Immunefi is the leading security platform for blockchains. Over $180B of user funds protected across 650+ protocols.
Get full onchain protection ➡️
Joined November 2020
- Tweets10.8K
- Following661
- Followers75.4K
- Likes6.4K
Pinned Tweet
Immunefi is the security infrastructure layer of crypto.
We protect 70% of all DeFi TVL today.
Our track record:
- We work with virtually every major DeFi project: Aave, Arbitrum, Optimism, Sei, LayerZero, Ethena, Jito, ENS, The Graph, and so many more
- Multiple $10M+ bounty payouts, the largest in internet history
- $25 billion+ in losses prevented, calculated based on the severity and exploitability of vulnerabilities disclosed
- $125m in payouts to security researchers
- 80% of customers have received valid critical vulnerability disclosures via the platform
- Thousands of valid vulnerability reports processed, creating the industry's most comprehensive dataset of real exploits
The Immunefi token ($IMU) is the central value creation asset powering the entire Immunefi ecosystem, so that it can grow to protect all onchain value.
And it will.
Join us.
Immunefi retweeted
An attacker spent $20,000 and took $9.4 million.
Two apps were built on the same blockchain. Both used a multisig, which means signers had to approve any change to their contracts.
But the blockchain had its own rule. If a governance vote passed, it could give admin control of any contract to someone else, and the multisig couldn’t stop it.
The attacker made a proposal called “AI Agent Takeover.” It looked like a research project, but it actually gave the attacker admin control of 10 contracts from both apps.
About an hour before the vote ended, the attacker uploaded new code that would send all the funds to their wallet.
A few minutes before the vote ended, they bought 31.6 million tokens for about $20,000 and voted yes. That was enough to pass it.
Once they had control, they switched the 10 contracts to their new code and drained them in less than 30 minutes.
The attack exposed a fundamental mismatch between how much it costs to control a blockchain’s governance and how much value that governance actually protects.
It cost $20,000 to control $9.4 million.
@Immunefi works with some of the largest DAOs in crypto to find risks like this before attackers do. That means having security researchers look at more than the code, including who can change it and how much that power costs.
Immunefi retweeted
24 single reports this year have paid $100K or more.
dgzlluny just found one of them, earning $100,000 for a critical smart contract vulnerability.
That one finding put them at #6 on the @Immunefi whitehat leaderboard for the last 90 days and #42 for all of 2026.
Critical findings account for about 65% of all bounty dollars paid to whitehats on Immunefi so far in 2026.
That’s why security has to be continuous. An audit checks code once, but a bug bounty keeps fresh eyes on it for as long as it holds value, and the next critical can come from anyone.
Congrats dgzlluny 🔥
Immunefi retweeted
AI made hunting faster, and report volume surged with it.
To handle the surge, everyone built guardrails: rate limits, spam filters, pay to submit.
They slow the flood, and they also hit the honest researchers who were never the problem. And with more reports, more of them collide: you can be right and still get a duplicate.
We built our share of guardrails too. Now, with Studio, we're taking bug bounty in a new direction, built around what researchers actually get:
- Know which programs respond, pay and aren't crowded before you invest a single day.
- See every scope and code change in one place, without the setup.
- Know if your report is a duplicate or a known issue before you send it.
Which guardrail hits honest researchers hardest?
Immunefi retweeted
The @immunefi Signals is where you compare and sort your target projects.
Open a program to see its current status, whether the queue is clear or congested and the 90-day metrics.
The delta shows how it moved compared to the previous window. Spot a program that's improving or slipping before everyone else does.
Watch the deltas, not just the numbers.
Studio has been built with security researchers since day one, and it’s in the last sprint before release.
Not on the waitlist yet? Link below.
The three questions I get most about Studio, answered.
When does it open? Soon. We're in the last sprint, building in what our beta testers pointed us to, and we'll announce the date here first.
Why not open it now? Studio started as a closed beta on purpose. A small group let us read every review, talk to the people behind them and fix what didn't work in days, not quarters. We want it ready for everyone who comes next.
I'm on the waitlist, what can I do? Keep an eye on this account and @immunefi: when Studio opens, we'll share here how to get in.
Until then, follow @vidrepar , @joxegr and @yassine3eth , who are showing how each tool works all week, and tell us how you hunt today. It shapes what we build.
What else do you want to know before Studio opens?
Ask below, I'll answer.
An attacker spent $20,000 and took $9.4 million.
Two apps were built on the same blockchain. Both used a multisig, which means signers had to approve any change to their contracts.
But the blockchain had its own rule. If a governance vote passed, it could give admin control of any contract to someone else, and the multisig couldn’t stop it.
The attacker made a proposal called “AI Agent Takeover.” It looked like a research project, but it actually gave the attacker admin control of 10 contracts from both apps.
About an hour before the vote ended, the attacker uploaded new code that would send all the funds to their wallet.
A few minutes before the vote ended, they bought 31.6 million tokens for about $20,000 and voted yes. That was enough to pass it.
Once they had control, they switched the 10 contracts to their new code and drained them in less than 30 minutes.
The attack exposed a fundamental mismatch between how much it costs to control a blockchain’s governance and how much value that governance actually protects.
It cost $20,000 to control $9.4 million.
@Immunefi works with some of the largest DAOs in crypto to find risks like this before attackers do. That means having security researchers look at more than the code, including who can change it and how much that power costs.
Immunefi retweeted
Instascope V3 is here.
Pick a program and read the code that's actually deployed in its scope:
- Entry points highlighted
- Proxies linked to their implementations, with full upgrade history
- Every ABI function one click from its declaration
- Live on-chain state beside the code
- Scope rules pinned to the code they cover*
- Value exits marked in the gutter*
Read the scope like a codebase, not a list of links.
*On the programs we've mapped so far
ALT Instascope V3: Scope as a codebase. Pick a program and navigate its scope like code, not like a list of links. 01 Entry points highlighted. 02 Proxies linked, full upgrade history. 03 ABI functions jump to declarations. 04 Live on-chain state beside the code. 05 Scope rules pinned to the code*. 06 Value exits marked in the gutter*. *On the programs we've mapped so far.
Immunefi retweeted
Under the scores, Review lists the gaps it found in your report, each with a severity:
- Blocking: fix this or the report will likely be closed.
- Substantial: a real weakness that can lead to back and forth with the program.
- Minor: polish before you submit.
The gaps are technical: missing PoC steps, state the attack depends on, an impact that doesn't match. Start from the blocking ones, fix them, then run the Review again.
Blocking first. Everything else is polish.
24 single reports this year have paid $100K or more.
dgzlluny just found one of them, earning $100,000 for a critical smart contract vulnerability.
That one finding put them at #6 on the @Immunefi whitehat leaderboard for the last 90 days and #42 for all of 2026.
Critical findings account for about 65% of all bounty dollars paid to whitehats on Immunefi so far in 2026.
That’s why security has to be continuous. An audit checks code once, but a bug bounty keeps fresh eyes on it for as long as it holds value, and the next critical can come from anyone.
Congrats dgzlluny 🔥
🚨 New Bug Bounty Alert! 🚨
@paxoslabs has launched a $500K Bug Bounty Program on @Immunefi.
Help secure Transit, a stablecoin conversion protocol for swaps on the same chain or across chains, and PAXGy, tokenized gold that grows in gold terms.
Start hunting: immunefi.com/bug-bounty/paxo…
Immunefi retweeted
AI changed bug bounty in about a year.
Agents now read more code than any of us could, and they find more bugs, faster. It also turned hunting into a race to be first: more reports, more duplicates, more slop, and a lot of good researchers burning out.
At @immunefi , we're building Immunefi Studio so every hunt counts in this new world: better information, better tools, and more of researchers' work turning into valid findings.
This week I'll share why we built it, when it opens, and what it's already doing for the researchers using it.
All week, @vidrepar , @joxegr and @yassine3eth show what's inside, one post a day each on the tools they build.
A lot of finding bugs comes down to noticing changes first.
A proxy upgraded 25 days ago. 541 lines removed from a node client yesterday. A program editing its overview and scope.
Studio home now shows all of it next to the programs you watch and the work you have open.
On Aug 30, an attacker pumped a thinly traded governance token on Cronos, posted it as collateral, and borrowed $120.4M from Tectonic, the chain’s largest lending protocol.
It took 11 minutes.
The attacker manipulated both the token’s market price and its collateral value. Tectonic treated that inflated value as real and allowed the attacker to borrow $120.4 million across nine lending markets.
Cronos halted the chain and rewound 10,961 blocks, almost two hours of history, to reverse it. $9.19M had already left and is still unrecovered.
Most protocols don’t have a chain that can rewind. For them, the fix has to come before the borrow.
And this wasn’t a one-off. @trmlabs counted 32 price manipulation attacks in 2026 through early September. All of 2025 had 12. Price manipulation now accounts for roughly 1 in 8 crypto hacks, up from 1 in 17 in 2022.
Researchers are finding the same bug class before attackers do:
✦ 16 price and oracle manipulation reports have been paid/confirmed on @immunefi so far in 2026, already matching all of 2025.
✦ Since 2022, there have been 60 of these reports. 49 of them were critical or high. 26 were critical.
✦ That’s more than 8 in 10 at the top two severity levels.
Price and oracle manipulation bugs rank that high because they make a protocol believe something false about value. Every borrow and liquidation then acts on that wrong number. No phishing, no stolen key and no insider is needed.
When a researcher finds one first, they’ve found the path an attacker would use to drain the protocol, before anyone uses it.
The attacks are getting more frequent but so are the catches.
Crypto hacks more than doubled in a year: 207 in the first half of 2026, up from 83 in the first half of 2025.
Here’s what @MitchellAmador, CEO of @Immunefi, told @davidgokhshtein about why:
“It’s not, ‘Are they taking AI seriously?’… They’re not taking security seriously.
I can’t tell you how many teams I’ve talked to, including wallet teams, who are running their audits now through just AI, thinking that’s going to work, which is a joke. That doesn’t work at all. For one thing, the best capabilities are hidden from you…
People are telling themselves this lie so that they can spend less money… And so they’re getting destroyed over and over and over again.
We’re going into a world where it has never been easier to create hardened and safe code. But you have to put in the effort. And instead, people are learning exactly the opposite lesson.
Guess who’s learning that lesson real well? Attackers are learning that lesson real well. They’re on the frontier. They’re paying attention.
This AI is the beginning of a truly limitless era for on-chain applications. But guess what? It needs to start and end with security, and most of these guys aren’t doing that.”
Attackers probe your code every day, so your defense has to as well.
That’s what @Immunefi’s bug bounties and audit competitions do. In August alone:
✦ 424 valid vulnerability reports, up from 154 a year earlier, our biggest month on record
✦ 126 confirmed criticals, up from 14
✦ Researcher base up 55% year over year
Launching something with user funds at stake? Reach out.
