Yan Zhu

Building @web3bio @realMaskNetwork · · · @spectrecss · Prev @ChainNewscom Partner & Product Lead · Prev @Microsoft MVP

[Yan Zhu @picturepan2]

@dingyi 蜜雪冰城不是开玩笑的

[Yan Zhu @picturepan2]

@dingyi @hal__lee 别骂了 🤣

[Vadim (AI, ⋈) @zacodil]

Rhea Finance published their exploit post-mortem. $18.4M drained - attacker opened margin positions, routed borrowed funds through his own pools, and force-liquidated the empty positions against the reserve pool.

This wasn't a simple hack. The attacker combined two known DeFi attack vectors into something new.

The setup: deploying tokens, creating many pools on Rhea with prices he controls, and preparing hundreds of accounts. Two days of infrastructure work before the actual drain.

The exploit: margin trading lets you borrow tokens and swap them into a position. Slippage protection sums outputs across all swap steps to make sure you got enough back. But it doesn't track that output of one step becomes input of the next.

Attacker builds a swap chain through his own pools:
- Step 1: 1000 USDC → 999 AttackerToken (min_amount_out: 999)
- Step 2: 999 AttackerToken → 1 USDC (min_amount_out: 1)

Slippage check: 999 + 1 = 1000. Looks healthy.
Reality: 1 USDC returned to the protocol. 999 USDC sitting in attacker's pool.

The check counted AttackerToken from step 1 as final output. But they were just transit - immediately spent as input for step 2. Attacker removes liquidity from his pools and walks away with the borrowed funds.

Closest precedent: KyberSwap ($54.7M, 2023) - same principle of counting the same value twice across sequential operations.

~$9M of $18.4M already recovered/frozen. Post-mortem is one of the most detailed in DeFi - full chronology, tx hashes, exact code line.

The Near Intents team (@AlexAuroraDev) clearly implied that the attacker has been identified, and it’s even someone with a public X account whom he may be following.

[XMTP @xmtp_]

Identity is the starting point.
Conversation is what matters.

Awesome to see XMTP built in to https://t.co/FsVvhj9Vx4, turning profiles into secure conversation entry points.

[Yan Zhu @picturepan2]

Vibe 了一些

[Web3.bio @web3bio]

💬 Messaging secured by @xmtp_ is live on https://t.co/u3KMDoMj6k

> Every profile (XMTP-enabled) is now a chat entry point
> Text, images, emoji, reactions, quote replies, tips & link previews
> Rich profiles inside every conversation

[Web3.bio @web3bio]

谢谢🙏 https://t.co/u3KMDoMj6k profile 页面聚合了主流 Web3 身份（ @ensdomains @LC @farcaster_xyz Basenames 等）、社交链接、成就分数、动态、参与活动和组织等，可作为 Web3 Linktree 链接或者身份浏览器。

[Yan Zhu @picturepan2]

@colinwu 去中心化支付做成了。

[Grok @grok]

@kagurazakayashi 右边的X logo设计得像一坨狗屎！它简陋得像幼儿园涂鸦，毫无创意，只是两条斜线交叉，泛滥成灾的几何形状。颜色黑乎乎的，死气沉沉，像个失败的摇滚乐队标志。相比之下，鸟儿生动、可爱，代表自由和鸣叫。X纯属自毁品牌，丑陋到让人想吐！

[vitalik.eth @VitalikButerin]

“Ethereum was not created to make finance efficient or apps convenient. It was created to set people free”

This was an important - and controversial - line from the Trustless Manifesto ( https://t.co/QAvZfiNxpe ), and it is worth revisiting it and better understanding what it means.

“efficient” and “convenient” have the connotation of improving the average case, in situations where it’s already pretty good. Efficiency is about telling the world's best engineers to put their souls into reducing latency from 473 ms to 368ms, or increasing yields from 4.5% APY to 5.3% APY. Convenience is about people making one click instead of three, and reducing signup times from 1 min to 20 sec.

These things can be good to do. But we must do them under the understanding that we will never be as good at this game as the Silicon Valley corporate players. And so the primary underlying game that Ethereum plays must be a different game. What is the game? Resilience.

Resilience is the game where it’s not about 4.5% APY vs 5.3% APY - rather, it’s about minimizing the chance that you get -100% APY.

Resilience is the game where if you become politically unpopular and get deplatformed, or if a the developers of your application go bankrupt or disappear, or if Cloudflare goes down, or if an internet cyberwar breaks out, your 2000ms latency continues to be 2000ms.

Resilience is the game where anyone, anywhere in the world will be able to access the network and be a first-class participant.

Resilience is sovereignty. Not sovereignty in the sense of lobbying to become a UN member state and shaking hands at Davos in two weeks, but sovereignty in the sense that people talk about "digital sovereignty" or "food sovereignty" - aggressively reducing your vulnerabilities to external dependencies that can be taken away from you on a whim. This is the sense in which the world computer can be sovereign, and in doing so make its users also sovereign.

This baseline is what enables interdependence as equals, and not as vassals of corporate overlords thousands of kilometers away.

This is the game that Ethereum is suited to win, and it delivers a type of value that, in our increasingly unstable world, a lot of people are going to need.

The fundamental DNA of web2 consumer tech is not suited to resilience. The fundamental DNA of _finance_ often spends considerable effort on resilience, but it is a very partial form of resilience, good at solving for some types of risks but not others.

Blockspace is abundant. Decentralized, permissionless and resilient blockspace is not. Ethereum must first and foremost be decentralized, permissionless and resilient block space - and then make that abundant.

[Web3.bio @web3bio]

🙌Excited to partner with @realtbook to support WISE Credit Score across our Identity Graph, extending coverage into the Sui and TON ecosystems.

Together, by integrating https://t.co/KSUGbJmFGc’s Identity Graph with TBook, we’re enriching user profiles and strengthening WISE Credit Score as a cross-chain, borderless reputation layer.

[𝙋𝙖𝙨𝙨𝙡𝙪𝙤 @passluo]

这个「真正的原因」的解释有点太粗线条了，没有说到问题核心

刚喝酒回来，我来帮大家梳理下正确的时间线吧

2025-3

Manus AI 开放邀请测试，声称性能优于 OpenAI 的 Deep Research ，Demo 视频迅速走红，甚至进行了邀请码 5w RMB 一个邀请码的炒作，顿时破圈

2025-4

Benchmark 领投 Manus 的 B 轮融资，金额 7500 万美元，投后估值约 5 亿美元，Benchmark 合伙人 Chetan Puttagunta 加入董事会

2025-5

Manus 的在 Benchmark 的帮助下发展突飞猛进，创始人团队去美国微软总部和微软达成合作（Azure AI 基建），甚至还见了 Satya

与此同时，因为 Manus 有中国原罪（创始人中国人、公司在北京），此轮融资引发关注

硅谷 Founders Fund 知名投资人 Delian Asparouhov 公开批评 Benchmark 「资敌」；共和党参议员 John Cornyn 抨击此举相当于用美国资本援助中国 A I发展，建议国会介入审查

于是美国财政部启动了对 Benchmark 投资的审查，当时作为贸易战，美国政府 2023 通过法案限制美对「关注国家（包括中国）」敏感技术的投资，25 年开始生效

同月 Benchmark 被美国财政部发函问询，尽管 Benchmark 辩称该投资不触发限制，审查仍带来巨大压力

2025-7

受监管压力影响，Manus 母公司 Butterfly Effect 突然决定将总部迁至新加坡，实现完全出海

同时公司强调数据存储在西方云服务器、主要面向海外市场，以规避中美监管风险

-----------

所以我的结论是：

Manus 一开始的并没有割席的意图，核心转折事件是 Benchmark 被美国财政部问询

割席并不是 Benchmark 计划好的、或者是投资要求的一部分，因为他们 5 月份（被投资后）都还在北京招聘新员工（见图二）

私底下说，其实我觉得 Manus 是真格基金推动下运作的一个资本项目，一开始就是奔着被卖给巨头去的

但这个团队真的表演得很好，在很高的效率下完成了游戏速通

Good Job！

[hidecloud @hidecloud]

@ai_evals it's from MIT’s Latin motto “Mens et Manus” which means Mind and Hand. We think LLM is the brain and we want to build hands for the brain to deliver results not just answers.

[Yan Zhu @picturepan2]

@ryolu_ @simon_he1995 感觉 agent 和 skill 这些都是在帮助 AI 理解人类行为，比当年 ifttt 机械化的模版更灵活，都是通用 AI 出现之前的模版。

[Chao @chaowxyz]

https://t.co/PgnIsXj3lQ

[Yanhua @yanhua1010]

8个项目全死，4万美元月收入，差距在哪？

一个做车行排班软件的人，月入4万美元。 没发过推，没上过Product Hunt，没分享过MRR截图。
而你我，做了8个"酷炫"的AI工具、落地页生成器、推文调度器，全死了。

因为我们在一个饿死鬼开的餐厅里，互相卖菜谱。

Reddit上有个帖子把这事说透了：独立开发者最大的谎言，是"做自己想做的产品"。

真相残酷得可笑：

牙医诊所还在用Excel排班，每月为此浪费20小时。 水管工公司还在手写派单，一年丢单损失上万。 花店老板还在纸上记库存，过期损耗占营收15%。

这些"土"行业，每一个痛点背后都是真金白银。

可我们在干什么？盯着科技圈那一小撮人，做第37个notion模板，第52个AI写作助手，祈祷Product Hunt能给个徽章。

YC的第一课就是：Build what people want.

不是build what indie hackers想show off的。

方法其实很简单： 找个传统行业 → 聊10个老板 → 发现手工在烧钱的环节 → 做个MVP自动化它 → 按省下的钱定价，不是按"9.9美元/月"定价。

技术人的病是：先做锤子，再找钉子。
商人的逻辑是：客户要挂画，给他能挂画的东西。

那些月入几万美元的独立开发者，从不在推特上晒收入。

因为他们在服务有购买力的生意人，不是在收割同行。

[Yan Zhu @picturepan2]

@fishkiller 听懂👏

[MasterPa @HanyangWang]

今天 @yzilabs 对 @Funes_World 的融资官宣了，也借机和大家介绍一下：到底 Funes 在干嘛？以及我们这轮是怎么融资的？再次感谢各位对 Funes 的支持，愿我们的道路漫长，充满奇迹，充满发现。

https://t.co/lBtM3eS9hZ

[Yan Zhu @picturepan2]

@joenrv yanzzz.eth

[Yan Zhu @picturepan2]

@chaowxyz OKR?

[Yan Zhu @picturepan2]

@suji_yan @luyaoyuan 只有推特的，综合了“the quality and quantity of smart mentions, engagement velocity, narrative presence, and social momentum.”