Protecting privileged onchain operations https://nitter.cf/t.co/Xx6yLshUEI
Joined December 2020
- Tweets675
- Following26
- Followers1.6K
- Likes588
Pinned Tweet
feeling grateful for the recognition 🙏
we’re working on more specialized and more focused ways to secure onchain interactions
onwards 🚀
At OKcontract Labs, we have been working for years on global security starting from frontend attacks.
And now we have a common ground for that research: Chainwall.
A Polymarket-style frontend compromise (like the good old Kyber one) would not rewrite the Chainwall onchain rules.
With Chainwall, injected JavaScript can display a fake transaction or request a malicious signature, but the account would still enforce pre-approved workflows, recipient restrictions, and independent approvals.
Control of the website alone would never grant permission to drain the funds!
⚠️ SECURITY ALERT: Polymarket faces a suspected frontend compromise as multiple users report WALLET DRAINS and unexpected signature requests.
Trading has been restricted to cancel-only mode, with relayer operations paused as the platform investigates to incidents.
The cause and scale of any losses remain unconfirmed.
Avoid the site and DO NOT sign unexpected wallet requests until official guidance confirms it is safe to proceed.
Find more about the incident on the OKcontract Incident Map: map.okcontract.com/?incident…
Just added Binance DevOps and EIP-7702 hot wallet drain to the OKcontract Incident Map.
At Chainwall, we are designing security mechanisms to prevent this kind of incidents.
A Binance-style laptop compromise should not give an attacker unrestricted control.
With Chainwall, assets sit in a smart contract whose code cannot be replaced through EIP-7702.
- Every execution must pass onchain policy checks.
- Compromising a signing service alone cannot bypass the account required approvals or authorized workflows.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
Find more about the incident on the OKcontract Incident Map: map.okcontract.com/?incident…
Attending @EFDevcon next week? Meet OKcontract team in Mumbai.
Our cofounder Henri Binsztok will give a talk about oksolc, a Solidity compiler in Zig released by OKcontract Labs.
📅 Wed, Nov 4 15:20
📍Lightning stage, Mumbai
oksolc 0.2.3 is out!
Fixed callback deadlocks, memory leaks, and a watch-mode bug that could overwrite its input. Faster dependency tracking on shared imports, too.
Still targeting solc 0.8.36, with the same bytecode 🙂
github.com/okcontract/oksolc
learn more: app.devcon.org/schedule/okso…
oksolc 0.2.3 is out!
Fixed callback deadlocks, memory leaks, and a watch-mode bug that could overwrite its input. Faster dependency tracking on shared imports, too.
Still targeting solc 0.8.36, with the same bytecode 🙂
github.com/okcontract/oksolc
By the way, oksolc 0.2.2 is out!
Fixed a bunch of tricky Solidity edge cases: deep inheritance graphs, recursive structs, immutables, and source URL hash checks.
Also fixed ABI size arithmetic beyond 4 GiB... good luck 🙂
Still targeting solc 0.8.36 compatibility, exact same compiler output.
github.com/okcontract/oksolc
oksolc 🚀
a new Solidity compiler written in Zig
builds 10 min → 2 min
incremental 700s → 99s
and most importantly: same bytecode
👉 github.com/okcontract/oksolc
OKcontract Labs | Chainwall retweeted
See you in Mumbai on Nov 2nd!
The DSS 2026 timetable is live.
Nov 1–2 · Mumbai · Amber + Pearl
Pick your talks, save a shortlist and share it with @summit_defi.
Agenda: defisecuritysummit.org/2026/…
Tickets: luma.com/9qtxqqxx
ALT DSS 2026 Day 1 Amber programme. All times IST. Schedule subject to change; full programme at https://defisecuritysummit.org/2026/agenda.
ALT DSS 2026 Day 1 Pearl programme. All times IST. Schedule subject to change; full programme at https://defisecuritysummit.org/2026/agenda.
ALT DSS 2026 Day 2 Amber programme. All times IST. Schedule subject to change; full programme at https://defisecuritysummit.org/2026/agenda.
ALT DSS 2026 Day 2 Pearl programme. All times IST. Schedule subject to change; full programme at https://defisecuritysummit.org/2026/agenda.
Onchain operations security goes far beyond smart contract audits. Even audited protocols can remain vulnerable through compromised signers, malicious front ends, custody or cloud infrastructure exploits.
As institutional adoption grows, we need to rethink how we approach security across onchain finance.
🎙️ Our cofounder @hbbiok joined Mike and Skyler on @AltFundsNetwork podcast to discuss these challenges, lessons from past security incidents, and how blockchain technology itself can become part of the solution.
Why smart contract audits aren’t enough to secure crypto assets?
Henri Binsztok of @OKcontract explains how compromised signers, malicious front ends, and AI-driven cyberattacks expose critical gaps in DeFi security—and how Chainwall aims to add another layer of on-chain protection.
#CryptoSecurity #DeFi #Blockchain
OKcontract Labs | Chainwall retweeted
Very busy day today
I almost forgot to tell that oksolc 0.2.1 is out! Make sure to update.
Many fixes thanks to Xiaohai Xu (sahuang on GH).
github.com/okcontract/oksolc
oksolc updates
Pushed multiple improvements to oksolc today
Major optimization to our slowest protocol in benchmark: Sablier comes down from 74s to 54s
Still the same byte output
Oh and we’re now using zig 0.17
Wish you all a good WE!
github.com/okcontract/oksolc
We're thrilled to announce that OKcontract cofounder @hbbiok will be speaking about security of multisigs at
DSS 2026 @summit_defi during @EFDevcon Mumbai
📅 Date: Nov 1-2, 2026
📍Mariott, Mumbai
Meet DSS 2026 speaker Henri Binsztok.
“Your Multisig Can Correctly Approve the Wrong Transaction”
Explore the talk and add it to My agenda:
defisecuritysummit.org/2026/…
Tickets: luma.com/9qtxqqxx
ALT DSS 2026 speaker announcement card for Henri Binsztok: Your Multisig Can Correctly Approve the Wrong Transaction
Thanks a lot to @hackerbane for the first audit of oksolc!
We reviewed all 29 findings and fixed 21, including one critical issue. We are happy to see the community contributions towards a better, secure Solidity compiler.
oksolc GitHub is: github.com/okcontract/oksolc
Merged PR (including the report) is: github.com/okcontract/oksolc…
Nice to see oksolc, our Solidity compiler implemented in Zig, mentioned by the Ethereal news. Thanks!
If you building on Solidity and want to speed up your development, oksolc might save your precious time github.com/okcontract/oksolc…
Ethereal news mini #2
🖼️ @ethPandaOps Hegotá upgrade frames-devnet-0 live
2⃣ @Nethermind 2.0.0
🧪 @asanso Daisugi post quantum testnet
ethereal.news/ethereal-news-…
The SEC’s new proposal marks an important development for crypto asset custody:
→ Crypto assets could be held in self-custody under certain circumstances
→ State trust companies could serve as custodians for client and regulated fund crypto assets
Chainwall is designed to make self-custody secure — allowing owners to maintain direct control of their assets while accessing onchain yield safely.
sec.gov/newsroom/press-relea…
OKcontract Labs | Chainwall retweeted
Still optimizing oksolc, starting to focus on the YUL optimizer
Now up to 22% faster!
github.com/okcontract/oksolc
