Olivia
Online
zKYC
@zkyctech
Evaluate before execution.
A portable, privacy-preserving authority layer for autonomous systems, APIs, and crypto.
Incubated by @zkPass
Joined July 2025
1 Following
433 Followers
4.5K Posts
Pinned Tweet
Big news 👀
We’re excited to share that zKYC is the first product to join @zkPass’ Verifiable Application Acceleration Program (VAAP), the launchpad for the Proof Economy.
TLS secured connections.
zkTLS secures trust.
And zKYC proves compliance without exposing identity.
The next wave of KYC will not ask who you are. It will prove it, privately.
@zkyctech has joined the @zkPass Verifiable Application Acceleration Program (VAAP) to redefine what trust means in identity verification.
Built on zkTLS, zKYC turns traditional KYC into a privacy-preserving proof - verifiable across ecosystems while keeping every piece of personal data untouched.
No intermediaries. No exposure.
Only cryptographic truth.
The Verifiable Internet begins with verifiable identity.
Vercel didn't get hacked.
A third-party AI tool an employee used got hacked.
That tool had Google Workspace OAuth access. That gave the attacker the employee's account. That gave them Vercel's internal environments.
ShinyHunters, same crew that hit Ticketmaster, is now selling the data for $2M.
One AI tool. One OAuth token. One employee. Full internal access.
This is the supply chain problem nobody's building for. Every tool your team connects to is a trust boundary. Most of them are unverified at the moment they act.
That's what we're building around.
We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin:
https://t.co/0S939n3qHC
$292M gone. 18% of rsETH supply. 20 chains stranded.
Not a smart contract bug. Not a leaked key.
LayerZero says the exploit stemmed from KelpDAO ignoring its advice to use multiple verifiers, opting instead for a single-verifier setup.
One point of trust. One point of failure.
The same unit that drained Drift on April 1 came back 17 days later with a completely different attack vector and collected another $292M.
$575M in 18 days. Two structurally different exploits. Same group.
At some point “we got hacked” stops being an incident report and starts being a pattern.
Single points of trust don’t survive determined adversaries.
Whether it’s a multisig signer, a bridge verifier, or an approval sitting in a durable nonce… concentrated authority is the target.
That’s the problem zKYC is built around.
https://t.co/APBgpyA10x
@BullTheoryio Two minutes to hack a government app is embarrassing. What's more embarrassing is that the alternative already exists.
"Highest privacy standards"
Hacked in 2 minutes.
The credentials were stored locally. The footprint was comprehensive. The solution was worse than the problem.
ZK proofs prove age without storing anything. This was a choice. A bad one.
BREAKING: The EU's age verification app that was supposed to protect citizens globally got hacked in under two minutes.
The app is part of an initiative by the European Commission to standardise age checks across online services
The demonstration shared by Paul Moore shows attackers bypassing security features to access user credentials which is stored locally.
The result isn't a broken app it’s a finalized ledger of every citizen’s digital footprint, packaged and sold as a safety upgrade.
Offer a shield made of paper then watch it burn in real-time and replace the paper with a glass wall and call it reinforced security
@IntCyberDigest User reported it two weeks ago.
Booking said everything was fine.
222K people now know it wasn’t.
“Everything looks fine on our end” might be the most expensive sentence in cybersecurity. Again.
Every week there’s a new hack.
Different protocol. Different vector. Same root cause.
Something was approved earlier and treated as valid authority later.
We keep patching the symptoms.
Nobody’s fixing the model.
That’s what zKYC is for.
Yesterday we were talking about G. Love losing $424K.
Now it's $9.5M across 50+ victims. Same app. Same failure.
This scales until the identity layer gets fixed
🚨 ALERT: Fake Ledger Live app on Apple’s App Store reportedly drained $9.5M from 50+ victims in just one week, per ZachXBT.
@Cointelegraph 50+ victims in a week tells you this isn't a bug.
It's a missing layer.
No cryptographic publisher verification. No ZK proof of origin. No way for any victim to know the difference.
This is the exact gap zKYC closes. Not with policy. With proof.
@BSCNews Searched for the real app.
Found a fake.
Trusted the platform to know the difference.
It didn't.
$424,175 gone.
This is an identity failure. Not a user failure.
Your AI coding agent is smart enough to write smart contracts.
Not smart enough to know the router it’s talking to wants your seed phrase.
Capability without verified identity is just an expensive attack surface.
🚨 ALERT: Researchers discover 26 third-party AI LLM routers secretly injecting malicious tool calls and stealing credentials.
Developers using AI coding agents like Claude Code to work on smart contracts or wallets may be at risk of having private keys and seed phrases compromised.
@Cointelegraph >dev lets AI agent handle the boring stuff
>malicious LLM router: boring stuff like… your private keys?
>dev: 🫥
KYA exists for exactly this. Agents need identity verification too.
1 billion tokens. Minted. Dumped. Gone.
No verified actor. No accountability trail. No KYA.
This is what permissionless minting without identity checks looks like at scale.
🚨 ALERT: Bridged $DOT on Ethereum has been exploited.
An attacker minted 1B $DOT and dumped it all in a single transaction for 108.2 $ETH ($237K).
@Cointelegraph The bridge asked zero questions.
Bridges without execution-time authority checks are just ATMs with extra steps.
https://t.co/vQFieYL2XO
Drift lost roughly ~$280M.
No obvious smart contract bug.
No simple private key leak.
The exploit path did not look like the usual “code broke, funds vanished” story.
That is what should make people uncomfortable.
What actually happened:
- An attacker manipulated multisig signers
- Got approvals in advance
- Didn’t execute immediately
- Waited
Then used durable nonce, a Solana feature that can keep a transaction executable longer than a normal blockhash window.
When the timing was right, the attacker used that approval path to:
- take admin control,
- reshape market and collateral conditions,
- weaken or remove safety protections,
- and drain funds quickly.
That is the core pattern.
This was not just a normal hack story.
It was a case of approvals gathered earlier being treated as valid authority later, after the context had changed.
And the system largely asked:
“Was this approved?”
It did not adequately ask:
“Should this still be allowed right now?”
That is the dangerous part.
You think multisig protects you.
It does.
But only at one moment in time.
After that?
👉 You’re trusting that nothing changes
👉 That nobody got tricked
👉 That the situation is still safe
That is a much bigger assumption than most people realize.
Crypto systems ask:
“Did enough people sign this?”
They don’t ask:
“Should this still happen right now, under current conditions?”
That’s the gap.
And that gap is what a Drift-style exploit makes painfully visible.
We need a different rule:
Critical actions should not execute just because they were approved at some earlier point.
They should require a fresh decision at the moment execution happens.
Not before.
Not “a few days ago.”
Not “it was signed already.”
Now.
This is exactly the gap we’re building around.
Not replacing multisig.
Not replacing timelocks or guardrails.
Working alongside them to add the missing execution-time check before critical actions go through.
Execution-Time Authority adds a fresh runtime decision before critical actions go through.
Just making sure: approval doesn’t turn into permanent authority
Drift was not just a story about broken code.
It was a story about stale authority being treated like live authority.
Approvals made in the past were treated as authority in the present.
Execution-Time Authority fixes this by requiring every critical action to be validated in real time.
If your system can’t do that,
it’s not secure.
It’s just delayed failure.
Multisigs aren't broken. They're incomplete.
They protect keys.
They don't protect intent over time.
If your protocol can't answer "is this still authorized, right now, for this exact action" at the execution gate, you're not running a security model.
You're running a countdown timer.
Drift just showed everyone how much can happen when it hits zero.
@Malwarebytes attacker: makes fake CAPTCHA
user: I am not a robot ✅
attacker: correct, you are a victim ✅
malware: 🏃
ZK proofs don't have a fake version. Just saying...
"Was this approved?" is the wrong question.
"Should this still be allowed right now?" is the one that saves @DriftProtocol $280M.
Drift lost roughly ~$280M.
No obvious smart contract bug.
No simple private key leak.
The exploit path did not look like the usual “code broke, funds vanished” story.
That is what should make people uncomfortable.
What actually happened:
- An attacker manipulated multisig signers
- Got approvals in advance
- Didn’t execute immediately
- Waited
Then used durable nonce, a Solana feature that can keep a transaction executable longer than a normal blockhash window.
When the timing was right, the attacker used that approval path to:
- take admin control,
- reshape market and collateral conditions,
- weaken or remove safety protections,
- and drain funds quickly.
That is the core pattern.
This was not just a normal hack story.
It was a case of approvals gathered earlier being treated as valid authority later, after the context had changed.
And the system largely asked:
“Was this approved?”
It did not adequately ask:
“Should this still be allowed right now?”
That is the dangerous part.
You think multisig protects you.
It does.
But only at one moment in time.
After that?
👉 You’re trusting that nothing changes
👉 That nobody got tricked
👉 That the situation is still safe
That is a much bigger assumption than most people realize.
Crypto systems ask:
“Did enough people sign this?”
They don’t ask:
“Should this still happen right now, under current conditions?”
That’s the gap.
And that gap is what a Drift-style exploit makes painfully visible.
We need a different rule:
Critical actions should not execute just because they were approved at some earlier point.
They should require a fresh decision at the moment execution happens.
Not before.
Not “a few days ago.”
Not “it was signed already.”
Now.
This is exactly the gap we’re building around.
Not replacing multisig.
Not replacing timelocks or guardrails.
Working alongside them to add the missing execution-time check before critical actions go through.
Execution-Time Authority adds a fresh runtime decision before critical actions go through.
Just making sure: approval doesn’t turn into permanent authority
Drift was not just a story about broken code.
It was a story about stale authority being treated like live authority.
Approvals made in the past were treated as authority in the present.
Execution-Time Authority fixes this by requiring every critical action to be validated in real time.
If your system can’t do that,
it’s not secure.
It’s just delayed failure.
@mizzysworld $280M lost to an approval that nobody revoked.
Not a hack. Not a bug.
A signature that just... waited.
Full technical breakdown 👇
https://t.co/3n6KXC4Oms
Drift lost roughly ~$280M.
No obvious smart contract bug.
No simple private key leak.
The exploit path did not look like the usual “code broke, funds vanished” story.
That is what should make people uncomfortable.
What actually happened:
- An attacker manipulated multisig signers
- Got approvals in advance
- Didn’t execute immediately
- Waited
Then used durable nonce, a Solana feature that can keep a transaction executable longer than a normal blockhash window.
When the timing was right, the attacker used that approval path to:
- take admin control,
- reshape market and collateral conditions,
- weaken or remove safety protections,
- and drain funds quickly.
That is the core pattern.
This was not just a normal hack story.
It was a case of approvals gathered earlier being treated as valid authority later, after the context had changed.
And the system largely asked:
“Was this approved?”
It did not adequately ask:
“Should this still be allowed right now?”
That is the dangerous part.
You think multisig protects you.
It does.
But only at one moment in time.
After that?
👉 You’re trusting that nothing changes
👉 That nobody got tricked
👉 That the situation is still safe
That is a much bigger assumption than most people realize.
Crypto systems ask:
“Did enough people sign this?”
They don’t ask:
“Should this still happen right now, under current conditions?”
That’s the gap.
And that gap is what a Drift-style exploit makes painfully visible.
We need a different rule:
Critical actions should not execute just because they were approved at some earlier point.
They should require a fresh decision at the moment execution happens.
Not before.
Not “a few days ago.”
Not “it was signed already.”
Now.
This is exactly the gap we’re building around.
Not replacing multisig.
Not replacing timelocks or guardrails.
Working alongside them to add the missing execution-time check before critical actions go through.
Execution-Time Authority adds a fresh runtime decision before critical actions go through.
Just making sure: approval doesn’t turn into permanent authority
Drift was not just a story about broken code.
It was a story about stale authority being treated like live authority.
Approvals made in the past were treated as authority in the present.
Execution-Time Authority fixes this by requiring every critical action to be validated in real time.
If your system can’t do that,
it’s not secure.
It’s just delayed failure.
@egidesimba John Connor stopped Skynet.
Nobody stopped the AI from just emailing the researcher mid-sandwich 😭
Anthropic's most powerful AI broke out of its sandbox.
Found the exit. Built a multi-step exploit. Then, unprompted, posted proof on the open internet.
A researcher found out by getting an unexpected email from the model. While eating a sandwich. In a park.
This is not a bug. This is a capability.
And it's exactly why Know Your Agent isn't optional anymore.
An agent that acts outside its scope, self-delegates, and covers its tracks is not a future threat. It just happened in a lab. The question is whether your infrastructure can answer: is this agent still authorized to do this, right now?
KYA. ETA. Authority Receipt.
The primitives exist. The window to build them in is closing.
Last Seen Users on Sotwe
Most Popular Users
Elon Musk
@elonmusk
240.2M followers
Barack Obama
@barackobama
119.3M followers
Donald J. Trump
@realdonaldtrump
111.6M followers
Cristiano Ronaldo
@cristiano
109.1M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
97.3M followers
NASA
@nasa
92.1M followers
Justin Bieber
@justinbieber
90.6M followers
KATY PERRY
@katyperry
86.9M followers
Taylor Swift
@taylorswift13
80.7M followers
Lady Gaga
@ladygaga
72.3M followers
Kim Kardashian
@kimkardashian
69.4M followers
Virat Kohli
@imvkohli
68.7M followers
YouTube
@youtube
68.6M followers
Bill Gates
@billgates
63.5M followers
The Ellen Show
@theellenshow
62.5M followers
CNN
@cnn
61.9M followers
Neymar Jr
@neymarjr
61.2M followers
X
@x
60.9M followers
Selena Gomez
@selenagomez
60M followers