
This is the dip! #Dev #Blockchain #Ethereum #Solidity #SmartContracts #DApp #DeFi #NFT #Security 💻
On chain
Joined July 2014
- Tweets1.7K
- Following1.3K
- Followers988
- Likes15.9K
Paulius retweeted
🚨 Nightmare day for cybersecurity
Multiple major security incidents, active exploits, supply chain compromises...
If you run production systems, start patching NOW.
PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW
LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets.
eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores.
Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs.
TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff.
Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors.
BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign.
And that's not even the full list.
Patch. Audit. Rotate. NOW.
Paulius retweeted
In the era of AI-powered triage, paying more than $10–$20 just to report a bug is EV-negative for both sides.
I've been in this industry for years, on both sides of the table.
If processing a report costs you more than $20, that's a triage problem. Passing that cost on to researchers just rigs the process against them.
This was an issue when we first started the AI slop submissions, now it's not about that anymore, fix your triaging bots and ease your process for to the defending side!
I can't believe i have to write this, tbh, lol!
Paulius retweeted
ok someone finally deployed the DAO proposal to add 0.01, 0.03, 0.3, 3, and 30 ETH Tornado Cash pools (we've asked the Tornado Cash community a few days ago to deploy this if anyone thinks it's valuable); personally i strongly second this proposal as it will help retail users and increase usage (particularly the 0.01 ETH pool). i hope the DAO voters see the merit of this proposal and will accept it.
Paulius retweeted
🚨 Important: If you ever traded on Magic Eden, read this.
Magic Eden used Payment Processor, a trading system built by an NFT company called Limit Break, for trades in 2024. They stopped using it in Oct 2024, but the approvals you gave it never went away.
On Sept 24, attackers found a flaw that lets them act on behalf of ANY wallet that approved it. They're taking NFTs for free and draining tokens like WETH by forcing wallets to "buy" worthless NFTs.
$2.8M+ stolen so far across ETH, Polygon, Base, Arbitrum and ApeChain. Still ongoing.
✅ Check if you're safe:
1. Go to: revoke.cash/exploits/magic-e…
2. Search your EVM wallet
3. If it says to revoke anything, revoke all
After that check again, and it should show "You Are Protected".
Do it now, on every chain you used.
Paulius retweeted
The bitget hacker showed no mercy
> Bitget celebrates its 8th birthday
> Employees go to sleep (Asia)
> Hacker steals nearly $200M
The day after she made this post, she was found dead
Hsin-Ju was one of the nicest people I met and made this industry feel inclusive
May you rest in peace @hsinju 💜
1/ gm. gm. Name is Hsin-Ju.
I have a dark, kinda tragic personal announcement.
I've decided I'd rather take $0 than accept a settlement that requires me to stay silent about what happened to me. I have since fired my lawyers at @sanfordheisler & will be releasing all the evidence from my time @hack_vc on Wed 8/26.
INTRO: I've been in crypto for 9 years. Most recently I was a partner & head of platform @hack_vc which is a $600-700M crypto VC firm. Many of you may know me from my time as Head of Growth at @StellarOrg in 2017 (worked w/ the Mt. Gox founder), @Solana in 2018 (joined under ~10 ppl, but quit before my cliff), & @Fhenix in 2024. Or have attended one of my @DystopiaLabs ETH events (2019-now).
Last year, I was forced to work through a serious medical emergency while at @Hack_VC due to threats by @alpackaP @dbulaevsky, saying that they would blacklist me from the space if I quit before finishing the hacksummit conference & side events that I was helping with during @kbwofficial. I was working 13-14hr days, 6 days a week, sleeping 0-4 hrs a night, and had documented Graves' disease, hyperthyroidism, and severe insomnia. I repeatedly asked to quit. Hack VC refused. This + other threats and intimidation went on for almost a month.
The conditions got so bad I attempted suicide.
The fucked up part is that, even after the suicide attempt, I told everyone at Hack VC (in writing) that I had no plans to sue. I was scared & extremely sick. I just wanted to leave. I told them that as long as there was no retaliation or badmouthing - I had no plans to sue.
@Hack_VC chose to retaliate.
After just 1 month after my near suicide, Hack VC mishandled my COBRA health insurance, refused to fix things, kept shooing me to customer support (when it's legally Hack VC's responsibility to fix this), and my insurance had issues and was not fixed for almost 4 MONTHS. Hack VC did not fix everything until I hired lawyers and had them force Hack VC to adhere to the law & fix my COBRA insurance issues. The sheer cruelty of an employer harming someone's health insurance almost immediately after they nearly committed suicide is extremely fucked up.
And, even during the legal engagement, Hack VC continued to lie & attempt to harm me through their lawyers and other employees/partners (multi-million dollar carry & clawbacks can make even the nicest ppl willing to turn the other way or lie). @0xRodney @IsTheBaron @roshunpatel @Alex__Botte.
Now. Almost an entire year of engagement & my near suicide anniversary coming up, our lawyers (mine & Hack VC's) have reached the point of preparing for private mediation and settlement. And...I realized that I just can't do it. I don't want money in exchange for silence. I'd rather speak.
I fired my lawyers yesterday.
In case it needs to be said, I did a good job at Hack VC. I was only there full time for 7 months; been part-time since 2021. I got a $50k raise to $300k, $30k bonus, and promises of additional carry that would have been implemented about a week or so after my last day. I was also offered admission into the GP entity (but not sure if admission was actually completed bc it was during my medical emergency). This + my resume, should show that me suing is not a money grab; I was genuinely harmed.
I'm aware that I'm just one person (who is not rich) facing a $600-700M VC institution. I've been told by @alpackaP that he's known most of the managing partners at most VC firms for almost a decade and he could absolutely blacklist me.
I'm also painful aware that the conclusion of this will probably be extremely poor for me or death - but I've accepted it.
Sharing with other web2 & web3 VCs:
@paulg @ycombinator @500STARTUPS @a16zcrypto @PanteraCapital @dragonflyvc @RaceCapital @hosseeb @haunventures @hiFramework @ElectricCapital @blockchaincap @Delphi_Digital @variantfund @1kxnetwork @archetypevc @shimacapital @robotventures, etc.
TLDR; I’m done with continued threats, pressure, and intimidation. I'm not going to take a payout and allow Alex or Hack VC to walk away from harming me. As mentioned, I'll be dropping the evidence from my case on Wed 8/26 (or before) -- privacy be damned.
Support here (or DM) please:
ETH: 0x68c10776C5c05Cbf5B4C2318bE02D61B9f06B875
SOL: B7S8TPcWWJXTsmgG8ShoTmy8sNPuJ3Dbmt7z5gLFAveq
Paulius retweeted
🚨TO ALL AUDITORS: Monad’s security team just open-sourced an agentic Solidity fuzzing system.
Its default campaign uses 43 agentic nodes to map flows, threat-model, derive properties, hunt bugs, triage findings and produce a report.
This looks awesome!
github.com/monad-developers/…
Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.
We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.
Paulius retweeted
🚨 Important Security Notice🚨
Our third-party email service provider Brevo has experienced a security breach.
Please note that the email titled “Data Breach Notice: Please refresh API Keys as soon as possible” was not sent by us and is a phishing attempt.
Do not click on any links contained in this email.
We are currently investigating the incident and will provide further information as soon as it becomes available.
Paulius retweeted
Claude: Code is done!
Codex: There's a bug here.
Claude: Fixed.
Codex: There's a bug in your fix.
Claude: Fixed.
Codex: There's a bug in your fix.
... 12 hours later ...
Claude: Fixed.
Codex: There's a bug in your fix.
ffs
Paulius retweeted
Guardian just announced $1 Million in security audit grant funding.
Here's everything protocol teams need to know and how to apply. 👇
I was the poor kid that was ready to do anything to help his family financially. Googling “how to make money”. Trying out every stupid idea. I never wanted money for myself, I wanted higher quality of life for my loved ones.
After achieving the goal, calling my mother and saying “you don’t have to work anymore” (sweet goal to achieve), it felt kind of weird. What now? The time came for me to buy exotic cars, travel, date lots of girls. Plenty of good times, but as with many things that give you a present moment high, you can overdo them and get bored.
What do you do when you are bored? Start a WAR. War with yourself, your old self, so that a better, stronger, newer one can be born and rule. How tf do you start a war with yourself? Set a goal you FEAR. One that you fear thinking about, and squirm when you imagine sharing it with others.
On this journey right fucking now. I love this shit. I truly invite you reading this to join the awesome ride of reaching your true potential. It’s joyful even in the failures and the saddest moments. It’s purposeful, complete and aesthetic.
You have just one short life, make the story beautiful, one worth telling. Lessssgo🫡
Paulius retweeted
Important Update on Arbitrum Nova.
As per a recent proposal, the ArbitrumDAO has voted to minimize Arbitrum Nova by transitioning it into a maintenance-oriented state with reduced capacity and deprioritized support.
A thread on what this means for developers and users 👇🏻
Paulius retweeted
You should:
1. Know the docs page on --via-ir differences .
2. Know that that page is not a complete list of differences.
3. Know everything in the Solidty docs that says "undefined behavior"
4. Most importantly, if you intend to deploy with --via-ir, run all tests, fuzzing, everything with --via-ir.
Paulius retweeted
Some pools still have a notable TVL in Curve pools on Fantom Opera. If you are one of the LPs - please remove before June 30: that network is shutting down
Since launch, Sonic has become the home of the ecosystem - users, builders, liquidity, and validators have all made the move.
With that transition complete, Fantom Opera will be retired on June 30, 2026.
The Fantom Opera network will cease operation at 5:00 PM GMT on June 30, 2026. If you have not migrated your assets, please do so before then. This serves as official notification of the network closure.
The ERC-20 FTM → S route and Sonic Gateway are not affected.
Full details 👇
npm finally fights supply chain attacks with v12 (July 2026) blocking install scripts by default.
Here's how to adapt early without breaking your CI 🧵
What's changing:
• preinstall/install/postinstall scripts → blocked by default
• Git dependencies → blocked by default
• Remote URL deps → blocked by default
The fix is creating a one-time allowlist per repo:
💻 npm install
💻 npm approve-scripts --all
💻 git commit -m "chore: allowlist install scripts"
This snapshots exactly what's trusted today and only new unknown scripts are blocked automatically going forward.
CI adaptation playbook:
1. Upgrade to npm 11.16.0+
2. Run the approve-scripts commands above
3. Add --strict-allow-scripts to your pipeline
Now jobs will fail loudly if anything unreviewed tries to run.
Source:
github.com/orgs/community/di…
🤯An AI security tool has 1st-place performance on security contests from just 1yr ago. Solidity-auditor v3 is out, FREE & Open Source.
Thousands of Solidity developers are using the tool already. Upgrade your security baseline, use the tool🫡
pashov.com/solidity-auditor-…
Paulius retweeted
rant time: people are so fucking obsessed with building more tools, more products, more services, more "security" layers. are you guys all fucking insane?? every single thing you add is more complexity. and complexity is exactly what makes systems _dangerous_. you don't get safer by stacking abstractions on top of abstractions. you just increase the attack surface and pray the whole dependency chain doesn't collapse (hint: it will collapse!!). now you depend on 10, 50, 100 moving parts. all needing updates, all with their own bugs, all potential supply chain failures and we call that "security" like fucking retards.
dude, it's the fucking opposite. we're not building safer systems. we're building systems so complex nobody actually understands them anymore. and almost nobody is asking the obvious question: **what can we remove?** everyone wants to add. nobody wants to reduce. that's how you end up in a nightmare system (hint: we're already in that nightmare). not because of one big failure. but because of thousands of tiny dependencies you never should have had in the first place.































