On chain
Joined July 2014
🚨 Nightmare day for cybersecurity Multiple major security incidents, active exploits, supply chain compromises... If you run production systems, start patching NOW. PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets. eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores. Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs. TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff. Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors. BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign. And that's not even the full list. Patch. Audit. Rotate. NOW.
98
584
132
3,722
468,040
Paulius retweeted
In the era of AI-powered triage, paying more than $10–$20 just to report a bug is EV-negative for both sides. I've been in this industry for years, on both sides of the table. If processing a report costs you more than $20, that's a triage problem. Passing that cost on to researchers just rigs the process against them. This was an issue when we first started the AI slop submissions, now it's not about that anymore, fix your triaging bots and ease your process for to the defending side! I can't believe i have to write this, tbh, lol!
5
9
1
73
2,625
I am also looking for extremely good security engineers / exploit developers to join the @tempo team - we have infinite AI token spend and love writing tools, plz DM
20
16
2
300
24,785
ok someone finally deployed the DAO proposal to add 0.01, 0.03, 0.3, 3, and 30 ETH Tornado Cash pools (we've asked the Tornado Cash community a few days ago to deploy this if anyone thinks it's valuable); personally i strongly second this proposal as it will help retail users and increase usage (particularly the 0.01 ETH pool). i hope the DAO voters see the merit of this proposal and will accept it.
14
13
2
148
10,684
🚨 Important: If you ever traded on Magic Eden, read this. Magic Eden used Payment Processor, a trading system built by an NFT company called Limit Break, for trades in 2024. They stopped using it in Oct 2024, but the approvals you gave it never went away. On Sept 24, attackers found a flaw that lets them act on behalf of ANY wallet that approved it. They're taking NFTs for free and draining tokens like WETH by forcing wallets to "buy" worthless NFTs. $2.8M+ stolen so far across ETH, Polygon, Base, Arbitrum and ApeChain. Still ongoing. ✅ Check if you're safe: 1. Go to: revoke.cash/exploits/magic-e… 2. Search your EVM wallet 3. If it says to revoke anything, revoke all After that check again, and it should show "You Are Protected". Do it now, on every chain you used.
29
48
1
244
41,185
The bitget hacker showed no mercy > Bitget celebrates its 8th birthday > Employees go to sleep (Asia) > Hacker steals nearly $200M
The view hits different from up here. #BitgetTurns8
119
78
25
1,179
321,852
Paulius retweeted
The day after she made this post, she was found dead Hsin-Ju was one of the nicest people I met and made this industry feel inclusive May you rest in peace @hsinju 💜
1/ gm. gm. Name is Hsin-Ju. I have a dark, kinda tragic personal announcement. I've decided I'd rather take $0 than accept a settlement that requires me to stay silent about what happened to me. I have since fired my lawyers at @sanfordheisler & will be releasing all the evidence from my time @hack_vc on Wed 8/26. INTRO: I've been in crypto for 9 years. Most recently I was a partner & head of platform @hack_vc which is a $600-700M crypto VC firm. Many of you may know me from my time as Head of Growth at @StellarOrg in 2017 (worked w/ the Mt. Gox founder), @Solana in 2018 (joined under ~10 ppl, but quit before my cliff), & @Fhenix in 2024. Or have attended one of my @DystopiaLabs ETH events (2019-now). Last year, I was forced to work through a serious medical emergency while at @Hack_VC due to threats by @alpackaP @dbulaevsky, saying that they would blacklist me from the space if I quit before finishing the hacksummit conference & side events that I was helping with during @kbwofficial. I was working 13-14hr days, 6 days a week, sleeping 0-4 hrs a night, and had documented Graves' disease, hyperthyroidism, and severe insomnia. I repeatedly asked to quit. Hack VC refused. This + other threats and intimidation went on for almost a month. The conditions got so bad I attempted suicide. The fucked up part is that, even after the suicide attempt, I told everyone at Hack VC (in writing) that I had no plans to sue. I was scared & extremely sick. I just wanted to leave. I told them that as long as there was no retaliation or badmouthing - I had no plans to sue. @Hack_VC chose to retaliate. After just 1 month after my near suicide, Hack VC mishandled my COBRA health insurance, refused to fix things, kept shooing me to customer support (when it's legally Hack VC's responsibility to fix this), and my insurance had issues and was not fixed for almost 4 MONTHS. Hack VC did not fix everything until I hired lawyers and had them force Hack VC to adhere to the law & fix my COBRA insurance issues. The sheer cruelty of an employer harming someone's health insurance almost immediately after they nearly committed suicide is extremely fucked up. And, even during the legal engagement, Hack VC continued to lie & attempt to harm me through their lawyers and other employees/partners (multi-million dollar carry & clawbacks can make even the nicest ppl willing to turn the other way or lie). @0xRodney @IsTheBaron @roshunpatel @Alex__Botte. Now. Almost an entire year of engagement & my near suicide anniversary coming up, our lawyers (mine & Hack VC's) have reached the point of preparing for private mediation and settlement. And...I realized that I just can't do it. I don't want money in exchange for silence. I'd rather speak. I fired my lawyers yesterday. In case it needs to be said, I did a good job at Hack VC. I was only there full time for 7 months; been part-time since 2021. I got a $50k raise to $300k, $30k bonus, and promises of additional carry that would have been implemented about a week or so after my last day. I was also offered admission into the GP entity (but not sure if admission was actually completed bc it was during my medical emergency). This + my resume, should show that me suing is not a money grab; I was genuinely harmed. I'm aware that I'm just one person (who is not rich) facing a $600-700M VC institution. I've been told by @alpackaP that he's known most of the managing partners at most VC firms for almost a decade and he could absolutely blacklist me. I'm also painful aware that the conclusion of this will probably be extremely poor for me or death - but I've accepted it. Sharing with other web2 & web3 VCs: @paulg @ycombinator @500STARTUPS @a16zcrypto @PanteraCapital @dragonflyvc @RaceCapital @hosseeb @haunventures @hiFramework @ElectricCapital @blockchaincap @Delphi_Digital @variantfund @1kxnetwork @archetypevc @shimacapital @robotventures, etc. TLDR; I’m done with continued threats, pressure, and intimidation. I'm not going to take a payout and allow Alex or Hack VC to walk away from harming me. As mentioned, I'll be dropping the evidence from my case on Wed 8/26 (or before) -- privacy be damned. Support here (or DM) please: ETH: 0x68c10776C5c05Cbf5B4C2318bE02D61B9f06B875 SOL: B7S8TPcWWJXTsmgG8ShoTmy8sNPuJ3Dbmt7z5gLFAveq
320
683
144
5,942
1,316,443
🚨TO ALL AUDITORS: Monad’s security team just open-sourced an agentic Solidity fuzzing system. Its default campaign uses 43 agentic nodes to map flows, threat-model, derive properties, hunt bugs, triage findings and produce a report. This looks awesome! github.com/monad-developers/…
3
20
152
7,810
Paulius retweeted
Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link. We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.
972
1,367
819
5,571
3,442,887
🚨 Important Security Notice🚨 Our third-party email service provider Brevo has experienced a security breach. Please note that the email titled “Data Breach Notice: Please refresh API Keys as soon as possible” was not sent by us and is a phishing attempt. Do not click on any links contained in this email. We are currently investigating the incident and will provide further information as soon as it becomes available.
18
52
14
156
17,635
Claude: Code is done! Codex: There's a bug here. Claude: Fixed. Codex: There's a bug in your fix. Claude: Fixed. Codex: There's a bug in your fix. ... 12 hours later ... Claude: Fixed. Codex: There's a bug in your fix. ffs
101
37
24
1,193
153,583
Guardian just announced $1 Million in security audit grant funding. Here's everything protocol teams need to know and how to apply. 👇
1
7
1
32
4,242
Paulius retweeted
I was the poor kid that was ready to do anything to help his family financially. Googling “how to make money”. Trying out every stupid idea. I never wanted money for myself, I wanted higher quality of life for my loved ones. After achieving the goal, calling my mother and saying “you don’t have to work anymore” (sweet goal to achieve), it felt kind of weird. What now? The time came for me to buy exotic cars, travel, date lots of girls. Plenty of good times, but as with many things that give you a present moment high, you can overdo them and get bored. What do you do when you are bored? Start a WAR. War with yourself, your old self, so that a better, stronger, newer one can be born and rule. How tf do you start a war with yourself? Set a goal you FEAR. One that you fear thinking about, and squirm when you imagine sharing it with others. On this journey right fucking now. I love this shit. I truly invite you reading this to join the awesome ride of reaching your true potential. It’s joyful even in the failures and the saddest moments. It’s purposeful, complete and aesthetic. You have just one short life, make the story beautiful, one worth telling. Lessssgo🫡
27
23
244
9,615
Important Update on Arbitrum Nova. As per a recent proposal, the ArbitrumDAO has voted to minimize Arbitrum Nova by transitioning it into a maintenance-oriented state with reduced capacity and deprioritized support. A thread on what this means for developers and users 👇🏻
4
9
4
63
18,826
You should: 1. Know the docs page on --via-ir differences . 2. Know that that page is not a complete list of differences. 3. Know everything in the Solidty docs that says "undefined behavior" 4. Most importantly, if you intend to deploy with --via-ir, run all tests, fuzzing, everything with --via-ir.
1
1
1
12
1,446
Some pools still have a notable TVL in Curve pools on Fantom Opera. If you are one of the LPs - please remove before June 30: that network is shutting down
Since launch, Sonic has become the home of the ecosystem - users, builders, liquidity, and validators have all made the move. With that transition complete, Fantom Opera will be retired on June 30, 2026. The Fantom Opera network will cease operation at 5:00 PM GMT on June 30, 2026. If you have not migrated your assets, please do so before then. This serves as official notification of the network closure. The ERC-20 FTM → S route and Sonic Gateway are not affected. Full details 👇
101
10
2
101
17,902
Paulius retweeted
npm finally fights supply chain attacks with v12 (July 2026) blocking install scripts by default. Here's how to adapt early without breaking your CI 🧵 What's changing: • preinstall/install/postinstall scripts → blocked by default • Git dependencies → blocked by default • Remote URL deps → blocked by default The fix is creating a one-time allowlist per repo: 💻 npm install 💻 npm approve-scripts --all 💻 git commit -m "chore: allowlist install scripts" This snapshots exactly what's trusted today and only new unknown scripts are blocked automatically going forward. CI adaptation playbook: 1. Upgrade to npm 11.16.0+ 2. Run the approve-scripts commands above 3. Add --strict-allow-scripts to your pipeline Now jobs will fail loudly if anything unreviewed tries to run. Source: github.com/orgs/community/di…
1
6
402
Paulius retweeted
🤯An AI security tool has 1st-place performance on security contests from just 1yr ago. Solidity-auditor v3 is out, FREE & Open Source. Thousands of Solidity developers are using the tool already. Upgrade your security baseline, use the tool🫡 pashov.com/solidity-auditor-…
98
121
24
505
46,661
rant time: people are so fucking obsessed with building more tools, more products, more services, more "security" layers. are you guys all fucking insane?? every single thing you add is more complexity. and complexity is exactly what makes systems _dangerous_. you don't get safer by stacking abstractions on top of abstractions. you just increase the attack surface and pray the whole dependency chain doesn't collapse (hint: it will collapse!!). now you depend on 10, 50, 100 moving parts. all needing updates, all with their own bugs, all potential supply chain failures and we call that "security" like fucking retards. dude, it's the fucking opposite. we're not building safer systems. we're building systems so complex nobody actually understands them anymore. and almost nobody is asking the obvious question: **what can we remove?** everyone wants to add. nobody wants to reduce. that's how you end up in a nightmare system (hint: we're already in that nightmare). not because of one big failure. but because of thousands of tiny dependencies you never should have had in the first place.
34
28
2
253
13,331
Paulius retweeted
software engineering in 2026: - your package manager is compromised - your cloud provider blocks your account - github itself is hacked software is solved
155
955
64
11,860
416,569