Pinned Tweet
I just found a confirmed bug on @immunefi
This was another one I submitted last week and the Protocol team was so good and detailed with their responses . I want to give them a shoutout , but I can't due to terms and conditions .
Good team do occur SR's , just work hard and find bugs .
I will be and I am taking part in #SRSummer , So will see u all guys in the battlefield .
#immunefitribe #SRSummer2026
immunefi.com/s/ss/?severity=…
Angry_Mustache_Man retweeted
Migration time + secrecy time > time to Q-Day = you’re already too late.
Post-quantum migrations have taken ~10 years in practice. And every layer of the stack has to change.
How long would your migration take?
Book a Quantum Readiness Review, link below.
Angry_Mustache_Man retweeted
Research papers you must read for Cybersecurity Engineer interviews:
1. Smashing the Stack for Fun and Profit (Buffer Overflow)
2. The Protection of Information in Computer Systems (Security Principles)
3. Reflections on Trusting Trust (Software Supply Chain Security)
4. New Directions in Cryptography (Public-Key Cryptography)
5. Why Johnny Can't Encrypt (Usable Security)
6. An Intrusion-Detection Model (Intrusion Detection)
7. The Base-Rate Fallacy and Its Implications for the Difficulty of Intrusion Detection (Threat Detection)
8. The Cyber Kill Chain (Attack Lifecycle)
9. The Diamond Model of Intrusion Analysis (Threat Intelligence)
10. Towards Evaluating the Robustness of Neural Networks (Adversarial Machine Learning)
Bookmark this.
Read one paper a week.
Understand the concepts.
Practice what you learn in a lab.
The goal isn't to memorize research papers. It's to understand how systems get attacked, how vulnerabilities are exploited and how to defend them.
Angry_Mustache_Man retweeted
Over the last few months I burned an insane amount of tokens testing every AI auditing technique and prompt I could think of and here are 5 that actually work (from my @summit_defi talk)
Angry_Mustache_Man retweeted
Across is fully restored, and all systems are operational.
across.to is back under our control, and all Across systems are working normally.
Thank you to the Namecheap founder, @synth for responding on X, helping us secure our account and opening an investigation into how this happened.
All affected users will be made whole. We’ll share a full post-mortem in the coming days.
While the domain was compromised, @SEAL_911 helped us get across.to flagged as phishing. If you still see a warning in your wallet or browser, it should clear soon.
We will only communicate through official Across channels. Don’t trust messages, links or DMs from any other source claiming to be from the team.
The Across domain is currently down while we secure it against an attack from earlier today.
At ~18:45 UTC, a social engineering attack on @Namecheap (our domain registrar) gave a bad actor control of the Across domain.
Within 15 minutes of this attack, we were alerted and immediately worked to shut the site down. SEAL911 marked across.(to) as a phishing site with major wallets, and Cloudflare worked with us to mark the domain as at risk, and later pulled the site’s DNS records.
At the time of this post, Across.(to) is fully down, and the phishing site is no longer available.
In the brief period before Cloudflare fully blocked the malware site, some users who visited across.(to) may have been affected. No third-party integrations or API users were affected. Users who believe they were affected should DM us with transaction details and revoke attacker permissions (see next tweet for details).
Despite our best efforts, @Namecheap has been unresponsive, and we have not been able to properly secure the domain to bring Across’s services back up. Across’s frontend and API will remain down until we can properly secure them. We will always put user safety first.
Across’s domain was fully locked down with best-in-class security practices; this unauthorized takeover should not have been possible. We will be investigating this deeply and will provide a post-mortem on how this domain takeover was possible once we have more information.
Angry_Mustache_Man retweeted
we should make formal verification the "new normal" for DeFi in 2027
ref anthropic.com/research/forma…
Check these out devs & SR's
42 things to install in Claude that turn it from a chatbot into a coworker:
>> Skills (free, from Anthropic)
docx: writes Word docs
pptx: builds slide decks
xlsx: spreadsheets with real formulas
pdf: creates and fills PDFs
skill-creator: builds your own skills
frontend-design: UI that doesn't look AI-made
mcp-builder: helps you build MCP servers
webapp-testing: tests your app in a browser
web-artifacts-builder: multi-file React apps
canvas-design: posters and visuals github.com/anthropics/skills
>> Claude Code plugins
commit-commands: commit, push, open a PR
code-review: reviews your diff
feature-dev: plans and builds features end to end
pr-review-toolkit: several agents review one PR
security-guidance: flags risky code as you write
plugin-dev: build your own plugins github.com/anthropics/claude…
>> Dev MCPs
GitHub: repos, issues, PRs
Playwright: drives a real browser
Context7: current library docs, fewer hallucinated APIs
Chrome DevTools: debugs live pages
Figma: turns designs into code
Supabase: your database
Neon: serverless Postgres
Vercel: deploys
Cloudflare: Workers and the rest of the platform
Sentry: reads your errors
Stripe: payments data
Linear: tickets
Atlassian: Jira and Confluence
>> Work apps
Notion
Slack
Google Drive
Gmail
>> Research
Exa: search built for agents
Brave Search: web search
Perplexity: answers with sources
Firecrawl: scrapes whole sites
Fetch: any page as clean text github.com/modelcontextproto…
>> Local power tools
Filesystem: works on your files
Git: reads your repo history
Memory: remembers across chats
Sequential Thinking: breaks big problems into steps
You don't need all 42. Pick 5 that match your work.
Bookmark this.
1
46
Angry_Mustache_Man retweeted
Recent big ones for learning:
Web3: Binance $6.3B (Oct 29) - compromised signing infra + EIP-7702. Binance findings: binance.com/en/square/post/3…. Blockaid + TRM on-chain details.
Ledger/CryptoBilis (~$100M supply-chain implants): Bitquery investigation + Ledger Donjon analysis.
Web2 "Black October": PHP2Shell RCE, GitLab CVSS10, LiteLLM supply-chain, eMudhra weak CA keys. See WorkOS or Wikipedia Black October summary.
More in Kann Audits Oct roundup and DefiLlama hacks.
So many security incidents happened across web2 and Web3 across last few weeks .@grok Please tag me onto some of the incident reports, so that I can learn from.
Also , security nerds please tag the writeups that u came across
1
1
208
Angry_Mustache_Man retweeted
The bug is like a joke.
On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀
‼️ BREAKING: OpenSSH has rushed out a fix for a critical flaw that lets attackers log into some Linux servers without the right password.
The team learned of the bug a day earlier. OpenSSH's Damien Miller says long embargoes now mostly help attackers, because AI agents rediscover bugs, sometimes within hours.
It hits Linux systems on the musl C library with PAM off, such as Alpine Linux. Miller told admins to disable password logins or SSH itself "IMMEDIATELY".
Version 10.6p2 works around it. Systems on glibc or PAM are not affected, and Miller says the root cause sits outside OpenSSH.
Angry_Mustache_Man retweeted
🚨If you're in cybersecurity, DON'T miss this 🙏
a FREE, hands-on workshop on building AI agents for vulnerability research
learn how to equip AI agents with memory, tools, testing environments and workflows to investigate and validate security flaws:
grahamhelton.github.io/harne…
Angry_Mustache_Man retweeted
After $6B got stolen by Lazarus Group from Binance, I am pitching KoreanFlare again
I'm building KoreanFlare - voice-activated wallet protection against North Korean hackers.
Our solution is simple:
Before any transaction, users must say "Kim Jong is gay" into their microphone. If you refuse or sound North Korean, wallet locks permanently.
Why it works:
- No hacker wanna see “PigJong”
- No North Korean hacker will say it (instant execution)
- Voice AI detects Korean accent
- Decentralized proof-of-disrespect consensus
- 100% effective (my theory, no testing needed)
Built on Cloudflare but web3 because I said so.
Do you things dear @heyibinance and team. Thanks
Best,
Hrithik
Founder, KoreanFlare
Integration issues in Web3 are the easiest and most repetitive issues that most devs miss out .
Devs keep on making these mistakes and Auditors keep on making money from it.
1
7
234
I am looking for a job . If u are protocol/team , looking for a dev with security knowledge or a security engineer . Please reach out
I have used @jumperapp from Day 1 in defi space and I can say it is one of best Bridge aggregators I have used.
Make the $JUMP .
waitlist.jumper.xyz/r/JMP-08…
2
99
Angry_Mustache_Man retweeted
PLEASE every protocol read this. Your bug bounty submission might be malicious:
The incident was the result of a sophisticated, multi-stage attack that combined social engineering with a trojanised proof-of-concept test suite.
The attacker initially established credibility by submitting a plausible responsible-disclosure report describing a potential reward-distribution front-running vulnerability in the vault contracts. The report referenced legitimate-sounding contract functions, followed a standard vulnerability disclosure format, and offered to collaborate on mitigation steps. These elements appear to have been deliberately crafted to encourage our team to review and execute the attached proof-of-concept.
Angry_Mustache_Man retweeted
It's here, it's live.
A new chapter for Bug Bounties in web3 and a new opportunity for a selected group of security researchers.
Next is building, iterating and paying out.
We've only just started.
