Proof of Exploit

Great to be back on the @IslandDAO stage! We audit @Solana projects in hand-picked cohorts. Here are the results so far Cohort 1: IslandDAO projects, vulnerabilities found in every single one Cohort 2: top projects of @SuperteamBR, first critical found within two hours Cohort 3: live now and we are onboarding now, with limited spots available

The biggest crypto heist in history just happened Thursday evening, the largest crypto exchange @binance got hit and about $6.3 billion was taken Here’s how they did it 👇 The attackers got into one engineer’s laptop. From there they reached the system that approves Binance’s withdrawals and made it approve the transfers for them They didn’t steal the secret keys, they made Binance’s own system sign the transactions, bypassing security measures The attackers were well prepared, data shows they spent at least 36 hours preparing and rehearsing the whole attack before hitting Then they emptied the wallets in about 20 minutes, pulling off the largest crypto theft in history The good news is that actors in the ecosystem acted fast, roughly half the money has already been frozen by parties like @circle and @tether It's expected Binance will be able to cover the rest so users don’t lose their money Unfortunately we expect these types of attacks and incidents to only get worse for the foreseeable future as AI gets smarter and hackers continue to master it Investing in your cybersecurity is now more important than ever

For too long, high-quality security audits were a privilege reserved for well-funded projects Not anymore We’re proud to announce that we got to audit @cloak_ag, a @colosseum backed privacy project Within the first 2 hours, we identified a critical vulnerability and worked with Cloak to patch it immediately. Funds are SAFU. To support the next generation of Solana builders, we’re offering: > 1 FREE full security audit for the next Colosseum Grand Prize winner > 50% OFF security audits for every team accepted into the next Colosseum accelerator batch (full audit for only $2.5k) AI has changed the game. Hackers find vulnerabilities faster than ever Security needs to evolve just as fast. We are Proof of Exploit, and we make security accessible to every builder on @solana

4 months ago we both quit our jobs to build something we believe in Met by coincidence, won a hackathon, and never stopped building We just submitted Proof of Exploit to @colosseum 🔓 Here's what we've built, why we built it and how we got here 🧵

September was our biggest month yet Started in Bali, ended at the @SuperteamBR Garage in Brazil In between: a full relaunch, our first ambassador cohort, a reworked audit workflow & heads down building for @colosseum Our recap is live👇

⁠Three weeks ago we were in Bali. Working from our villa every day, ordering food in, laptops by the pool Locked in, barely leaving the villa Then @RegiRegiRegi123 jumped on a call with @shimas_sol, just catching up ⁠By the end of it, he had me completely convinced: we had to come to the Garage in Brazil 🇧🇷 It was 11pm. @SyotoshiX was still working, with his laptop by the pool in the dark "We need to go to Brazil" ⁠He looked up from his laptop. "What?" ⁠Two minutes later, he was convinced and we booked the flight the next morning ⁠Five flights later (Indonesia → Bangkok → Vietnam → Netherlands → USA → Brazil), we're at the @SuperteamBR Garage Thank you @kukasolana, @shimas_sol and @kauenet for the spontaneous invite and for treating us so well ⁠We have big things cooking for @colosseum and Superteam members. Stay tuned.

Millions of dollars in NFTs were vulnerable until a whitehat hacker @0xQuit took it upon himself to rescue them! Here is the story: A massive hack just took place via the @MagicEden NFT marketplace A bug in an old smart contract used by the marketplace, allowed hackers to use an old wallet approval from users to steal their NFTs and approved balances! The marketplace itself was already gone, but the wallet approvals users granted years ago were still sitting onchain That meant NFTs could be pulled from those wallets without the owner signing anything new After a few initial reports, the scale started to become more obvious, this was not a one-off theft It was an open door across a huge set of leftover approvals On the newer version of the contract an emergency pause could be triggered but this was not possible on the older version of the contract @0xQuit quickly realized this and started going to work in a race against the malicious hackers The goal was simple, steal the vulnerable assets and secure them before the malicious hackers could do so By morning, the whitehat managed to secure more than $5.7M in NFTs Unfortunately the malicious hackers realized not only NFTs but also approved WETH and USDC balances could be stolen The total reported theft (beyond the rescued NFTs) has been estimated at $2.8M+ but would have been significantly bigger without the hero whitehat hacker coming to the rescue!

The future of Solana just changed because of a few last-minute calls by @mert In case you missed it, @solana wrapped up a governance fight and one of the proposals came down to a hair Here is what happened: > The first proposal changes voting for Solana: who gets a say & what it takes for a change to go through It passed quickly > The second proposal was the real fight. It reduces the amount of new solana:So11111111111111111111111111111111111111112 printed per year for staking & validator rewards > Hours before the deadline it was still short. Then @krakenfx’s big validator flipped from no to yes, Galaxy moved with it, and Mert kept calling until the votes landed In the end the vote passed with 67%, just 0.33% above the threshold! > The third proposal wanted to change fees so the network would burn a lot more SOL It failed after too many people sat it out or disagreed Solana now has clearer rules and a path to print less SOL, but the big daily burn is off the table This goes to show how the last few votes on a proposal can change the course of direction for the entire network

Avici, a Solana-based neobank got drained for over $1M last night @avici didn't write the code that failed. They built on Rain's infrastructure, and they got exploited What happened: > @raincards smart contracts were running an old version with a flaw in how they checked permissions > The attacker got the program to accept signatures it shouldn't have > Made themselves admin on people's collateral accounts, then withdrew their money > The attackers then bridged the funds from Solana to ETH and laundered them through Tornado Cash Rain has upgraded the contracts and halted activity. Avici has confirmed the issue, pledged full refunds, and reported it to the FBI The lesson isn't about Rain or Avici. It's that you inherit the security (flaws) of everything you build on

Getting the work done, anywhere, anytime Prepping the security audit pipeline for benchmarking 💥

After wrapping up day 2 of @CoinfestAsia in Bali, we’re still processing how different this one felt compared to most crypto events we’ve been to At the majority of conferences and festivals, the room is usually full of builders, developers, founders, and people already deep in the space This event felt different, many local Indonesian students and young people who came specifically to learn Not necessarily to network for jobs or raise money, not to flex their projects, just genuinely curious about crypto, asking basic to intermediate questions, taking notes, and wanting to understand how this whole thing actually works The hunger for knowledge was very real. It felt less like an industry meetup and more like watching the next wave of local crypto natives form in real time Indonesia’s adoption story is still in that pure education phase in a lot of places, and you could feel it at Coinfest Day 2 of Coinfest we spent at the @MeteoraAG x @bitget side event Great location at a private villa village with a little night market of food & drink stands and a nice environment to meet people We ended up having some genuinely interesting conversations with people from both the local and international side Met @Friday_SOL & @Efunderf from @SuperteamINDO to discuss how we can collaborate and help Indonesian builders ship secure code Bullish on Indonesia! 🇮🇩