Co-Founder @ShieldifySec Taking your smart contracts' security seriously!
Joined April 2022
- Tweets2.3K
- Following596
- Followers2.9K
- Likes7.5K
Martin retweeted
🚨 Binance suspected hack: $5.5B+ drained, the largest crypto theft ever (Bybit was $1.5B)
What we know:
• 20:24 UTC: Binance 14 hot wallet sends 167K ETH, 1.6B USDT and 60+ tokens to a fresh address in one tx
• 3 min earlier: a Tornado Cash funded address installed an EIP-7702 delegation on the hot wallet
• Total outflows: ~$3.5B on Ethereum, ~$1.44B in BTC, ~$630M on Tron
• Tether froze 1.57B USDT, Circle froze 823M USDC (~$2.4B total)
• Binance: investigating, says user funds are SAFU. CZ: “it does look like a hack”
The real concern: ETH, BTC and TRX can’t be frozen. Watch for laundering via DEXs and mixers.
The 7702 detail is the one for devs to study. A delegation persists and can authorize later transfers without another signature.
Not confirmed by Binance yet. Follow official channels only and beware of scams.
Track the hacker wallets: arkm.com/explorer/entity/21a…
Martin retweeted
Security is more important than ever for this space to scale.
Please integrate AI into your workflow, but never fully rely on it.
Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe.
Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.
Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.
Security is more important than ever for this space to scale.
Please integrate AI into your workflow, but never fully rely on it.
Our teams are aware of reports of a potential security issue and are actively investigating. User funds are completely safe.
Our security teams are reviewing all relevant information with urgency, and we will provide updates through official Binance channels as soon as we have verified information.
Users should remain cautious of scams and should not trust unofficial links, messages, or requests for account information.
Martin retweeted
We're partnering with @unhosted, the self-custodial smart wallet built on ERC-7702 smart accounts 🤝
Shieldify is proud to be their security partner, for the long term, backed by our 6-layered security approach 🫡
Martin retweeted
Groth16 verifier bug: gamma and delta in the verification key were set to the same G2 point 🙃
They must be independent. When they match, the pairing equation collapses and valid-looking proofs can be forged with no deposit and no witness
That is how Foom Cash lost $2.26M in March. The cause: one snarkjs Phase 2 setup step was never run
Math was fine. Setup was not
rekt.news/the-unfinished-pro…
Martin retweeted
Talent onboarding is one of the biggest gaps in Web3 security.
Too few people are actively helping newcomers break into the space, learn from others and build meaningful connections.
Bringing people together, sharing knowledge and creating opportunities to grow is the way.
Martin retweeted
New shieldify.org is live 😱
Request an audit in a few clicks, and browse 170+ security reviews filtered by chain, language and status.
shieldify.org/audits 🫡🫡
Martin retweeted
The @ShieldifySec Team has been absolutely amazing to work with and their communication is always on point.
Very excited to announce RABtools/ RAB Engine has gone through the smart contract audit!
We will be doing a soft launch for a small group of users to start utilizing RAB Engine and our automated services.
🔺👁️
New Audit Completed: @Rabtools on @avax 🔺
A treasury management system on the Avalanche network that automates reward claiming and compounding for Pharaoh AutoVault positions.
Users deploy personal treasury contracts, pick a reward asset (USDC, WAVAX, or BTC.b), and let a bot handle claiming, compounding, and restaking on autopilot.
Read the full report 👇
github.com/shieldify-securit…
Martin retweeted
New Audit Completed: @Rabtools on @avax 🔺
A treasury management system on the Avalanche network that automates reward claiming and compounding for Pharaoh AutoVault positions.
Users deploy personal treasury contracts, pick a reward asset (USDC, WAVAX, or BTC.b), and let a bot handle claiming, compounding, and restaking on autopilot.
Read the full report 👇
github.com/shieldify-securit…
Martin retweeted
Solid resource 😱 This is one of the most structured open-source prompt packs I’ve seen for bug bounty hunting!
@mdp_sec broke down their entire workflow into 10+ reusable phases:
→ Recon & surface mapping
→ Authenticated access setup
→ Endpoint & vuln-class sweeping
→ Browser-based walkthrough
→ Critical-impact hunting
→ Triage, dedup & validation
→ Independent verification gates
It’s Web2 focused, but the methodology is gold for anyone building AI-assisted security workflows. The evidence-first, phase-by-phase structure is exactly how you avoid hallucinated findings and actually produce reliable results: github.com/mdpsec/bug-bounty…
Martin retweeted
Another audit report for @pear_protocol is live ❇️
We reviewed their PEAR → PEAR migration to HyperEVM: a one-way LayerZero bridge, rate-limited minting, staking migration with preserved timestamps, and the HyperCore spot listing.
Read the full report 👇
github.com/shieldify-securit…
Martin retweeted
✅ Audit completed by Shieldify (@ShieldifySec)
Our contracts were reviewed and the fixes are in, so the code is solid before anyone trusts it with real funds.
Now $DRKW launches.
Review the audit 👇
github.com/shieldify-securit…
Another Robinhood Chain protocol audited ✅
@DarkWalletRH came out of our review with informational findings only. Clean code, solid design, and a team that clearly takes security seriously.
Read the full report 👇
github.com/shieldify-securit…
Martin retweeted
Another Robinhood Chain protocol audited ✅
@DarkWalletRH came out of our review with informational findings only. Clean code, solid design, and a team that clearly takes security seriously.
Read the full report 👇
github.com/shieldify-securit…
New audit partnership with @darkwalletrh 🤝
Dark is a self-custodial privacy wallet on Robinhood Chain. Your USDG balance and private transfer amounts are encrypted on-chain, and selective disclosure lets you prove only what you choose. Not a mixer, just your wallet, kept to yourself 🔒
Audit report coming soon! 🤫
Martin retweeted
Another security RFP closed on @procur3
This time for a pentest of a wallet.
Congrats @ShieldifySec team on winning the engagement.
Our comparison tooling allows you to shortlist auditors based on relevant experience, merit, timelines and so much more.
Decision making becomes easier and protocol teams have confidence in the selection they make.
gProcur3
A wallet provider put one scope to the market and let specialist firms compete for it.
The wallet team compared coverage, timeline and named reviewers before making the award.
Congratulations to @ShieldifySec on winning the engagement following a competitive RFP process
Martin retweeted
Hash-perfect decompilation of a Solana program is now a thing.
@osec_io went from a 220KB .so blob to byte-identical Rust source for GoonFi V2, using agents scored on how closely each function matched the original bytecode.
The bug they found once the code was readable? The AMM priced assets off its own vault balance. Donate tokens, skew the price, drain the other side. $6.1M at risk.
If your program is live, assume your source is public.
osec.io/blog/goonfi-decompil…
