
🥷 Security-First Solidity Dev 🏅 SSCD+ | QWS+ certified @CyfrinUpdraft ✍️ Co-author SSCD+ study guides 🗣️ Ambassador @Cyfrin 🤝 Contributor SEAL Frameworks
Joined October 2012
- Tweets2.6K
- Following408
- Followers651
- Likes5.4K
Usman retweeted
Replying to @0xtruthlover
It's about time @immunefi started refunding submission fees for duplicates of valid findings.
@MitchellAmador, in your own words:
"Immunefi now prices out spam with pay-to-submit mechanics, so a junk report costs the sender something, and the flood thins out."
Fair point! But if a researcher submits a legitimate vulnerability and gets marked as a duplicate simply because someone else reported it first, where's the spam?
What's the justification for keeping the submission fee in this case?
xitter.cf/MitchellAmador/article…
Celebrating privacy and @davidzmorris’ new documentary covering @rstormsf’s trial.
V fitting time as we reach the final hours of our privacy funding round on @OctantApp.
Writing code should not be a crime. Roman’s been unfairly prosecuted and is now going into his second trial. His case deserves a LOT more visibility and awareness.
Usman retweeted
🚨 PSA: threat actors are approaching crypto projects on Telegram, posing as white-hat researchers, offering an “exploit PoC” for your own infra. The PoC contains malware. Our detailed write-up is linked below.
It’s a complete, runnable Solana exploit kit (fork harness, fixtures, the real program binary) so it looks legit. But poc.mjs reads a byte array from a JSON field called UnifiedSignatureInfo, decodes it to a URL, and runs curl -fsSL -k "" | sh.
The decimal array is plain ASCII posing as a Solana signature. Following the README (npm install, start fork, node poc.mjs) is what detonates it.
IOC: hxxps://162[.]35[.]174[.]231:5000/stage2.
Treat any unsolicited PoC as hostile, review statically in an isolated VM, and never run the setup steps on a box you care about. Report any suspicious reachouts to SEAL.
radar.securityalliance.org/a…
Usman retweeted
🚀 Kann Audits Internship Program 2.0 is here!
We're back with our second paid internship program for Security Researchers!
Looking for motivated hustlers across:
• Solidity
• Rust
• TypeScript / Off-chain
• ZK
We're giving emerging talent the opportunity to work on real security audits, build strong portfolios, collaborate with other researchers, and level up their skills.
Ready to prove yourself?
Apply here: kannaudits.com/internship
Once you've applied, comment "Applied!" below 👇
Usman retweeted
🚨 MAJOR SECURITY ALERT
8 certificate authority private keys have been compromised.
How bad is it? An attacker holding these keys could impersonate ANY website, including banks, exchanges, or Google, and potentially intercept sensitive communications.
The good news: Chrome, Firefox and Apple have already taken action to block the compromised certificates.
The bad news: Many apps, developer tools and systems may still trust them.
What you should do TODAY:
Update your browser, OS and phone.
Update desktop apps (Slack, Discord, VS Code, etc.) as patches arrive.
Avoid untrusted Wi-Fi until your devices are updated.
Only install updates from official sources.
Ignore any email offering a "certificate fix".
This is a serious compromise of internet trust infrastructure, not just another website hack.
Full technical details:
emudhra.we-have-a-problem.co…
Usman retweeted
Hiring: Smart Contract Engineer (Solidity, EVM) – @saifuro_finance
Saifuro secures AI-agent payments with verifiable, non-custodial onchain escrow.
Role highlights:
- Earn $170k–$220k remotely
- Own Solidity escrow infrastructure
- Build secure Base and Solana rails
Apply below 👇
Usman retweeted
🚨If you are ever targeted in a wrench attack or threatened with physical violence for your crypto: comply.
Your life is more important than your assets.
Once you are in a safe place, speed is everything.
Call the police immediately, then contact @SEAL_911 on Telegram t.me/seal_911_bot.
Share the transaction hashes and attacker addresses as fast as possible so they can trace the movement and relay the data.
In a recent incident, this sequence made all the difference.
A victim was subjected to a violent robbery and had their funds stolen.
Once they reached safety, they contacted SEAL 911 with the transaction details.
SEAL verified the incident and pushed the attacker addresses directly into TIPzs, zeroShadow's threat intel platform that feeds live incident data straight to exchange screening systems.
Seconds later, the criminals attempted to swap the stolen assets at an exchange.
Because TIPzs pushes threat data to connected platforms in under two seconds, the intelligence landed ahead of the deposit.
The exchange caught the incoming transaction and froze the funds on arrival.
SEAL 911, zeroShadow, the exchange team, and law enforcement are now coordinating to follow the legal process and help the victim recover their assets.
Prioritize your physical safety first.
After that, fast reporting is what makes intercepting and freezing the stolen funds possible.
Thank you to SEAL 911, the exchange team and law enforcement for working together with us and showing how the private and public sectors can work together and do our part to effectively help those who are victimized and deserve all the help they can get.
Usman retweeted
How many Web3 hacks started with a compromised account or device?
Actually, easier question: how many didn't?
🙃
Honored to have my work included in the Wallet Security Framework. Thanks to the SEAL team and @pinalikefruit for the review.
Replying to @_SEAL_Org
3) Our Wallet Security Framework now includes a Security Best Practices section for beginners and small balances, covering auto-lock timers, a dedicated browser profile with sync turned off, and malware protection.
Thanks @0xusmanf for these additions & @pinalikefruit for the Steward review!
frameworks.securityalliance.…
The Safe UI shows you the owners it can index and stays silent on ones it can't. This talk shares learnings from scanning 2M+ Safes hunting for shadow owners and modules.
Elliot Friedman · DSS 2026
“Every Safe Is Blind to Its Own Backdoor: Scanning 2M+ Multisigs for Shadows”
Explore the talk and add it to your agenda:
defisecuritysummit.org/2026/…
Tickets: luma.com/9qtxqqxx
If you are a multisig signer, a DAO delegate, a protocol team member or a treasury manager, you may be authorizing transactions that move real money. This article is a practical guide to verifying them properly.
Usman retweeted
Yubikeys are not enough.
Watch how an info stealer steals your open sessions.
Devices are infected daily, by so many different attack techniques and vectors.
Protect your devices with an EDR.
Are you still relying only on MFA?
Usman retweeted
Dear @discord_support,
I am a security engineer who helps servers and users stay safe on the Discord platform.
A server was currently being compromised by bad actors and I was assisting the team, while attempting to assist the team the bad actors/scammers changed the server name and server PFP to my name and my PFP, and then mass reported me for "impersonation", which somehow led to my account being banned for "impersonation"..
I am the only NFT_Dreww in which I can prove that in multiple ways, and was not impersonating anyone, therefore this is a false positive that has to be reviewed to revoke the ban.
I appealed this 3 days ago, and attempted to open several tickets but thus far I have not been able to get past your automated AI and they respond with the same template auto-closing the ticket. Please help ><
Discord Name: NFT_Dreww
Discord ID: 859580996143415337
Discord Tickets:
#69001961
#69024236
#69023529
#69024402
Usman retweeted
🚨PODCAST SCAMMERS ARE BACK… AND THEY'RE AUTOMATING THEIR ATTACKS!🚨
Scammers are scaling their outreach, refining their social engineering tactics, and targeting even MORE people... Review and block all the accounts below ⤵️
And it's not just fake podcast invitations anymore👀
🎙️ Podcast invitations
📰 Article features & interviews
🎮 Game beta testing opportunities
💰 Investment opportunities
🤝 Fake partnership offers
The goal? Gain your trust, then trick you into downloading malware, visiting a phishing website, or compromising your wallet.
⚠️Just because an opportunity looks legitimate doesn't mean it is!
Be extremely cautious of unsolicited outreach, especially when someone asks you to download software, open unfamiliar files, or connect your wallet.
🚩Accounts flagged in connection with these campaigns, report and block all the accounts below:
@theindicatorpod (Scammers)
@Web3UnlockedHQ (Scammers)
@KenziMoriyama (Scammers)
@SachiKagetsu (Scammers)
@dikshaksagar (Scammers)
@Web3BlockWave (Scammers)
@kenzimerkie (Scammers)
@sachiminara (Scammers)
@Kai2009pp (Scammers)
@BeaconLayer (Scammers)
@SituWanxin (Scammers)
Stay Safe & Stay Vigilant
🚫ENTIRE PODCAST RING YOU MUST AVOID 🚫
I've been tracking a network of fake podcast accounts that look completely legitimate.
They're stealing interviews, copying articles almost word-for-word, and using that credibility to convince people to download malware.
The content isn't the scam.
It's the trust they build before the scam begins.
Block & Report ⤵️
@Web3UnlockedHQ (Scammer)
@KenziMoriyama (Scammer)
@SachiKagetsu (Scammer)
@dikshaksagar (Scammer)
@Web3BlockWave (Scammer)
@kenzimerkie (Scammer)
@sachiminara (Scammer)
@Kai2009pp (Scammer)
Stay Safe & Stay Vigilant
Usman retweeted
🚨BOOKMARK @RevokeCash RIGHT NOW AND GO REVOKE YOUR BLUR APPROVALS🚨
With @blur_io frontend shutting down, blend closing, and all the chaos surrounding recent exploits; scammers are taking advantage by directing users to FAKE approval-revoking websites designed to DRAIN your wallet.
🔐 revoke.cash - Bookmark the official website and access it directly from your bookmarks.
❌ Don't trust random links in DMs
❌ Don't blindly click sponsored search results
❌ Don't connect your wallet to unverified sites
Even when you're trying to protect your wallet, scammers are trying to exploit you.
Take 10 seconds to bookmark the legitimate site NOW, before you urgently need it.
Stay Safe & Stay Vigilant
Avengers of Web3 🦸♂️
Thank you for your service 🫶

























