
Head of Product @DuskFoundation | Software Engineer & Consultant working in Finance #Crypto #Web3 #RWA #FinTech #RegTech #Tokenization #Trading
Europe
Joined April 2024
- Tweets155
- Following360
- Followers149
- Likes681
Thomas retweeted
Today's PHP disclosure is by the way a good example of why we at Dusk have invested so much time in making continuous AI-assisted audits and reviews part of how we build.
PHP patched two critical bugs, CVE-2026-109618 and CVE-2026-109619. Both let an attacker run code on a web server without logging in. One sits in how PHP cleans up after running out of memory. The other is state that survives from one request to the next after its memory has been freed. The oldest affected code goes back to PHP 5.4 in 2012.
Calif and Wiz found them independently using AI. Calif did it with no special setup and only models anyone can access. PHP runs a huge part of the web and a lot of people have looked at its code over the years, yet these bugs sat there for over a decade. Getting the fixes right took the PHP team weeks.
This won't be the last case like it. The same tools are available to attackers, and a lot of older code has never been looked at this deeply, as the speed at which AI can inspect, test and validate invariants is impossible for a human to match.
It also matches what we see in our own stack. Most of what turns up is in code written before we had these tools, so that's where we've put the majority of our focus, going back through all of our older code. The fixes go out in our public repos, like the Phoenix release below.
The tools only get you so far. Finding bugs is a numbers game in the end, and with enough compute you'll find something in almost any codebase. The hard part is understanding what you found and which invariants matter in the first place. Without that you end up with fixes that don't hold up. A bad fix is dangerous because it gives people a false sense of safety. Judging what's a real issue and fixing it properly still takes people who know what they're doing, especially when dealing with cryptography.
That costs a lot of time, testing and compute upfront. Our bet is that it pays off in the long run though.
CVEs for reference:
github.com/php/php-src/secur…
github.com/php/php-src/secur…
This Phoenix release comes out of a re-review of our whole cryptography stack, which we started months ago.
With how much easier AI has made exploit hunting since, and the incidents we've all been seeing, I'm glad we did.
A lot of effort, testing and compute went into it. We also rechecked the implementation against the protocol's formal proofs. It doesn't guarantee we're bug free, but we should be a lot safer than before.
france is the leading country on the planet for crypto kidnappings and wrench attacks
largely because their tax authority leaked the personal data of everyone
now they want to increase by 50,000x the amount of data they collect and hence leak
zero
🇫🇷 LATEST: French lawmakers advance a proposal requiring self-custody crypto holders with €100,000 or more to declare their assets or face fines of up to €10,000.
ct.com/news/french-lawmakers…
Thomas retweeted
Berlin zahlt nicht. Die Ransomware-Gruppe Rhysida fordert 30 Bitcoin vom Land - oder droht mit der Veröffentlichung von 5,8 Terabyte gestohlener Daten.
Viele Schlagzeilen rücken Bitcoin in den Vordergrund. Das ist der falsche Fokus.
Das eigentliche Problem: Wie konnten 46.500 Verträge, 80.000 Ordnungswidrigkeitsverfahren und Login-Daten überhaupt abfliessen? Bitcoin ist das Zahlungsmittel der Täter - nicht die Ursache des Angriffs.
Und genau hier wird DAC8 zum Problem.
Ab 2027 melden Krypto-Dienstleister Namen, Adressen, Steuer-IDs und detaillierte Transaktionsdaten an das Bundeszentralamt für Steuern - die dann grenzüberschreitend ausgetauscht werden.
Für Kriminelle wäre das eine fertige Zielliste: Identität, Wohnort, Krypto-Aktivität - alles an einem Ort.
Berlin zeigt, dass staatliche Systeme keine sicheren Datentresore sind. Je mehr sensible Daten gesammelt werden, desto grösser wird der Schaden wenn es jemanden trifft.
Das Berliner Problem ist kein Bitcoin-Problem. Es ist ein Datenschutz-Problem.
Quelle: Blocktrainer, 30.08.2026
When the dust settles, we'll have to talk about the fact that not a single vulnerability was found by a US frontier model.
Instead, we're spending $10k a day on open weights models like Kimi K3 and Qwen 3.8 to find vulnerabilities in Bitcoin infrastructure.
It's a disaster.
Institutions want rails they can trust. Users want products they actually enjoy using.
@DuskFoundation and the SHIFT team sits together to discuss about what it takes to fix that.
📅 April 28, 3 PM UTC.
Set your reminder: teapawt.net/i/spaces/1DGleEolykMJL…
Thomas retweeted
Tokenized RWAs are under $1T today, but projected to reach $16T this decade.
Join this RWA Megaspace on 24th April to upack:
🔹 Where tokenization stands today
🔸 How leading teams are building toward scale
40 speakers. 10 panels. One Space!
RSVP 👇
teapawt.net/i/spaces/1DxLdverXrRxm
Thomas retweeted
We're excited to join @HouseofChimera's RWA Megaspace this Friday.
🗓️ April 24, 17:00 CET
Our Head of Product @Neotamandua will be joining as a speaker.
Set a reminder ↓
Tokenized RWAs are under $1T today, but projected to reach $16T this decade.
Join this RWA Megaspace on 24th April to upack:
🔹 Where tokenization stands today
🔸 How leading teams are building toward scale
40 speakers. 10 panels. One Space!
RSVP 👇
teapawt.net/i/spaces/1DxLdverXrRxm
Thomas retweeted
DUSK/USDC is now live on Uniswap V4.
With USDT delisted from European exchanges under MiCA, EU users lost access to most USDT pairs.
We've deployed a $300K DUSK/USDC pool on Ethereum, a MiCA-compliant trading route for DUSK.
Access the pool here ↓
Thomas retweeted
Dusk Trade waitlist is now open.
Our regulated RWA trading platform, built with NPEX, a licensed exchange with €300M AUM, bringing tokenized assets and funds on-chain.
Sign up for a chance to win up to $500 in RWAs 👇
Thomas retweeted
Dusk is joining @binance for a Binance Square AMA.
📅 Jan 22, 2026 at 13:00 UTC
🎙️ @HeinDauven (CTO at Dusk)
🎁 4000 $DUSK in red packet rewards
Set a reminder below👇
Thomas retweeted
Private by default, accountable when required.
$DUSK shielded transfers hide sender/amount from the public, while the receiver can still verify (and cryptographically prove!) who paid them.
That missing piece makes privacy on Dusk much more travel‑rule‑friendly and compliant.
Thomas retweeted
ERC20-like tokens on $DUSK are now in draft. DRC20 is public and open for community contribution.
Big thanks to builders helping shape the standard: @sozu_dusk @tminus_dusk @pieswap_dusk @neotamandua
A shared baseline makes tokens easier to integrate (wallets, explorers, tooling), safer to implement and faster to ship without everyone reinventing the wheel.
And with DuskEVM coming up, having a clear token standard matters even more for bridging between EVM <-> DS.
A DRC20 proposal is now public: a minimal fungible token reference for $DUSK @DuskFoundation.
Built as a clean starting point for ecosystem tokens.
We’re evolving it in the open with a collective of OSS builders on Dusk. RFCs, issues & PRs welcome:
github.com/Dusk-Forge/drc20-…
Thomas retweeted
This is what I worry Europe will get negatively polarized into: an ideology taking pride in a neat, sanitized online environment free of evil corporate and fascist pathogens.
I hope European govs do not go this way, and instead take a Pirate Party approach of user empowerment.
First, what's wrong with the tweet I'm quoting:
The idea that there should be "no space" for something you dislike is fundamentally a totalitarian and anti-pluralistic impulse. It's incompatible with being in an environment that you do not fully control.
This is especially true for categories that are subjective and controversial, because you end up trying to fully remove things you think are pathogens, when other people have good faith disagreements, and because you give yourself the maximalist goal of not even giving them breathing room, you create conflict and end up building the machinery of technocratic authoritarianism to impose your victory in the conflict.
So sorry, if you want to be a free society, you have to bite the bullet that some people, somewhere, will be selling things that you consider dangerous and saying things you consider disinformation and vicious lies.
What is the goal to shoot for?
You want to create an environment where those things don't dominate. This is the problem with twitter today: not that it's a safe space where 1000 people talk to each other in a corner about how heritage americans are the master race and putin is good or whatever, but that that crap gets shoved in our face on a mass scale, and the algorithms actively favor it.
The right metaphor is not castles and walls, but biological - think, why European forests don't have tropical lizards.
Having incentives for social media platforms to have less of those things instead of more is fundamentally reasonable, @audreyt has talked about how Taiwan has done something similar.
You also want to do this in a way where it's clear what the underlying principle is, so it's not a vehicle for imposing arbitrary and frequently changing expert-consensus agendas.
You also want to empower users, rather than working against them. People want to see and buy good things instead of bad things. Often the problem is that competition is too difficult in the current market. I actually supported the USB-C standardization mandate; it created more interoperability and thus improved competition and convenience. I would support incentivizing social platforms to be more open, and to be more transparent (eg. my proposal to require algorithms to be continuously published with a 1-2 year delay, with zk-proofs to ensure that the algorithm being used in real time exactly equals the one that gets published later)
Being able to better identify what messages are coming from what communities is also good, though I don't support the direction of banning anonymity of individual posters, rather I would want to see more macro-scale analytics, eg. seeing what communities are most strongly saying and amplifying content that semantically matches a particular idea; this can be done in privacy-preserving ways.
There is a real opportunity to reaffirm freedom of speech in a unique and different way, that emphasizes pluralism and pushes against unbalanced attempts to manipulate the discourse by individual powerful actors. We want to do this, not go down the dark path of having something that claims to support fundamental rights but actually is not trusted by anyone to be anything other than the fundamental right to follow the footsteps of a few technocratic experts.
𝗡𝗢 space for cyberbullying.
𝗡𝗢 space for dangerous products.
𝗡𝗢 space for hate speech.
𝗡𝗢 space for scams.
𝗬𝗘𝗦. With the Digital Services Act, what is illegal offline remains illegal online.
🔗 link.europa.eu/gbRf9h
Thomas retweeted
Our partnership with @chainlink is a key step in bringing regulated assets onchain, at scale, for everyone.
Key takeaways:
- We are adopting CCIP, Chainlink’s secure messaging and token-transfer standard that connects blockchains.
- DataLink will deliver @NPEX onchain, vital as NPEX’s assets move onto DuskEVM.
- Data Streams provide high-frequency, low-latency market data feeds designed for onchain trading.
Want to go deeper? Our blog post explains everything 👇
Thomas retweeted
Join Chainlink and @duskfoundation today at 10AM ET for a live discussion on how Dusk is leveraging Chainlink to power compliant, tokenized assets onchain.
Set a reminder ↓
teapawt.net/i/spaces/1nAJEEVgvZVJL…
Thomas retweeted
DUSK x CHAINLINK
We’re proud to partner with @chainlink to bring regulated securities and RWAs onchain, private, compliant, and programmable.
The next era of financial markets starts here 🤝
Dusk (@duskfoundation) is adopting the Chainlink interoperability & data standards to enable compliant, cross-chain tokenized securities backed by real-world equities from NPEX, a fully regulated Dutch stock exchange with €200M+ in financing raised & 17.5K+ active investors.
prnewswire.com/news-releases…
Chainlink CCIP will serve as the canonical interoperability solution for tokenized NPEX assets, while also enabling the Dusk Network’s native token, DUSK, to be natively transferable across Ethereum and Solana via the Cross-Chain Token (CCT) standard.
Chainlink DataLink will serve as the exclusive data oracle solution for bringing NPEX exchange data onchain and cross-chain. Dusk and NPEX will become official data publishers of regulated market data, and Chainlink Data Streams will deliver low-latency price updates for institutional-grade DeFi applications on Dusk.
Together, this integration brings regulated securities, verified financial data, and cross-chain connectivity into a unified infrastructure, unlocking a new era of institutional capital markets onchain, powered by the Chainlink platform.



























