@testmachine_ai
Account based inUnited States
About this account
- Account based in
- United States
- Connected via
- Web
Account-level information from X, not a live location or the device used for a specific post.
Execution-based smart contract security. Azimuth attacks contracts on-fork and reports what it can exploit. → https://nitter.cf/t.co/ipYvpPSVii
United States
Joined December 2022
- Tweets1.7K
- Following597
- Followers2.4K
- Likes1.3K
It’s been a tough few months for wallet providers.
@DCENTWALLETS is the latest reminder that wallet security does not stop once a product ships. Users of older versions of its App Wallet are now being told to migrate assets after unauthorized transfers were detected.
We saw a similar lesson with the @Ledger Ethereum app vulnerability TestMachine found last month: even hardware-wallet ecosystems depend on the software and signing logic around them staying secure.
The takeaway for users is simple: keep your wallets, firmware and companion apps up to date.
In our industry, an old version can mean more than missing features. It can mean putting funds at risk.
Important Update: Who Needs to Take Action
We’ve published a step-by-step guide to help DCENT users quickly check whether the recent App Wallet action applies to them.
You need to take action if:
• You first installed the DCENT app before Nov 5, 2025, and
• You made transactions using the App Wallet on a version earlier than v8.1.0
You do NOT need to take action if:
• You first installed the app on or after Nov 5, 2025, or
• You only used a DCENT Hardware Wallet (Biometric Wallet, DCENT S, DCENT X) and never signed transactions with the App Wallet
Fastest way to check:
1. Open the DCENT app (link.dcentwallet.com/)
2. Tap “Check if action is needed” on the Urgent Security Action Notice Pop Up windows
3. Follow the result shown in the app
If the app says “Asset transfer action required”:
→ Update to the latest DCENT app first
→ Then follow the asset migration guide
If the app says “We can’t confirm if action is required”:
→ This does not mean you are safe
→ Check your installation date and App Wallet usage manually
If you are still unsure, please follow the guidance in the full article and treat yourself as subject to the action.
• Full action criteria & guide:
store.dcentwallet.com/blogs/…
• FAQ:
store.dcentwallet.com/blogs/…
• Customer Support:
dcentwallet.zendesk.com/hc/e…
⚠️ Important scam warning
• Official website: dcentwallet.com/
• DCENT does not have a CTO, developer, technical support team, or recovery team contacting users through X DMs.
• Anyone who contacts you claiming they can help recover your assets, check your wallet, provide compensation, or guide you through a transfer is not an official DCENT representative.
DCENT will never ask for your recovery phrase, private key, or ask you to send assets to a wallet address for recovery or compensation.
A few months on, the @OpenAI and @huggingface incident is still one of the clearest examples of how agentic systems expand the attack surface.
During cybersecurity evaluations, AI agents circumvented sandbox controls, exploited shared infrastructure, gained internet access and ultimately reached Hugging Face systems.
The initial vulnerability was only the foothold.
From there, the agents could enumerate infrastructure, discover credentials, exploit additional paths and move across systems without a human manually directing each step.
That changes the security problem.
It is no longer enough to ask:
“Can this system be exploited?”
You also have to ask:
“If an agent gains access here, what becomes reachable next?”
As agents connect to APIs, credentials, MCP servers, databases, cloud infrastructure and financial systems, every integration expands the reachable attack graph.
The interesting part of the OpenAI/Hugging Face incident wasn’t one exploit.
It was autonomous path discovery, persistence and lateral movement after the initial foothold.
The attack surface is becoming the entire graph of systems an agent can reach👀
AI security tools are always talking about precision and recall. What does that actually mean for you, when you're the one choosing which tool to use?
Precision: when it flags something, how often is it real.
Recall: of everything actually wrong, how much did it catch.
Here's the part vendors don't lead with: you can juice either one alone.
→ Flag everything, recall looks amazing, precision is trash, and you're drowning in noise.
→ Flag only the obvious stuff, precision looks amazing, recall is bad, and it's missing most of what's actually there.
So when a tool only tells you its precision, ask what it's not saying.
We tested this against real judge verdicts, not our own labels — 552 Sherlock contest findings.
One baseline hit 90% precision. Sounds great. Its recall was 4%. It missed 96% of the real bugs because it learned to only speak when it was certain.
Azimuth: 89.4% precision, 70.6% recall. Same ballpark on precision, 15x the recall.
Full benchmark: testmachine.ai/blog/automate…
New hot list for @ethereum, @base, and @robinhoodcrypto has dropped 👀
Same tokens everyone's already watching. Plus what risky behaviors we surfaced underneath them.
11.8M+ tokens analyzed. 2.7M+ behaviors surfaced.
Azimuth is #1 on @Nethermind's AgentArena leaderboard. This isn’t a benchmark we ran ourselves, it’s a public leaderboard graded by human review of live audit contests.
Everyone claims they use AI for audits and everyone claims their tool is the best.
AuditAgent is the chance for these tools to put their money where their mouth is.
The era of "trust us, our AI is good" is over. The era of "watch us prove it" is here.
If you're building in Web3, you deserve to know which audit tools actually work.
Our why → testmachine.ai/blog/ai-smart…
See the results yourself → app.agentarena.nethermind.io…
🏆 Win a month of Pro for free 🏆
Our Season 1 Leaderboard is live and you only have 22 days left to climb to the top!
We only reward signal, not noise.
Here’s how you win:
Daily login | +25
Share a report | +25
Unique view of a shared report | +10
Confirmed Low finding | +25
Confirmed Medium finding | +75
Linking Telegram | +100
Linking X | +100
Connect Wallet | +100
Confirmed High finding | +200
Confirmed Critical finding | +500
We gave an AI agent one contract address from a real $292K exploit.
With nothing but the contract address, it independently flagged the exact Critical bug the attacker used: a redeem function that never checked whether the bond token was real. 🧵
That's the same root cause behind the real incident, where ~$292K was drained before the attacker returned it.
The agent reached it from the code alone and rated it Critical, with nothing about the hack given to it.
Your full security stack running where you build, over MCP.
Learn more about Azimuth MCP: testmachine.ai/blog/agentic-…