“I am putting myself to the fullest possible use, which is all I think that any conscious entity can ever hope to do.” I work at Hypernative. Opinions my own.
Joined October 2022
- Tweets1.4K
- Following3.5K
- Followers1.6K
- Likes7.8K
I am going to Inside the Binance Hack And What’s Really Happening in Onchain Security Right Now. Join me! luma.com/inside-binance-hack… via @LumaHQ
Sam Friedman retweeted
Onchain data now confirms Binance hot wallets were drained. Here's what we know so far:
→ From about 20:10 UTC, Binance hot wallets on Ethereum, Arbitrum, Optimism, Base, Solana and Bitcoin, and likely Tron and Avalanche, sent funds to fresh attacker addresses.
→ Losses are $3.6B+, with public estimates up to ~$5.8B.
→ Every outflow was authorized with the hot wallets' own keys . How the attacker got signing access is not yet known.
→ On Ethereum, Binance 14 was taken over with EIP-7702 and is still delegated to the attacker's contract.
→ Tether and Circle have frozen part of the stolen USDT and USDC. ETH, SOL, BTC and most other tokens can't be frozen and some are already moving.
Timeline (UTC)
1️⃣ 02:28: The attacker deploys a test version of a drainer contract.
2️⃣ 15:59: The drainer contract goes live. Only the attacker can call it.
3️⃣ ~20:10: Binance hot wallets begin sending funds to attacker addresses.
4️⃣ 20:20: One transaction carrying 50 pre-signed authorizations from Binance 14 delegates the wallet to the drainer contract.
5️⃣ 20:24: A single call sweeps ~167K ETH and ~64 tokens from Binance 14.
6️⃣ 20:41 and 20:59: The same delegation is used to move ~$823M USDC out of another Binance contract.
7️⃣ 21:04: Binance 14 is swept again.
8️⃣ Since then: USDT was swapped to ETH ahead of the freezes, and BTC is being split into 1,000 BTC chunks.
What to do
→ Keep exposure to Binance reduced until Binance confirms its hot wallets are secure.
→ Do not send funds to Binance 14 (0x28c6c06298d514db089934071355e5743bf21d60). It is still delegated to the attacker's contract, so anything that arrives there can be swept.
→ Exchanges, OTC desks, bridges and other venues taking deposits: screen and block inbound funds from the attacker address (0x5227f603c1ee34ce3c06efe6477003bdfccb2f8c).
Sam Friedman retweeted
The Claude Code team shared their approach to code reviews. They keep architecture and direction as human decisions.
Yet they ask “If machines do most of the reading, how does anyone learn the code?” and answer “We don’t have a formal process for this. Nobody on the team keeps a complete mental model of Claude Code in their head, and we don’t think anyone needs to.” (1/5)
Sam Friedman retweeted
Meet DSS 2026 speaker Akand Sitra.
“Web3 Security - Real-Time Monitoring”
Open a talk and save it to your agenda.
defisecuritysummit.org/2026/…
Tickets: luma.com/9qtxqqxx
ALT DSS 2026 speaker announcement card for Akand Sitra: Web3 Security - Real-Time Monitoring
Sam Friedman retweeted
Post-fact alerts are cheap. Prevention is hard because automated action needs high conviction and low noise. Hypernative keeps adding public, verifiable cases of it working. Latest: Kodiak’s automated pause stopped an exploit on BeraFarm that could have cost $250K+. Zero funds lost.
On Oct 9, 2026, Kodiak's real-time security monitoring (powered by @HypernativeLabs) detected a malicious contract targeting a vulnerability in an external vault provider's contracts that interacted with Kodiak Islands. NO FUNDS WERE LOST.
As designed, our pre-configured automated response with Hypernative paused all Kodiak Islands within seconds, before the attacker could execute the exploit. The pause closed the route the exploit needed and stopped an attack on an external ecosystem protocol, BeraFarm.
No Kodiak user funds were lost or extractable. The simulation estimated a loss of at least $250K had the exploit succeeded.
Read more about how Kodiak and its ecosystem partners are secured with Hypernative's real-time security: documentation.kodiak.finance…
Sam Friedman retweeted
On Oct 9, 2026, Kodiak's real-time security monitoring (powered by @HypernativeLabs) detected a malicious contract targeting a vulnerability in an external vault provider's contracts that interacted with Kodiak Islands. NO FUNDS WERE LOST.
As designed, our pre-configured automated response with Hypernative paused all Kodiak Islands within seconds, before the attacker could execute the exploit. The pause closed the route the exploit needed and stopped an attack on an external ecosystem protocol, BeraFarm.
No Kodiak user funds were lost or extractable. The simulation estimated a loss of at least $250K had the exploit succeeded.
Read more about how Kodiak and its ecosystem partners are secured with Hypernative's real-time security: documentation.kodiak.finance…
I'm happy to see good projects taking advantage of the Ethereum Security Subsidy Program. Please apply if you're securing your protocol and following Ethereum CROPS guidelines.
1/ Cohorts IV & V are officially locked in to the @ethereum Security Subsidy Program. Join us in welcoming these stellar teams!
Cohort VI will be our final cohort of the pilot, so get your applications in ahead of the Oct 14th deadline for your chance at subsidized security services from industry-leading providers.
Big thanks, as always, to our expert committee from @ethereumfndn, @nethermind, and @chainlinklabs.
Sam Friedman retweeted
1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group.
Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain.
Sam Friedman retweeted
Claw machines funded the pipeline for the robot fleet
That's the part everyone skips when they talk about rwa. You don't start with the capital-intensive thing. You start with something cheap that prints cash on day one, a $1k machine in a mall, and prove the underwriting model works before you move to $50k robots.
The same operator math applies. The same verification layer. The coin box data feeds the same model that will underwrite a robot arm.
We earned it with claw machines.
Sam Friedman retweeted
Bitget's own wallets signed away ~$387M. No private key was stolen.
We rebuilt the drain onchain: ~$290M left in 24 seconds of signing, with Bitget's own fee settings on every EVM chain.
The gas limit gave the attacker away.
Full analysis: buff.ly/zczt4VC
Sam Friedman retweeted
Autonomous agents are only as trustworthy as the defenses protecting them.
Our new post digs into prompt injection mitigation — practical ways to harden your gateway so agents stay secure, predictable, and production-ready.
🔗 blog.nebulablock.com/prompt-…
-----
#AISecurity #PromptInjection #AIAgents #NebulaBlock
Sam Friedman retweeted
Everyone wants exposure to tokenized stocks. But do you have a protected claim to backing securities?
@annabelleacta gave the breakdown behind Dinari's custodial model with dShares™.
Regulated custody is table stakes for anyone dealing in US securities. The real question is whether you have any claim on what sits in that account. With dShares™, you do. Dinari Securities, our registered broker-dealer, acquires the backing security into a custodial brokerage account, and you hold a regulated, protected claim to it.
The rights you expect from being an investor in US capital markets, preserved. This includes cash dividends, fully automated corporate actions and redemption at NBBO.
724 tokenized equities, including the S&P 500, available to eligible investors in 85+ countries and now to the US as well.
dShares™ are stocks.
Great comprehensive article on the AI safety-risk importance of humans reading and understanding the code. Good callouts of human biases towards investigating failures more than successes (which could be false positives) and limitations of oracles.
Sam Friedman retweeted
Fast confirmation rule can make bridging across Ethereum and L2s:
- Cheaper (no need to pay bps to solvers)
- Faster (13mins -> 12 seconds)
- Universal (available to all tokens with a simple integration)
This is a zero-to-hero guide if you're not deeply technical, but want to know what FCR does for cross-chain interoperability.
Sam Friedman retweeted
I've been excited to announce this for a few weeks now...
@lolo_IRL will be the official networking and agenda platform for Boston Blockchain Week.
At a conference, everyone wants to know 2 things:
> who's here?
> where do I go?
Lolo solves this.
Lolo's purpose is to help people connect IRL, and for that, context matters. One of the strongest signals of context is someone's profession – in the case of @blockchainwk, everyone attending will relate on crypto, tech, and finance.
This creates a perfect environment of network density in which everyone there is aligned, and will likely want to accomplish comparable goals and go to similar events.
Lolo provides a single, easy platform to accomplish all of that.
No more jumping around 5 telegram group chats, sending RSVP links and asking on X "who's in Boston?".
Lolo fixes it.
And afterward, everyone who went to BBW can stay connected for the future. On Lolo, your global network grows and compounds with every new connection and event, meaning you'll have people you already know at that next conference, and the one after that.
I'm looking forward to taking on this mission for Lolo, providing a platform and product which upgrades Boston Blockchain Week overall.
Ready to sink our teeth in and show what we can do, Sep. 8 - 10 in Quincy, MA.
Let's gooo. 😁🦾
We’re pleased to announce that Lolo will be the official networking and agenda platform for @blockchainwk – Sep. 8-10, 2026.
Lolo upgrades the BBW experience, allowing attendees to connect before, during, and long-after the event ends.
Let us show you how 🧵
