Sam Friedman

“I am putting myself to the fullest possible use, which is all I think that any conscious entity can ever hope to do.” I work at Hypernative. Opinions my own.

[Hypernative @HypernativeLabs]

KPK’s agents acted within seconds of an alert, from Morpho exits to Gearbox pauses. This is what Hypernative is built for: giving teams the real-time signal to take whatever action they need, when it matters. We're very happy to be part of @kpk_io's stack and play our part in a positive result.🤝

[KPK @kpk_io]

Security is hard to prove in advance.

When the largest crypto hack hit @binance last week, KPK’s automation stack fired exit transactions seconds after its @HypernativeLabs alerts triggered

Deep dive into what happened and how KPK compared with other curators

[Sam Friedman @proof_of_sam]

Sunday at the Village Vanguard is from the same sessions/engagement. It is arguably my favorite album of all time. I think it has a better selection of songs, maybe because it highlights great performances by Scott Le Faro who died a few days after the sessions.
IIRC, Paul Motion was unhappy about Bill’s heroine energy here.

[Hypernative @HypernativeLabs]

The Binance breach is the largest crypto theft on record, with $6.3B drained from hot wallets in under an hour. The loss raises a critical question for any organization managing digital assets: what stops your systems from signing a malicious request?

Our review covers what happened, how the attack worked, and what it means for teams across the industry.

Read it here → https://t.co/tLtgafVAhF

Dan Caspi walks through the attack live on Wednesday 4 November, 10am ET / 3pm GMT → https://t.co/WtLzCtGyDo

[Sam Friedman @proof_of_sam]

I am going to Inside the Binance Hack And What’s Really Happening in Onchain Security Right Now. Join me! https://t.co/ifF2yb7Opd via @LumaHQ

[Hypernative @HypernativeLabs]

Onchain data now confirms Binance hot wallets were drained. Here's what we know so far:

→ From about 20:10 UTC, Binance hot wallets on Ethereum, Arbitrum, Optimism, Base, Solana and Bitcoin, and likely Tron and Avalanche, sent funds to fresh attacker addresses.
→ Losses are $3.6B+, with public estimates up to ~$5.8B.
→ Every outflow was authorized with the hot wallets' own keys . How the attacker got signing access is not yet known.
→ On Ethereum, Binance 14 was taken over with EIP-7702 and is still delegated to the attacker's contract.
→ Tether and Circle have frozen part of the stolen USDT and USDC. ETH, SOL, BTC and most other tokens can't be frozen and some are already moving.

Timeline (UTC)
1️⃣ 02:28: The attacker deploys a test version of a drainer contract.
2️⃣ 15:59: The drainer contract goes live. Only the attacker can call it.
3️⃣ ~20:10: Binance hot wallets begin sending funds to attacker addresses.
4️⃣ 20:20: One transaction carrying 50 pre-signed authorizations from Binance 14 delegates the wallet to the drainer contract.
5️⃣ 20:24: A single call sweeps ~167K ETH and ~64 tokens from Binance 14.
6️⃣ 20:41 and 20:59: The same delegation is used to move ~$823M USDC out of another Binance contract.
7️⃣ 21:04: Binance 14 is swept again.
8️⃣ Since then: USDT was swapped to ETH ahead of the freezes, and BTC is being split into 1,000 BTC chunks.

What to do
→ Keep exposure to Binance reduced until Binance confirms its hot wallets are secure.
→ Do not send funds to Binance 14 (0x28c6c06298d514db089934071355e5743bf21d60). It is still delegated to the attacker's contract, so anything that arrives there can be swept.
→ Exchanges, OTC desks, bridges and other venues taking deposits: screen and block inbound funds from the attacker address (0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c).

[Sam Friedman @proof_of_sam]

Computer, Tea, Earl Grey, Hot.

[Ron Bodkin @ronbodkin]

The Claude Code team shared their approach to code reviews. They keep architecture and direction as human decisions.

Yet they ask “If machines do most of the reading, how does anyone learn the code?” and answer “We don’t have a formal process for this. Nobody on the team keeps a complete mental model of Claude Code in their head, and we don’t think anyone needs to.” (1/5)

[Defi Security Summit @summit_defi]

Meet DSS 2026 speaker Akand Sitra.

“Web3 Security - Real-Time Monitoring”

Open a talk and save it to your agenda.
https://t.co/nQwGo2Pc7N

Tickets: https://t.co/RTbPxGH7zF

[Hypernative @HypernativeLabs]

Post-fact alerts are cheap. Prevention is hard because automated action needs high conviction and low noise. Hypernative keeps adding public, verifiable cases of it working. Latest: Kodiak’s automated pause stopped an exploit on BeraFarm that could have cost $250K+. Zero funds lost.

[Kodiak @KodiakFi]

On Oct 9, 2026, Kodiak's real-time security monitoring (powered by @HypernativeLabs) detected a malicious contract targeting a vulnerability in an external vault provider's contracts that interacted with Kodiak Islands. NO FUNDS WERE LOST.

As designed, our pre-configured automated response with Hypernative paused all Kodiak Islands within seconds, before the attacker could execute the exploit. The pause closed the route the exploit needed and stopped an attack on an external ecosystem protocol, BeraFarm.

No Kodiak user funds were lost or extractable. The simulation estimated a loss of at least $250K had the exploit succeeded.

Read more about how Kodiak and its ecosystem partners are secured with Hypernative's real-time security: https://t.co/p25hDAxjGL

[koeppelmann @koeppelmann]

I hate this so much. The top Google result (an ad) leads to a well-made scam version of @safe. Given how often legitimate crypto projects get suspended from ad programs, fkn @Google still happily sells its top spot to scammers after all these years.

[Sam Friedman @proof_of_sam]

I'm happy to see good projects taking advantage of the Ethereum Security Subsidy Program. Please apply if you're securing your protocol and following Ethereum CROPS guidelines.

[Findlay @0xboo]

1/ Cohorts IV & V are officially locked in to the @ethereum Security Subsidy Program. Join us in welcoming these stellar teams!

Cohort VI will be our final cohort of the pilot, so get your applications in ahead of the Oct 14th deadline for your chance at subsidized security services from industry-leading providers.

Big thanks, as always, to our expert committee from @ethereumfndn, @nethermind, and @chainlinklabs.

[ZachXBT @zachxbt]

1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group.

Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain.

[Nate Holiday @nateholiday]

We are hiring!

https://t.co/fFnCvTtPSt

[Sam Friedman @proof_of_sam]

@catdaly Papago app for live Korean translations image/text/voice is super useful

[Sam Friedman @proof_of_sam]

@DevDacian @cyfrin Congratulations!

[Bill Lee @billtlee]

Claw machines funded the pipeline for the robot fleet

That's the part everyone skips when they talk about rwa. You don't start with the capital-intensive thing. You start with something cheap that prints cash on day one, a $1k machine in a mall, and prove the underwriting model works before you move to $50k robots.

The same operator math applies. The same verification layer. The coin box data feeds the same model that will underwrite a robot arm.

We earned it with claw machines.

[Hypernative @HypernativeLabs]

Bitget's own wallets signed away ~$387M. No private key was stolen.

We rebuilt the drain onchain: ~$290M left in 24 seconds of signing, with Bitget's own fee settings on every EVM chain.

The gas limit gave the attacker away.

Full analysis: https://t.co/ctolGwDREL

[ibu @ibuprod]

I'm throwing NYC's first @XMoney event

"FINANCIAL DDOS" NYC MEETUP

@XMoney x @UsePaid x $e/acc

🕑 Sep. 27th, 2 - 5 pm
📍Corgi Cafe. 27th Street, NYC

Come meet other e/accs, founders, investors, and traders. Learn about the new meta.

Link in comments below.