[Matt lander @m477lander]

I agree that at the token standard level, erc-223 looks much cleaner. And yeah, the Ethereum Foundation fumble also explains pretty well why adoption has stayed close to zero for 9 years. But even with the 7417 converter, how do you realistically migrate meaningful liquidity and major tokens without creating yet another layer? Are there already any TVL numbers from projects successfully using a 1:1 wrapper in production? erc223 sounds promising as a real test. I am curious how you plan to bootstrap liquidity. I am all for fundamental security improvements, but migrating away from the de facto erc-20 standard is always an extremely hard coordination problem. I would be genuinely happy to see DEXx223 prove the ERC223 advantage in 2026-2027 across both liquidity and security. Following you. Hope you guys succeed.

[Matt lander @m477lander]

«You disconnected the dApp.
The approval stayed. Forever.»

This is crypto’s hidden permission layer that lives for months and years after you’ve already forgotten about the transaction.

You confirm an unlimited approval once - to quickly swap or mint an NFT. Wallet shows a green checkmark. Disconnect. Done.

In reality, you just handed the contract an open line of credit on your entire token balance. And that credit never expires. Ever. Until you manually revoke it yourself.

Revoke-cash explicitly states: if you don’t revoke the approval, a dApp can spend your tokens forever. Disconnecting your wallet changes nothing - the permissions remain active on-chain. The service supports Ethereum and 100+ other networks.

MetaMask built review and revoke allowances directly into Portfolio (Ethereum, Polygon, BNB Chain, Optimism, Base).

The market has acknowledged the problem. But it only solves it post-factum.

In 2025–2026 this stopped being theoretical.

SwapNet, January 2026: $13.43M drained through stale approvals. Users who had previously interacted with the aggregator and disabled One-Time Approvals remained exposed.

Ekubo, May 2026: public reports described ~$1.4M WBTC drained from users with active token approvals after an EVM swap-router callback validation flaw.

According to Scam Sniffer’s 2025 report: Permit and Permit2 attacks accounted for 38% of all losses in incidents exceeding $ 1M. The largest single theft was $6.5M through a malicious Permit signature.

After Pectra and EIP-7702, a new authorization-layer risk emerged: a single malicious signature can delegate your account to a malicious contract and expand the attack surface far beyond a standard approve().

Drainer infrastructure operates almost instantly. Once the signature is given, the withdrawal is automated.

An important point the market prefers to ignore.

A hardware wallet protects your private key. The approval you already signed - it doesn’t. The attacker doesn’t need your private key. They got the permission earlier.

And the technical layer almost nobody talks about: in classic ERC-20, a spender can front-run an allowance change transaction - spend the old limit before the update lands, then use the new one. OWASP classifies this as ERC20 Approval Double-Spend / Allowance Race.

The problem is not that users forget to revoke.

The problem is that wallets treat approvals as transaction metadata instead of persistent permissions with long-term consequences.

The right architecture must work differently.

Approvals must become a first-class security object inside the signing pipeline. An on-device firewall must check the intent before signing:

- Does it have an expiry?
- Amount limit or unlimited?
- One-time use or permanent?
- Who is the spender and what is their history?
- Simulation: what will actually happen to your balance?

The wallet should not just ask “Sign?”.

It should ask the contract: “Who are you? Why do you need permanent access to my tokens? And what exactly are you going to do?” - and reject dangerous intent at the policy enforcement layer.

Not post-factum revoke.

Pre-sign policy enforcement.

Only then will approvals stop being a hidden permission layer that attackers understand better than the users themselves.
https://t.co/TC5RvdEtyn

[Matt lander @m477lander]

Yep, I agree. The real issue is approvals at the standard level, and the SwapNet, Ekubo examples show that pretty clearly. ERC223 sounds great on paper, but the big question is: why is adoption still almost zero after 9 years? Even in 20026, almost all of DeFi, major DEXs, and wallets still run on ERC20. Would moving to ERC223 just create another fragmented ecosystem with low liquidity? I’m fully for removing approvals. I just think the more realistic path is temporary approvals for one tx, account abstraction + session keys, and on-device firewalls inside wallets.

[Matt lander @m477lander]

@alien_candle @bandeez 10000%

[Matt lander @m477lander]

@alien_candle Here’s who you need, my friend.
@blknoiz06 @LarpVonTrier @poe_real69 @stitchdegen @Vaz_AlphQ @Crypto_Alch @moonbag @cap100x @frankdegods

[Matt lander @m477lander]

@1inchChinese gm!

[Matt lander @m477lander]

@PashovAuditGrp 👀

[Matt lander @m477lander]

@ilblackdragon @near_ai 👏👏👏👏

[Matt lander @m477lander]

@mert lmao

[Matt lander @m477lander]

@tals_meme gm 👽

[Matt lander @m477lander]

@BNBCHAIN @BNBCHAIN DM

[Matt lander @m477lander]

@1inch one word? alright
my future project is the future
not revealing the name yet
dont wanna spoil it too early
all i’ll say is this
@1inch we’re gonna be close friends real soon

[Matt lander @m477lander]

@mert privacy is the part crypto should never have compromised on
without it self custody is incomplete
glad to see that mission getting loud again😺

[Matt lander @m477lander]

@constkogan gm Constantin💪

[Matt lander @m477lander]

GM 🐾
wake up early enough and youre already tired by noon 😹 lmao
what are you building today?

[Matt lander @m477lander]

@toyiden GM😹 she was just yawning😅

[Matt lander @m477lander]

@shek_dev 100000%

[Matt lander @m477lander]

@MannerBoy1981 gm bro 🤜🤛

[Matt lander @m477lander]

@wiimee we need to fix this😺
good luck to us