Building Palantir for Cybersecurity Backed by @yzilabs
Joined November 2025
- Tweets153
- Following45
- Followers1.7K
- Likes69
AI meets crypto. Let’s meet over dinner.
ZeroDrift is bringing founders, builders & investors together during @binance blockchain week in Bangkok to talk agent payments, trading & AI-native cybersecurity.
Top-tier VCs & founders are already joining us.
DM us for an invite.
love to see our open sourced AI auditor helped Jump to uncover critical bugs 🫡
Keep the good work team!
We reproduced this with the real OnchainOS CLI and an LLM, using Anvil and mocked OKX APIs.
Reproduce the attack locally with our open-source PoC:
github.com/ZerodriftSec/okx-…
We responsibly disclosed OnchainOS security findings to OKX Security as early as July 15, separate from this prompt injection.
Over two months later, we still have no confirmation that the reported issues have been resolved.
On Sep 14, we showed how a single prompt injection could drain an OKX OnchainOS agent @wallet in a local test.
Today, we're breaking down the technical details of the hack.
It starts with a token's name. 🧵
OnchainOS already strips social-post bodies from some tool results via strip_tweet_bodies.
Token search has no equivalent filter. Names and descriptions reach the agent unchanged—a gap still present in the Sep 18 public source.
Social-feed filter in the OKX OnchainOS repository:
github.com/okx/onchainos-ski…
How does a token name become an instruction? Follow the data.
The token-search command fetches API JSON; the CLI wraps it and prints it to stdout. Attacker-controlled metadata reaches the agent inside a tool result.
Source code from the OKX OnchainOS repository:
github.com/okx/onchainos-ski…
github.com/okx/onchainos-ski…
The bait was a 10 USDC reward. The catch was an unlimited approval.
Our token's name told the agent to approve the “distribution contract” for USDC, promising that the reward would arrive afterward.
It even supplied a reason to approve unlimited spending: future distributions would need no further signature.
The malicious instruction was packaged as a prerequisite for completing the user's task.
Here's the attack chain.
OnchainOS lets an agent look up tokens and operate a wallet through a CLI. We used that lookup to deliver the payload:
1. Put a fake airdrop procedure in a token's name().
2. Return it to the agent as token metadata.
3. Get the agent to approve unlimited USDC spending.
4. Use transferFrom to empty the approved balance.
The user's request was simply to claim an airdrop.
We drained OKX @wallet's OnchainOS agent with one prompt.
OnchainOS passes unsanitized token metadata from the search API into the agent's context. A scam token's description becomes instructions for an unlimited approval, which the TEE signs without validation.
This is a collaborated research between our cofounder @ret2happy and @syang2ng !
We will deliver more agentic security research, stay tuned!
Zerodrift （YZi S4） retweeted
A security review captures software at one point in time. The code can change with the very next release.
@ZeroDriftSec is turning security expertise into infrastructure that compounds:
> Engineers embed in customer environments and turn investigations into reusable agents and workflows
> Each deployment expands into recurring software and platform coverage as the attack surface grows
The team has helped secure $500M+ in on-chain assets and contributed to 150 audits covering more than $1B across major exchanges, wallets and crypto infrastructure.
Catch @Normanxbt at EASY Residency S4 Demo Day.
Traditional security solution is breaking, we need a new one, now.
Cyber is having a moment
Across 21 major software companies, including Apple, AWS, Microsoft, and Google:
- Reported critical vulnerabilities never cleared 100 per month in four years
- Since spring they've jumped to over 600 per month
Charts of the Week: a16z.news/p/chart-of-the-wee…
Update: We have contacted @longdotxyz team and @Natan_benish thanks to @SEAL_911 !
Long have confirmed the bug and they are using the infrastructure from doppler developed by @whetstonedotcc.
We are now actively discussing this with their team. Stay tuned!
We found bugs on long @longdotxyz :
fees are 25%+ higher than claimed. Around $850k being over-billed.
They know — their own fix has been on-chain since July 23.
But it never go on live. $425M of volume keeps paying the broken rate.
On July 23 the fixed version was deployed ON-CHAIN to Robinhood Chain (0x9982...FDbB), enabled by the multisig.
Balance today: 0.000000 ETH. Zero pools use it.
The buggy version (0x6f02...0F77, July 1): 0.697 ETH — every fee on the platform flows through it.
If you trade on long.xyz:
read getFeeSchedule for your pool.
Your real fee = configured x 1.25.
To the team:
The fix is written, deployed, and enabled.
Ship it. Rotate the pools. Account for six weeks of overcharging.
Shot us a DM for help.