Custodia Security (@CustodiaLab) header
Custodia Security (@CustodiaLab) profile picture

Custodia Security

@CustodiaLab

Team Behind 0xAlix2

Joined April 2026
  • Tweets19
  • Following2
  • Followers26
4Media
Photo by Custodia Security (@CustodiaLab)Photo by Custodia Security (@CustodiaLab)Photo by Custodia Security (@CustodiaLab)Photo by Custodia Security (@CustodiaLab)
Introducing CustodiaSec - smart contract security, done right. We've been auditing quietly under the radar. Now we're making it official. Known in the contest scene as 0xAlix2, we've competed across Sherlock, Code4rena, Cantina and Immunefi with consistent top placements. But contests were never the full picture. We've been running private audits for different projects, building a track record one review at a time. If you're building in DeFi and want your contracts reviewed before shipping, let's talk. Read our public reports: custodiasecurity.xyz
1
2
7
580
🚨 BIG NEWS: Custodia Security is merging with @ValkyriSecurity We share one vision: Web3 security must go beyond smart contracts. By bringing our teams together, we’re strengthening our ability to secure the entire stack, from protocols and dApps to the infrastructure behind🧵
Image from Custodia Security (@CustodiaLab)
2
2
1
10
529
🔐 One team. Broader coverage. Stronger security. From smart contracts and frontends to APIs, cloud, and off-chain systems, all under one roof. With @kvazar_ai, we’re building an AI security engine that uncovers risks traditional audits miss.
1
6
39
Building in Web3? We help teams find critical vulnerabilities before attackers do, combining manual expertise with an automated AI engine. Protocol, dApp, or infrastructure- let’s secure it. 📩 DM us to get started.
6
26
We've been noticing something lately. The demand for web2 security reviews in web3 projects is rising. It makes sense. Your dApp has layers: → Smart contract (on-chain) → Off-chain backend / API → Frontend → Infrastructure & cloud config → Admin panels & internal tooling A reentrancy bug can drain your pool. A misconfigured API can hand an attacker your private keys without touching the chain. The space is maturing. Builders are starting to think beyond the contract. Security isn't just about what's on the blockchain. It's about everything that talks to it. If your off-chain stack hasn't been tested yet — it probably should be. Reach out.
2
11
767
Must-read. Web3 scammers are getting more sophisticated from social engineering to RCE attacks. This breakdown is exactly the kind of security awareness our space needs. Stay sharp out there.
Guy (@guy_de) profile pictureGuy
@guy_deApr 15
Last week, two separate hiring scams nearly made it into our recruiting pipeline. Different people, different companies, different setups, but similar playbook. Sharing the full breakdown and the learnings, so that you won't fall for the same trap. Stay safe
4
128
$DOT 🚨 $237K was drained from Hyperbridge's TokenGateway today in one of the cleanest cross-chain governance exploits we've seen in 2026. No flashloan. No reentrancy. JUST a single forged Merkle proof. Here's the full attack breakdown and what every bridge builder must learn from it.
1
1
4
175
more replies
Damage: With proof accepted, the attacker executed a ChangeAssetAdmin message transferring full admin control of the bridged DOT token to their own contract. Then they: - Minted 1,000,000,000 DOT - Routed it through Uniswap V4 via OdosRouter - Pocketed ~108.2 ETH
1
2
64
Why it worked The exploit succeeded because of a design failures: ❌ Merkle proof accepted trivial single-leaf proofs ❌ challengePeriod = 0 — no dispute window whatsoever ❌ Admin transfers had no time-lock or multi-sig
2
63
🚨 EXPLOIT ANALYSIS: SubQuery Network $SQT 🚨 $130K lost on 2026-04-12 Root cause: Missing onlyOwner on Settings.sol setters A textbook Missing Access Control bug. Here's the full breakdown thread 🧵
2
2
9
724
more replies
Result: 218,000,000 SQT (~$130K) unbonded and drained instantly. TX: basescan.org/tx/0xd063b3848a…
Base Transaction Hash: 0xd063b3848a... | BaseScan

Base Transaction Hash: 0xd063b3848a... | BaseScan

2 Contracts Created | Success | Apr-12-2026 05:04:45 AM (UTC)

basescan.org
1
4
99
The fix is a simple modifier // Vulnerable function setContractAddress(uint256 id, address addr) external {...} // Fixed function setContractAddress(uint256 id, address addr) external onlyOwner {...} Fix was done but it was a bit late 😅
Image from Custodia Security (@CustodiaLab)
4
90
Audit complete. @NetworkNoya x Custodia Security, report is live. Full report + all our reports → custodiasecurity.xyz/
Image from Custodia Security (@CustodiaLab)
1
1
6
660
Load more