wallisi 🛡️⚡️

Founder ✨ex Biz Dev Consensys, MetaMask 🦊, Linea, web3 Security 🛡️ and Electric vehicles ⚡️ Turtle mode maxi 🐢 Views are my own

[wallisi 🛡️⚡️ @wallisi]

AI is breaking the verification layer of society. Zero knowledge proofs can restore that verification layer. We went from http 🏴‍☠️ to https 🔐and now we need to go to httpz 🔍 as per @balajis

[wallisi 🛡️⚡️ @wallisi]

ZK brings back the trust layer to society

[wallisi 🛡️⚡️ @wallisi]

Good to see Customer-managed encryption keys available for Claude workspace data

https://t.co/NWNryG7phq

[wallisi 🛡️⚡️ @wallisi]

It has taken longer than I expected but I think this is a very positive move for bitcoin, crypto and adoption of blockchain technology

[Etherealize @Etherealize_io]

BlackRock CEO Larry Fink: Countries are racing to launch their own stablecoins

“Every member of our government needs to wake up to the idea that these deficits are threatening our future and the value of the dollar. Let’s be clear, if we were not the country whose currency is the currency of the world, we would not be able to have these deficits… it is a privilege, not a right. I think too many men and women in congress think it’s a right, not a privilege, and I think we’re jeopardizing that right.”

Larry Fink points out that crypto is creating a credible alternative to the dollar:

“I was in Asia two weeks ago, and the countries are all talking about creating their own stablecoins because they’re worried about the increased dominance of a dollar stablecoin worldwide. So they’re all going to start their own.”

And when regulated institutions and sovereigns need neutral global rails to issue these stablecoins, they’re overwhelmingly choosing Ethereum Mainnet (which already hosts $168 billion in stablecoins — 55% of the global market).

Hong Kong’s regulated HKD stablecoin went live on Ethereum this month.

Twelve of Europe’s largest banks are launching a euro stablecoin on Ethereum later this year.

Australia’s largest bank has been issuing AUD on Ethereum since 2022.

A few weeks ago, the Japan Blockchain Foundation announced plans to launch a Yen stablecoin on Ethereum.

Video source: @CPIWealth (Aug 2025)

[wallisi 🛡️⚡️ @wallisi]

A real privilege to present on “Tokenisation and DeFi” at Edinburgh University #TokenisationSummit thanks to @blockchain_scot 🏴󠁧󠁢󠁳󠁣󠁴󠁿

[wallisi 🛡️⚡️ @wallisi]

Agree 100%

[Anshu Sharma 🌶 @anshublog]

@levie @random_walker New rule: any ceo who claims work can be fully done by ai needs to immediately let go of their executive assistant.

Oh so you’re telling me it can do the job of a software engineer that builds schedulers but not that of a scheduler?

[wallisi 🛡️⚡️ @wallisi]

Strawberries grown by @Dyson in the UK via vertical robotic farming now available in supermarkets. Will be interesting to see how this system impacts productivity of greenhouses and the cost of strawberry production. It definitely reduces the need to import berries in winter 🍓

[Josh Newton @JoshuaNewton]

WOW!! First time seeing @Dyson strawberries in the supermarket. Fully nerding out and losing my mind

[wallisi 🛡️⚡️ @wallisi]

Banger

I would add “AI makes your cloud rain again”

[Andy Ayrey @AndyAyrey]

they call it the cloud because eventually it rains all your data out again

[wallisi 🛡️⚡️ @wallisi]

Compromised admin key on @EchoProtocol_ on Monad

[Echo Protocol @EchoProtocol_]

Earlier today, Echo Protocol identified unauthorized activity involving eBTC on Monad that resulted in unauthorized minting and associated fund loss.

Our investigation indicates the issue originated from a compromised admin key affecting the Monad deployment. Based on current findings, approximately $816K was impacted on Monad. The Monad network itself was not impacted and continues to operate normally.

Since detecting the incident, we have been actively investigating potential cross-chain exposure, coordinating with ecosystem partners, and implementing additional precautionary measures. We have successfully regained control of our admin keys and burnt the remaining 955 eBTC that was in the attacker’s possession.

[wallisi 🛡️⚡️ @wallisi]

Thorchain node operators freeze the network after an approx $10m exploit of their own protocol but allowed exploit funds from the Bybit and KelpDAO hacks through stating “decentralisation”. Sus

[Charles Guillemet @P3b7_]

This morning, THORChain was drained of roughly $10.8m
Node operators have freezed the network for nearly 13 hours. The full analysis isn't out yet, but according to @jpthor, this could be a MPC exploit.

ECDSA and TSS is hard. THORChain's vaults rely on TSS, a flavor of MPC where a quorum of nodes jointly produces a signature without ever reconstructing the private key. Clean for Schnorr or EdDSA; painful for ECDSA, which Bitcoin and Ethereum require. That's why we saw plenty of protocol attempts (Lindell17, GG18, GG20, CMP, CGGMP21, DKLS, KU23...), each patching flaws in the previous one.

GG20 has a track record. THORChain's TSS uses GG20, on a fork of Binance's tss-lib. GG20 has shipped two well-publicized critical bugs: CVE-2023-33241 and TSSHOCK. CGGMP21, now cggmp24, are the latest protocols, but GG20 is still widely deployed.

I often hear a misconception when I hear about MPC setup: "The key is split across many nodes, so any single co-signer doesn't really matter".
In every published GG18/GG20 attack, one malicious or compromised co-signer is enough to extract everyone else's shard and reconstruct the full key.

AI changes the threat model. Compromising a full software node, complex Go stack, exposed P2P, custom signing daemons, a churn protocol that admits new participants on a schedule, has always been difficult and acted as a barrier. With LLM-driven vulnerability discovery and exploit synthesis, the bar to compromise one of N validators is dropping fast.

Here, it's a plausible TSSHOCK-style playbook:
- compromise one operator
- wait for it to churn into an active Asgard vault
- send malformed proofs during keygen or signing
- reconstruct the key offline
- sweep in a single transaction

It's unclear yet if the attacker used a known-unpatched GG20 weakness, or a fresh cryptographic flaw.

But, in all cases, MPC and TSS are not a substitute for hardening every co-signer. They sit on top of co-signers that must each be treated as critical infrastructure, hardware-isolated enclaves, minimally exposed, continuously audited, and running protocol with security proofs.

While the investigation progresses, be careful in your interactions onchain. These TSS setup are used in various protocols.

[wallisi 🛡️⚡️ @wallisi]

There is so much going on in this clip, I can't even start to describe it. Pure, joyous chaos

[That’s So Village @ThatsSoVillage]

long live village cricket

[wallisi 🛡️⚡️ @wallisi]

Oh boy. Memecoin trading by LayerZero multisig signer wallets is beyond irresponsible

[Zach Rynes | CLG @ChainLinkGod]

This new post from @LayerZero_Core directly contradicts Bryan's claim yesterday that the LayerZero Labs multisig signer who was trading the "McPepes" memecoin on Uniswap was just "testing the PEPE OFT integration"

Turns out that gaslighting doesn't work when people can check the chain and verify for themselves

Naturally, they attempt to minimize the issue by making it seem like this was a one time incident, involving only one signing key, and that the memecoin trader was quickly rotated off the multisig

In reality, the multisig signer attempted multiple memecoin trades over the span of a year and stayed on the multisig for nearly two years after the first memecoin trade, before finally being rotated off

Furthermore, there were actually 3 signing addresses that were engaged in non-multisig related activity (memecoin trading, DEX swaps, bridging, LP provisioning) on a 2-of-5 Gnosis Safe multisig

Billions of dollars in OFT value was exposed to the risk of being exploited by a multisig whose majority threshold of signers failed to practice even the most basic opsec and key isolation practices, FOR YEARS

This was not a one-time error oopsie, this was a complete disregard for opsec

--

Timeline of events of the LayerZero memecoin trader multisig signer:

March 1, 2023 - 0xf1f5E swaps 0.198548 ETH for 1,727,120 McPepes (PEPES)

December 21, 2023 - 0xf1f5E calls approve() for Uniswap on the McPepes ERC20 contract

April 20, 2024 - 0xf1f5E attempts to sell McPepes on Uniswap but the transaction reverts

January 27, 2025 - 0xf1f5E is finally rotated off LayerZero’s Gnosis Safe multisigs and signing threshold changed

--

More context in following tweets

[wallisi 🛡️⚡️ @wallisi]

Was thinking AIs replace UIs. Curious how they replace APIs

[Naval @naval]

AIs replace UIs and APIs.

[wallisi 🛡️⚡️ @wallisi]

The irony is Big Tech smart phones, apps and websites as we know them could change significantly and may even go away. Our sovereign AI agents will be sourcing everything we require through prompts (purchases, travel, music, games, movies etc…) and in a way that is good for our mental health

[Henrick Johansson @compliantvc]

Europe should mandate flip phones with no internet access for citizens

It's the only way to ensure that American Big Tech companies stop stealing our precious data

[wallisi 🛡️⚡️ @wallisi]

Come join us in Edinburgh - May 27th - Tokenisation Summit https://t.co/askandlTGS

[Blockchain Scotland @blockchain_scot]

[1/2] What is tokenisation? Find out, and join Scotland’s first major celebration of tokenisation on May 27th: https://t.co/zrDRikpjbg featuring @ismiMatthew from @Ethereumfndn, @mead0w1ark from @ADB_HQ Dr Tong Wang from @uoebusiness, @TFGolden from @BaillieGifford,

[wallisi 🛡️⚡️ @wallisi]

34th major incident this month. April 2026: 30+ exploits, ~$630M drained

Everything changed after the release of Opus 4.6

I think this pattern continues for another 6 months, maybe longer if Mythos like AI becomes accessible to hackers

[Francesco Andreoli ᵍᵐ @francescoswiss]

wow, i want to re-iterate here, the @wasabi_protocol exploit isn't really a story about a stolen key. It's a story about what happens when one EOA controls a batch of upgradeable vaults with no multisig, no timelock, and no DAO governance as @evilcos and @zachxbt both pointed out within an hour of the drain (it should have never happen)

The mechanics: deployer EOA grants ADMIN_ROLE to an attacker contract → UUPS upgrade replaces the perp vaults & LongPool with malicious logic → strategyDeposit() called on 7 vaults → drain(). 3 minutes, $5M+ across Ethereum, Base, Berachain & Blast. Largest single hit: 840.9 WETH (~$1.9M) from wWETH.

Wasabi has acknowledged the issue and asked users not to interact with contracts. @blockaid_ flagged that all Wasabi/Spicy LP-share tokens minted by these vaults should be treated as compromised the underlying assets are gone.

If you have funds anywhere in the protocol: withdraw and revoke approvals via @RoscoKalis's @RevokeCash. Big shoutout to him, the tool everyone reaches for on days like this.

34th major incident this month. April 2026: 30+ exploits, ~$630M drained. The recurring pattern keeps writing itself: privileged EOAs over upgradeable contracts, no governance friction, one phished signature away from zero.

[wallisi 🛡️⚡️ @wallisi]

Agent wallet wars just beginning. @stripe just announced @link which allows agents to spend on your behalf

[Stripe @stripe]

Today, we’re launching the @link wallet for agents. It lets you securely empower agents to spend on your behalf. Your payment credentials are never exposed and you approve every purchase.

https://t.co/TcvEiVNth9

[wallisi 🛡️⚡️ @wallisi]

Moonpay acquires @sodot_hq and launches Moonpay Institutional

The consolidation phase of web3 is just getting started as institutions don’t want to piece everything together

[MoonPay 🟣 @moonpay]

BREAKING: MoonPay has acquired Sodot and launched MoonPay Institutional

we've always believed DeFi is for everyone

led by @CarolineDPham, we're bringing access and infrastructure for the next generation of financial markets to TradFi institutions ready to invest trillions

[Tay 💖 @tayvano_]

@danielvf fixed for this weekend:

[wallisi 🛡️⚡️ @wallisi]

Agreed that there is a massive difference between working “manually” on documents and research vs working via AI. The level of information to process just goes up by whatever multiplier your brain can handle. Human in the loop becomes the limiting factor

[Teng Yan @tengyanAI]

something i've noticed: AI agents create a weird new kind of burnout. esp for young people.

a lot of ambitious 22 year olds are going to think the answer is simple:
- spin up more agents
- ship more code
- sleep less
- outwork everyone

and for a while, it will feel incredible.
you can keep multiple agents running, feed them tasks, review outputs, fix mistakes, make decisions, and keep the whole loop moving.

the problem is that the work no longer drains you through typing. it drains you through judgment.
More attention.
More context switching.
More verification.
More decisions per hour.

so instead of 8-10 normal productive hours, you might get 4-5 extremely intense hours before your brain is fully cooked. and you feel numb until you sleep properly and reset

some of my friends are already burnt out. they don't say it out loud but i can tell.

the agent can keep working 24/7.
the human still has a hard limit

[wallisi 🛡️⚡️ @wallisi]

This is wild. Instead of “try before you buy”, AI allows you to “try to build before you buy”

[Sid Trivedi @sidtriv]

Diligence in 2026 is wild. My friends in PE are now spending the weekend before IC trying to rebuild the company they're acquiring in Claude Code. If the clone works, the deal dies. Cheapest moat test in human history.

[wallisi 🛡️⚡️ @wallisi]

I thought this would be the case a few years back. Good to see this happening. Eventually I expect a lot more over night trips with a bed like set-up ala business class in the car

[Nahuel Hilal - TattooGuy @nahuelhilal]

Yesterday I drove my @tesla 900 miles on FSD from Miami to Nashville and I realized it’s genuinely the better option.

I fly that route 2 to 3 times a month. Flights are never under $400. Most times $600. Sometimes $800.

Add Uber to and from both airports, or parking garage fees. Then factor in the delays, the cancellations, the security theater, the chaos, the guy next to you who hasn’t met deodorant yet.

On the other hand: I pack healthy snacks, press one button, and the car just goes.

I took calls. Replied to emails. FaceTimed my family. Ate without pulling over. Did everything I normally do on a travel day, except none of the stuff that makes travel days miserable.

My biggest concern going in was range and charging. Here’s what actually happened:

My bladder needed one extra stop the car didn’t even suggest. Most charging stops were under five minutes. Total cost for the whole trip was less than just the uber to the airport.

And this was the base model Y.
Now I’m thinking I should get something comfier and just make this the default.