CEO @Fidesiumapp | Blockchain Security Partner Smart Contract Security • Manual Audits • Exploit Analysis • Onchain Security Building Autonomous Security Tools
London, England
Joined August 2008
- Tweets1.7K
- Following589
- Followers459
- Likes4.1K
Pinned Tweet
The audit model is broken and everyone knows it.
You once paid $200k. You wait 8 weeks. You get a PDF. Then your protocol evolves and the audit is already stale.
That's not security. That's a snapshot.
We started @Fidesiumapp because security should be continuous, not ceremonial.
Human auditors catch what machines miss. Automated and AI tools catch what humans can't scale to review. Neither alone is enough.
The future isn't audit OR automation. It's both, working together.
And now they are going after the people who try to track their ill gotten gains.
This is an interesting new discovery about the hack.
The sweeper that the theives used left 1 ETH in every wallet to make sure there was gas for later transactions and not set off alarms.
Reading the reconstructed bytecode of the Binance EIP-7702 sweeper (`0x63e8...6fae`) is wild.
This wasn't a generic drainer. It was custom-engineered for Binance 14's architecture:
- Leaves exactly 1 ether behind (`bal - 1 ether`) when sweeping ETH so Binance's automated hot wallet queue wouldn't error on gas and trip alarms.
- Uses raw `staticcall` + `continue` loops with custom error codes (`SweepItemFailed`) so one bricked or blacklisted ERC-20 wouldn't revert the $6B batch.
- Includes a custom `callExecute` function to impersonate Binance 14 as controller of an external vault holding $823M in USDC.
They leave a comment: "robberies could be prevented if getaway cars were slower."
You can't fully blame EIP-7702, but it sped up the attack. Without 7702, draining 64 tokens plus an external $823M vault from a live exchange hot wallet meant fighting moving nonces across 70+ transactions. Defense systems would've killed it after tx #3.
With 7702, Lazarus sprayed 50 consecutive nonces in one type-4 payload, turned an EOA into a custom proxy, and atomically swept billions in a single block.
Ethereum core devs built the ultimate getaway car. Surgical state-sponsored engineering.
This could be etched onchain:
`if (bal > 1 ether) { to.call{value: bal - 1 ether}(""); }`
Readers added context they thought people might want to know
The quoted comment appears only in an AI-reconstructed source (explicitly labeled not original) uploaded to explorers; no source comments exist in deployed bytecode, and core features match independent decompilations/on-chain data.
etherscan.io/address/0x63e8…
gist.wavey.info/Ta3FgAxastgj42…
x.com/thearsondragon…
Thanks for the shout out.
This situation is nuts and only getting worse.
Whoever emptied a Binance hot wallet had 50 authorisations signed with that wallet's own private key, on-chain data shows.
🤡🌎
this is a not-so friendly reminder that every builder in crypto needs to constantly test and evaluate their OpSec standards.
there’s quite literally billions at stake.
especially as nation states and AI infrastructure evolves we’re going to see more of these attacks and you need to invest into your defences.
here’s a great starter guide that adapts a Soc2 framework to web3 built by our @SuperteamUK members:
👉 fidesium.com/soc2-field-guid…
prioritise your company’s security & defences 🫡
bock retweeted
‼️ UPDATE ON THE BINANCE HACK:
Whoever emptied a Binance hot wallet had 50 authorisations signed with that wallet's own private key, on-chain data shows.
Under Ethereum's EIP-7702, an authorisation is a signed permission that lets a wallet hand control of itself to code.
Each one works only for the wallet's next transaction number, its nonce. Binance's wallet was still sending transactions, so that number kept moving.
The sender didn't know which number would be live, so they packed all 50 into one transaction, Blockaid says. One matched.
That one installed a sweeper contract on the wallet. Blockaid found that only the Tornado Cash-funded sender can operate it.
Minutes later it emptied the wallet of $1.6B in USDT, 167,464 ETH and 60+ other tokens.
Only that key, or the system that holds it, can produce those signatures. How the sender got them is unknown.
Across Ethereum, Bitcoin and Tron, at least $5.57B left Binance-linked wallets.
Binance says user funds are "completely safe" but has not explained how.
$6.3B drained from Binance in under 4 hours. ~$3B frozen.
The rest mostly BTC/ETH that can’t be stopped.
Binance’s own finding say that it was one compromised DevOps engineer’s laptop let an attacker reach an internal service container that could submit withdrawal requests. No private keys were leaked and the signing system accepted and executed the requests by design.
A single employee device had a path to authorize withdrawals from hot wallets holding billions across multiple chains. Once that laptop was owned, the attacker could make Binance’s own infrastructure sign and send the funds—including using EIP-7702 on Ethereum to turn a hot wallet into a sweeper that kept draining it.
This isn’t “bad opsec.” It’s architecture and process design that boggels the mind. Allowing a developer laptop to be a viable entry point to production with withdrawal authority is insanity.
This is a similar pattern as the Bybit hack. The industry keeps treating the keys as the hard problem while leaving the operational layer around them with single points of failure.
Binance's initial investigation suggests that the security incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions. We have found no evidence of any wallet private key leak. We will share a detailed technical post-mortem once the investigation is complete and the facts are fully verified.
The estimated total impact sits at around $6.3B. We have worked with blockchain partners to freeze affected assets, with ~$3 billion frozen on-chain so far.
Binance will cover all losses from the SAFU fund and the company’s funds. User funds are safe. We will also publish an updated Proof of Reserves once the remediation is complete.
As an immediate precaution, Binance has:
- temporarily suspended deposits and withdrawals while security checks are completed;
- revoked the affected address authorisation;
- engaged law enforcement and blockchain intelligence partners to trace and recover funds.
Our teams are working around the clock to resolve this issue safely and thoroughly. We are working closely with our law enforcement partners to confirm the identity of these criminals and bring them to justice.
Please rely only on official Binance channels for updates. Please feel free to contact Binance Customer Support if you have any further questions.
binance.com/en/support/annou…
Killin' it!
I've spent most of 2026 hunting on bug bounty programs. So far, I've found and reported more than 100 zero-days: 4 critical, 12 high, 55 medium, and 51 low severity findings. Write-ups are coming.
I've also participated in Immunefi audit competitions, and I'm currently ranked in the top 500 on the platform over the last 90 days.
And yes, AI is a key part of my workflow.
I don't use it to switch my brain off. I use it to challenge assumptions, explore adversarial ideas, and answer questions faster. It's a tool.
At the same time, Claude and GPT models are becoming increasingly restrictive for some of the challenges security researchers face in 2026. Models such as Kimi K3 and DeepSeek Flash V4.1 are becoming more useful than many of us would have expected.
What I believe comes next is building specialized security workflows where deterministic systems and LLM-based reasoning work together.
I don't think the future of AI security research is simply throwing more compute at a target and hoping vulnerabilities fall out.
That approach eventually hits two ceilings.
The first is reliability. Hallucinations and imperfect reasoning can cause models to miss branches, alternative execution paths, edge cases, and possible states.
The second is economics. More context, more agents, more tokens, and more frontier-model calls eventually create a very real cost ceiling.
I believe we can achieve strong cybersecurity results without relying on brute-force compute.
We should start thinking seriously about these future problems today if we want to keep an edge.
I have said it before and I will say it again. LLMs are an opsec nightmare.
A while ago people touted the pithy soundbite "privacy is dead". With LLM's and todays AI, it really is.
The level of GDPR and data privacy breaches across all businesses and everyday life now must be so vast, that it makes a mockery of any of this legislation. Privacy policies broken, laws broken, data shared ubiquitously into black boxes where possibly even the operators of those systems don't know exactly what is being processed where or how, because AI today isn't entirely explainable in the sense of audit trail.
It's not yet clear what the implications are; but it's going to be messy :)
If you are around for the London Hacker House @abepolishchuk and @Fidesiumapp will be doing security office hours Thursday the 5th.
Thanks @CapinUK and @SuperteamUK London Solana is the best Solana.
London Hacker House agenda is live.
12 days at Somerset House, Sun 1 Nov to Solana Demo Day on 12 Nov.
You’ll be learning from the teams behind 👇
@anza_xyz
@triton_one
@solanamobile
@Superteam
@RockawayX
@animocabrands
@Helius
@inside_r3
@ikadotxyz
@tokenGBP
@CFBenchmarks
@FluxRPC
@Multichain
@Flight3official
@FoundationVent
@useDecal
@nosana_ai
@reflectmoney
@landeddigital
@AtelierVentures
@TruYields
@aomi_labs
@solomon_labs
@bonfiresai
@GreedAcademy
@JET_EUROPA_
@EYEKONSTUDIO
Free to join. Pick your days and sign up: luma.com/london-hh-26
Security generally only gets a look in the final week before launch in web3. That's also when fixes cost the most.
I will be giving a lightning talk on what security looks like during development instead. 15 minutes of talk, 15 of live Q&A.
Wednesday, November 4, 4:00 PM GMT. Hosted by @truscova with @Fidesiumapp
Save your spot.
Another day another zero-day world ender. Happy Wednesday.
‼️ Anthropic and Google researchers found a flaw that lets one crafted packet hijack a server during network boot, before Secure Boot checks the OS.
Almost all servers on earth are affected.
CVE-2026-97631 sits in TianoCore EDK II, code in the UEFI firmware of most servers.
Readers added context they thought people might want to know
The vulnerability is limited to servers actively PXE network-booting with vulnerable EDK II firmware; most servers boot from local disks and are unaffected in normal use, with Intel noting limited impact on supported products.
github.com/tianocore/edk2…
arstechnica.com/security/2026/…
Crypto talks endlessly about onboarding the next billion users, and the ones after that.
Exchanges publish research about payments, yield, and tokenized assets bringing in the masses. Founders pitch “financial infrastructure for everyone.”
Then you actually try to find or understand most projects as a normal person and the gap is glaring.
The SEO is often terrible.
A lot of sites are one-page marketing landings or JavaScript-heavy dApps that render as empty shells to crawlers. Content that should rank for “how does this work,” “is this safe,” or “what problem does this solve” sits behind wallet connects or doesn’t exist as proper pages at all. Google treats crypto as YMYL (Your Money or Your Life), so it already demands high trust signals—anonymous teams and thin, jargon-filled pages make that harder. Paid ads are heavily restricted, which makes organic search one of the few scalable channels… and yet a huge number of projects treat it as an afterthought.
The result: the people searching “how to earn yield safely” or “best way to send money abroad cheaply” mostly find exchanges, scams, or outdated explainers instead of the actual protocols claiming to serve them.
The explanations are even worse.
Insiders suffer from the classic curse of knowledge. What feels obvious (“it’s just a shared ledger + smart contracts”) is opaque to almost everyone else. Surveys consistently show large numbers of people can’t name a single clear benefit or risk. Landing pages and docs default to tokenomics, L2s, intents, restaking, and liquidity pools without translating any of it into something a regular person cares about: lower fees, faster settlement, ownership of their own money, or access they didn’t have before.
There is a huge storytelling problem. Features and charts instead of clear “here’s why this matters to you and how it works in plain English.” The industry wants retail and the next billion. The websites and messaging are still mostly built for people who already live on Crypto Twitter.
Until that changes, a lot of the “onboarding” talk stays aspirational. The technical rails can scale; the discoverability and clarity haven’t caught up.
Let’s not even talk about the constant stream of hacks and security incidents.
The kind that wipe out funds, erode trust overnight, and make the average person wonder why they’d ever risk putting real money into something that still feels this fragile.
We are never going to get there if everytime someone onboards to crypto their funds disappear in less than a month.
I mean I thought I had seen peak degen, but this is next level. More security....naw. Lets just bet on it!
You can now trade protocol revenue and exploit odds. We're partnering with Trueo to launch new prediction markets that settle based on DefiLlama data.
Revenue Markets
If you follow the revenue meta, you can now trade that directly on Trueo. We launched markets for Hyperliquid, Pump, Aero, Uniswap, Collector Crypt, and Papertrade revenue.
Exploit Markets
Hedge against exploit risk by trading the odds of total DeFi hacks and exploits of specific protocols. We have markets for whether there will be exploits of Aave and Morpho this month. We also have weekly and monthly markets for the size of the largest hack.
Other Onchain Metrics
Robinhood Chain RWA mcap, Robinhood Chain DEX volume, and whether Solana or Base ends the week with higher TVL.
defillama.com/predictions
This goes deeper and worse than originally thought. eMudhra’s 8 intermediate CA private keys were tiny numbers (one was literally d=4). Anyone could recover them in <1s from the public certs and forge valid certs for MITM attacks on TLS clients including python.org/PyPI.
Python users must update pip to ≥26.2.2; OS-level distrust is useless because pip always loads its vendored certifi too.
discuss.python.org/t/informa…
(The keys were not stolen, they were generated that weak during a botched key ceremony in April 2025 and stayed recoverable the whole time.)
Well I don't think we are going to forget October 21st for a little while.
PHP2Shell: Critical unauthenticated RCE flaws in PHP core (patched today; early/mass exploitation risk).
LiteLLM 1.107.0: Malicious PyPI/Docker package that steals credentials and plants a backdoor on Python startup.
SBI Dark Web Leak: India’s largest bank confirmed ~3,900 customer records with PII among ~375k dark-web records.
SafePay Ransomware: CISA/FBI advisory: 600+ critical-infrastructure victims worldwide since 2024.
UpdraftCentral Keys: TeamUpdraft breach let attackers use stolen keys to backdoor WordPress sites.
Immediately patch PHP, scan for LiteLLM 1.107.0 and rotate secrets if found, enforce MFA and offline backups against SafePay, and audit WordPress/UpdraftPlus sites for backdoors.
bock retweeted
I strongly recommend to all our clients and even non clients to check out your back end
This might be the remaining piece to close a complete drain exploit on your business
‼️ BREAKING: Two leaked remote code execution flaws in PHP are real, watchTowr confirms.
PHP will ship fixes for two critical flaws, both rated CVSS 9.2, on Wednesday 21 October at 14:00 UTC, a day before the embargo was due to lift.
CVE-2026-109618 and CVE-2026-109619 first surfaced in a Hacker News post whose author admitted having no evidence beyond "source: trust me, bro".
Kevin Beaumont flagged the leak, and watchTowr confirmed it two hours later.
PHP says it may release sooner if details go public or exploitation appears. It has not named the CVEs or the affected versions.
So a couple months ago I started moving our banking because @Revolut decided to turn off treasury functions with no announcement.
Their customer service promised to get back to me and lost the ticket. After leaving me in limbo for 2 weeks I was finally responded to.
I asked for a refund of that months business banking fee because of the inconvenience and the horrible customer service. I was told to pound sand.
The recent @Revolut outage and lack of coms is the opposite of a surprise.