Sagar Joshi

Paid to find bugs in AI agents, Apps, APIs, and Phones. Telling you about everyone else's for free. Senior Security Engineer · The alert before the headline

[DCo @Decentralisedco]

https://t.co/fFcbPQ7I3c

[Sagar Joshi @sjazz007]

@sidinkd It's done bro

[Sagar Joshi @sjazz007]

@_MananPahwa_ @DTDCIndia @DTDCIndia what is this behaviour?

[Sagar Joshi @sjazz007]

@sidinkd Show me your claude's chat history 😅

[Sagar Joshi @sjazz007]

Coinkite's advice: update firmware, generate a NEW seed on it, verify the fingerprint on-device, migrate with a small test transaction first.

TRM Labs analysis: https://t.co/6ZU2IWIRAU

[Sagar Joshi @sjazz007]

🚨 Coldcard owners: a firmware update does NOT fix this.

A 2021 firmware bug generated seeds with ~40 bits of real entropy instead of 128. Attackers brute-forced them and drained 1,816 BTC (~$116M) from 5,200+ addresses.

Affected seed? New seed, then migrate. 👇

[Sagar Joshi @sjazz007]

The bug shipped in firmware 4.0.1 (March 2021): a build error made the device use a software RNG instead of its hardware entropy source. Theft began July 30 in four waves; the first drained ~594 BTC in 25 minutes.

[Sagar Joshi @sjazz007]

Claude is down, which means the entire infosec community has temporarily suspended all threat hunting to collectively stare at a "529 Overloaded" error. If the APTs want to breach us, now is the time. Nobody remembers how to write a custom bash script from scratch. 💀📉

[Sagar Joshi @sjazz007]

@sidinkd I'm using 9 pro and it's amazing

[DCo @Decentralisedco]

Investors are not betting on tokens as much anymore, and we have been thinking why.

There are three kinds of assets that have accrued value in the past 18 months.

1. Assets that commit revenue to buybacks. Hyperliquid is an instance of this.
2. Assets that commit to governance through tokens requiring institutional partners to purchase the token to own a stake in the network. Morpho is an instance of this.
3. Ones that do not issue tokens but issue equity directly to private investors. Deribit, Privy, Rain fall in this camp.

The market has wised up and is no longer willing to pay ridiculous multiples for low-revenue tokens without a great future. Pre AI crypto was the hot asset class. In 2026, AI takes that crown.

So where does value go? Tokenisation is the trend that has been winning. Stablecoins were the first attempt at it. On-chain stocks are the second iteration. Blockchains will become the infrastructure layer where the world’s assets will be traded and settled.

These assets will not be issued by foundations and labs with funny piecharts for token distributions, but more often than not by large institutions. The assets represented would be on-chain equivalents of traditional assets alongside native ones.

1. Ondo has 438 assets represented on chain.
2. Blackrock’s BUIDL has $2.3B represented on-chain.
3. Similarly, Centrifuge has scaled to $1.62B in TVL by focusing on treasury funds ($870M ) and a AAA corporate fund ($686M).

None of these are what would be considered “tokens” in the conventional realm of digital assets. But in 2026, they are all digital asset representations of where the industry is headed.

If you are into issuing tokens, pivot to capturing value from tokenisation.

The reason for this secular trend is fairly simple. In 2022, there was the hope that radical decentralisation and DAO-native models that are run by token holders will upend traditional firms. And tokens represented a meaningful premium. In 2025, that premium turned into a discount as most asset

Users see the value in tokenised representations of real world assets due to improvements in accessibility and cost. They do not value the 50th dex on the 18th L2

Tokenisation is the easiest mechanism to export the best assets from mature markets like the US and Korea to the world. It gives a mechanism for financial primitives to communicate with the marvel that globalisation itself was. The rails on which these assets move, settle and are stored will be valuable.

We think, for investors and founders, this really just means four things

1. Crypto has reached a level of maturity where moats and network effects matter. The players that have emerged and dominated in the last 24 months were capital-intensive, walled IP ecosystems that spoke to finance at scale. Both Ethena and Hyperliquid had moats of capital and networks that can’t be rivaled.

2. Value accrual will increasingly be in the equity side of the equation. If you are trying to raise, seeing where tokenisation unlocks new markets or business models may be far easier an answer to find than to compete with being the 50th iteration of a Hyperliquid trading interface

3. Geo-specific markets are not as mature as the ones in the US. Tokenisation unlocks fintech primitives that were not possible earlier in emerging markets. Cracking distribution, UX and business models can lead to economies of scale in these new markets

4. Lastly - question what can be tokenised and why?. USDAI tokenised the debt markets around GPUs. There are players tokenising energy markets.

A good place to start is to revisit the graveyard of dead startups in 2017 and explore what could come on-chain today due to changes in regulation and infrastructure not just beacuse it can but because there is demand.

Blockchains are capital rails, but the new winners among startups will be ones that redefine what forms of capital can be pushed in these rails

Where tokens allow anyone to be an asset issuer, tokenisation focuses on bringing productive assets to the masses. It creates a pathway to retain the benefits of DeFi - be it composability, 24/7 markets or global access, without the risks of buying into a random token. As consumers look towards better alternatives to hedge their own savings and diversify asset classes, tokenisation will become the common trend.

For founders and investors, the fork in the road ahead asks a simple question: do you bet on a private, equity-native vehicle or do you bootstrap a network from scratch with a token? Right now, we are leaning away from tokens and towards equity.

[DCo @Decentralisedco]

https://t.co/agYu0Xshpm

[DCo @Decentralisedco]

https://t.co/H1RxvUhpR4

[Sagar Joshi @sjazz007]

Do you remember when you joined X? I do! #MyXAnniversary

[DCo @Decentralisedco]

https://t.co/HQyNSzYiNK

[DCo @Decentralisedco]

https://t.co/aELlC4iGEj

[DCo @Decentralisedco]

https://t.co/XvJfG9hix8

[DCo @Decentralisedco]

https://t.co/Od9lfqvf21

[Sagar Joshi @sjazz007]

Have you tried it yet?
#vpn #smart #hacks

[Sagar Joshi @sjazz007]

Stripe Settling International Payments through Stablecoins:

source: Decentralisedco

[Sagar Joshi @sjazz007]

@oxwizzdom Gonna miss having you around at DCo.
Grateful for the grind and the vibes. Keep killing it 🔥