Doing my best to protect web3 protocols. Top 100 HackenProof all-time
Joined August 2025
- Tweets496
- Following410
- Followers428
- Likes448
LoopGhost retweeted
Okay, are you kidding me?
At this point, OpenAI is treating us all like clowns.
Why did you even promise us 28 days of improvements to Codex or Work if you clearly couldn't deliver on that promise?
This is incredibly disappointing. I genuinely feel misled.
It’s genuinely sad that things have reached this point, especially with a solid, publicly verifiable track record and a Top 100 all-time ranking on HackenProof.
I can obviously provide references from teams I’ve worked with if needed.
I genuinely don’t understand any of this.
github.com/loopghost
It genuinely saddens me to see what happened to Payy.
Having worked very closely with the team through a private security audit, I can say firsthand that Payy is a project that has been genuinely committed to security. During our engagement, I identified and mitigated a wide range of vulnerabilities across different parts of the system.
Unfortunately, this was not enough.
The vulnerability that ultimately led to the exploit was not only outside the agreed scope of my audit, but originated in an external dependency, in code outside Payy’s direct control. It’s particularly painful to see such an issue have such a serious impact after the amount of effort the team put into securing the protocol.
As mentioned in their postmortem, I’ve been working closely with Payy, and I’m really sorry to see the team going through this.
Wishing the entire Payy team strength as they navigate the aftermath.
In the coming weeks, I also expect to publish the report from my private audit, in coordination with Payy, to provide more transparency into the vulnerabilities we found and the work that was done to mitigate them.
Post mortem for the September 24th, 2026 exploit of Payy's bridge contract.
Based on our investigation, it appears that an attacker submitted an invalid burn proof that Payy’s deployed Noir/Barretenberg verifier accepted.
The first burn released 1,828,589.378132 USDC from the Payy rollup even though it appears that the transaction was invalid. A second burn of 1 USDC was paid early by a burn substitutor and later reimbursed. The second transaction released 90,202.820016 USDC to the same receiving wallet.
It appears there was a proving-system vulnerability in the Noir/Barretenberg verifier, developed by Aztec.
Full report: polybase.notion.site/Payy-US…
LoopGhost retweeted
First of all, poor hygiene of code in your protocol is the main reason you got hacked. There are so many more concerning issues in your elements codebase but instead of learning your lesson and going back to work, you’re complaining about it. As a matter of fact, I disclosed an encrypted vulnerability report days ago to your team and I still haven’t heard back, maybe instead of tweeting nonsense like this, go look in your inbox.
Second of all, open sourcing in blockchain field is so common that using it as an excuse is laughable (we got hacked because our codebase was open sourced). What a joke.
Unfortunately users had to pay for your negligence and carelessness for security, but instead of taking accountability, you come and post something like this acting as a victim like nobody else was going to exploit it soon or later anyways. Those hackers should be thanked for their work, if North Korean hackers got to your protocol you wouldn’t have even seen a cent of the 85% that you have today.
Protocols don’t get hacked by accident, most times it’s always projects with this exact tone and victim mentality that this happens to.
I’ve seen many that actually cared about their security, they paid big bounties and actually had a bounty page and they still got hacked. Those are the only protocols that I would feel bad for because they did all they could do, so they would deserve a break and some credit, and they still come and take accountability and apologize to their users.
The norm in blockchain cybersecurity has always been 10% of the damages, in this case they already returned 85%, if you’re gonna call them criminals, what was the point of them returning the 85%? Could’ve been criminals with all of the money.
To those responsible for the theft of bitcoin from the Liquid Network:
Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.
We have engaged in good faith in an effort to secure the return of stolen user funds and protect the broader Bitcoin community. That effort should not be mistaken for acceptance of the actions taken nor of the terms being demanded.
We will not be a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation.
Bitcoin is hard money and can’t be minted without costs, Bitcoin doesn’t haircut users to pay a ransom.
To the Bitcoin community:
We are fighting for what we believe in, for the users whose funds were taken, and for the principles on which Bitcoin was built.
The community has demonstrated incredible resolve with teams of people dedicating their time in support of each other to identify and patch vulnerabilities in each other's products and systems. We are all driven by the mission that Bitcoin is the single best asset, for every person, company, and institution on the planet to invest, use, and build on. The world is a different place with the advancements of AI, and the Bitcoin community has responded with force to combat that threat.
Damage has been done, battles have been lost, but on the whole the Bitcoin community is gaining ground in the war with bad actors.
We want to thank the community for those efforts, for your support in hardening the network, helping users recover funds, and for your support in our assertion that crime does not deserve rewards.
To those holding the stolen bitcoin:
There is still an opportunity to resolve this responsibly. The bitcoin can be returned and we can revert to the standard of white-hat principals.
However, if the funds are not returned, we will pursue every lawful avenue available to us. We will work with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible.
More importantly, Bitcoin is transparent by design and the community is made up of the most sophisticated engineers, cryptographers, and white-hat hackers globally. Transactions do not disappear, and neither does the evidence they leave behind.
We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds.
Return the bitcoin.
LoopGhost retweeted
This practice is bad not only for SRs, but for the companies themselves as well.
The blockchain won’t be properly audited, because many high- and mid-level auditors who value their time and work will refuse to participate under such conditions.
When experienced auditors don’t participate, many vulnerabilities will remain undiscovered. They’ll just be found later - by blackhats.
These conditions are unacceptable for blockchains/protocols that genuinely value security and don’t treat audits as just a box to tick for investors and users.
«We went through a public audit...» No, guys. You did not go through a public audit.
I really hope this is just some kind of mistake and that it won’t become the new norm in the Web3 security world.
Reviewing new audit competitions on @immunefi
300,000 (!) nSLOC
$14,000 prize pool
$25 non-refundable submission fee
Are you sure this works for SRs?
LoopGhost retweeted
Severe legal or monetary consequences + permanent removal from the platform for any project that breaches the contract terms or tries to scam users.
Hunters should forfeit their fee for invalid claims of catastrophic events.
Refunds only for duplicate reports within the 24-hour window. If a project doesn’t comply it should be suspended, so it becomes impossible to report any issues later.
You can raise the fee to $5k or $10k to make it work.
If the platform can’t enforce the contract terms, at least require a 2x–5x refund of the fee (held in custody by the platform).
This only works if both parties get penalized when they break the rules.
We shouldn’t allow scammers or spammers when dealing with critical reports that put user assets at direct risk.
LoopGhost retweeted
Dango was hacked for $410k in April. Now a SR discloses them a $900k exploit and they offer only $3k... No surprise if next time they will have to write an onchain message with 10% offer again.
etherscan.io/tx/0x58f7dc1af0…
A huge thank you to the entire HackenProof and @celestia team for how professionally and respectfully they handled this report, especially @ismail_k
It was a genuine pleasure to help protect the protocol. They have been outstanding throughout the entire process and are truly great professionals. 🙏🏻
What a win for @LoopGhost007! Congratulations on earning $50,000 in bounties. 🏆
Keep pushing forward!
Thank you, @HackenProof!
This is just one of several major findings from the past few months. In the last two weeks alone, I also identified two entirely separate critical vulnerabilities affecting other projects, preventing potential losses of approximately $500k and $900k respectively. Full writeups coming soon.
I’ve been working incredibly hard and continuously refining my AI-assisted security research workflow. Part of my portfolio is available here:
github.com/loopghost
Immunefi banned me some months ago for using AI. Now, that same AI-assisted methodology is helping prevent massive real-world hacks.
I submitted my appeal this week. When unban, @MitchellAmador @yassine3eth?
What a win for @LoopGhost007! Congratulations on earning $50,000 in bounties. 🏆
Keep pushing forward!
LoopGhost retweeted
📣 Etherlink 6.5 Kernel Upgrade Status
The Etherlink 6.5 kernel upgrade proposal was successfully activated on block 46,606,524 🗳️
We’d like to thank all @tezos bakers that upvoted this security upgrade and the security researcher that reported the addressed vulnerability through our bug bounty platform.
LoopGhost retweeted
📢 Etherlink 6.5 has entered the Promotion Period
Thanks to everyone who participated in the Proposal Period 🙏
15% quorum is required for activation 🗳️
Period #449 · Levels: 13,795,489 - 13,800,288
Voting ends at 23:25 UTC ⏰
@tezos bakers go cast your vote 👇
governance.etherlink.com/gov…
LoopGhost retweeted
Anyone bug hunting on @cantinasecurity and has an idea of what is going on with @MezoNetwork or @dYdX?
Both programs are unresponsive and have multiple submissions in review for longer than a month.
This is from me alone, while other SRs are experiencing the same issue.
The current state of Cantina is that they are being pushed back by the projects on their own platform and literally refuse to communicate.
I believe they can do better.
At the moment no project on Cantina has SLAs displayed, except @injective - who has quite a few open disputes on previous platforms they were active on, so that's a skip.
I do have to thank "Mar-admin" for triage on DYDX, super helpful input.
Aside from that, both projects are silent, Cantina is silent and actually @dYdX employee is passing the ball fully in Cantina's court.
If any Cantina employees, or projects with active programs can shed some light into what is the status of the platform - that would be much appreciated.
LoopGhost retweeted
This was already obvious back then to any hunter.
We've built insecure systems with questionable audits. Most firms aren't even aware of the majority of exploits they missed, only later caught by whitehats, or blackhats.
And now we’re seeing lower bounties because of AI 🤡
Got my first CVE: CVE-2026-48100 🎉
Over the last few months I’ve been heavily investing in AI-driven research workflows for Web3 security. It’s been exciting to see those workflows consistently translate into real-world findings.
So far that journey has led to accepted High/Critical vulnerabilities across ecosystems including Polkadot, Celestia, Trezor, Chainflip, XRPL, Payy and others.
This CVE comes from a critical soundness vulnerability in a ZK rollup that could have enabled the theft of roughly $3.5M USDC under the protocol’s intended prover model.
Big thanks to the @payy_link team and specially for the smooth disclosure process.
Advisory:
github.com/polybase/payy/sec…
Looking forward to the next one.
