Devendran

That's a wrap on @EFDevcon 🇮🇳 Binance's post-mortem says its $6.3B hack began with a fake job interview and a coding assignment on a work laptop. At Devcon, security and agent builders said it too: attacks are moving from code to people. More soon from @RTindex and @Payaion .

Final day at #Devcon8 @EFDevcon 🇮🇳 4 days with security teams, agent builders and Base. Clear signal: agents need to pay for files, devs need to check code before running it. RTIdx → rtidx.com/conference/devcon8 Payaion → payaion.com/conference/devco… Still here today. DM to meet.

Day 3 at #Devcon8 @EFDevcon @ethereumfndn 🇮🇳 A $6.3B hack began with a job interview. Check the code before you run it → rtidx.com/conference/devcon8 Sell files for USDC on Base, to people or agents. One gasless signature, 95% to the seller → payaion.com/conference/devco… DM to meet.

Day 1 at Devcon 8, Mumbai. That's a wrap. An afternoon at the Security Hub with people working on incident response, threat intel and security funding. One idea kept coming up: catch attacks on developers before they land. That's what we're building with @RTindex . Good to catch up with old friends from the ecosystem too. Tomorrow: agent payments and private file sharing with @Payaion . At Devcon? DM and we would love to connect with you. #Devcon8 #Ethereum #Web3Security #AIAgents

I’ve pitched in! If you love open source, consider donating to help keep this project alive and thriving. Donated to GNOME! donate.gnome.org

Real talk — I almost lost my wallet to a fake "Blockchain PM" interview a while back. Stolen identity, a cloned GitHub, a MetaMask connect request mid-call. Got lucky — empty wallet, and I happened to check the console. Since then I've been part of the team behind @RTindex , built within @thedefdone . This week we shipped a free CLI that checks a recruiter's repo before you run it. Anyone else been targeted by one of these? Tell us about it.

A development worth watching closely.

🚨 Something happened during a job search that I sat on for months. I'm talking about it now — because we built something about it. I was contacted for a blockchain role. Professional communication. Real company name. Proper GitHub repo. All the right signals. They sent a take-home technical task. I ran it on a cloud instance instead of my laptop. Good instinct, as it turned out. The actual code ended at line 46. Everything beyond that — all the way to line 258 — was a hidden payload: 🔑 SSH keys 🌍 Environment variables 🔐 Credentials and API keys 💀 Anything it could reach on a local machine Designed to look like nothing. Designed to run the moment I opened it on my own machine. I flagged it to the "recruiter." No response. And then I kept thinking: what if I'd just run it locally, like most people would? That question didn't go away. This attack pattern has a name. It's documented. It's ongoing. It specifically targets blockchain and Web3 developers — because running code during a technical interview is completely normal behaviour, and that normality has been weaponised. I wasn't the first. I won't be the last. So we built a response to it. @RTindex — the Risk & Threat Index — is live today. Paste a suspicious repo link or a recruiter conversation. Get a risk verdict in under 2 minutes — with a clear explanation of why, not just a flag. The full story, the technical breakdown, and the case that started all of this are on the blog. 🔗 rtidx.com This wouldn't exist without @piotrdz (product vision and trust) and @jan_defdone , who engineered RTIdx end-to-end. Jan's work is the product. The platform's analytical foundations draw from research by Prof. @ameerrahmati and Abisheka Pitumpe PhD at Stony Brook University's Ethos Security & Privacy Lab — connecting serious academic research on recruitment scam ecosystems to a tool developers can actually use in the moment. If you're in Web3, blockchain, or any developer community — share this. Someone in your network may already be targeted. The index gets stronger with every report. 🔗 rtidx.com #cybersecurity #web3 #blockchain #developerprotection #infosec #recruitmentscam #rtidx