Full-stack Security Engineer & GTM Advisor | 2× @ethereumfndn Grantee | ETHSecurity Badge @thedaofund | Founder @Web3Sec_News & DigiBastion.com | 🦭 @_SEAL_Org
Based in India
- Tweets 8,699
- Following 2,903
- Followers 2,869
- Likes 24,578
Pinned Tweet
light finds the crack, water makes one.
both get through
only the timeline is different
1
8
402
Binance did not lose its keys. It lost control of what those keys would sign.
Go check yours today:
> Can your signer sign a raw digest it never decoded?
> Would it sign an EIP-7702 authorization for a custodial hot wallet? It should never need to.
> Is signing scoped per chain and wallet tier, or is it one path for everything?
> Do you alert on delegation changes, or only on balance drops?
If you cannot answer those in a minute, that is the answer.
1
1
5
301
If your AI agent browses the web on the same machine as your keys or your wallet, do these four things today.
- Check what you're running: ls ~/.cache/ms-playwright (macOS: ~/Library/Caches/ms-playwright). chromium-1248 means you're on the stale build.
- Point it at your real Chrome instead: channel: 'chrome' and chromiumSandbox: true
- Pin your MCP version. Stop using @latest.
- Container anything that visits sites you don't control. Keep hot keys off that machine entirely.
Why:
Playwright 1.64.1 bundles Chromium 156.0.8078.4. Chrome stable has been on 156.0.8078.79 since Oct 29. There is no 1.65 stable, so there is nowhere to upgrade to right now.
And Playwright launches Chromium with the sandbox off by default. Their own docs: chromiumSandbox defaults to false. The sandbox is what stops a bad page from reaching the rest of your machine.
Stale browser, no sandbox, and an exploit runs as your user. Files, SSH keys, .env, live sessions, signing material if it's on the box.
The bugs, all triggered by loading a page:
- CVE-2026-118306 (9.6), memory corruption in FileSystem, escapes the sandbox on its own
- Three more at 8.8: CVE-2026-118331, CVE-2026-118348, CVE-2026-118344. A sandbox would normally contain these.
Not known exploited in the wild, and the realistic path is your agent getting steered to a hostile page.
Fix it anyway, it takes two minutes.
h/t @nisten
5
12
1,134
why is clear signing still optional?
if I'm holding the key I should be able to see what the transaction does without trusting the interface that handed it to me. Most devices still show you a hash and you approve on faith.
usual answer to this is "use a multisig."
Bybit had one.
three signers approved, all of them reading the same spoofed UI. The keys were fine.
1
2
5
291
Only 15% of incidents account for ~80% of the TOTAL VALUE LOST in the last few years, and it's NOT CODE related - it's YOUR people, infrastructure, multisig operations, third parties, frontend & signing services, etc..
Quality & security don't come cheap.
not surprised to see all these crypto exchanges getting hacked.
recently @cyfrin was asked to conduct a grey-box penetration testing assessment on a crypto exchange as required by a govt regulator.
we provided what i thought was a very competitive quote for the comprehensive service required.
client said they have a quote for $6k, could we price-match? no way lol, we'd be losing money at $6k.
so there you go, $6k to secure a crypto exchange as required by a govt regulator.
the crypto exchange hacks will continue cause no one legit & thorough can secure a crypto exchange for $6k, gg
1
2
11
597
Raiders retweeted
This week @cyfrin running 7 private audits in parallel engaging 20 top auditors!
* 2 engagements include Formal Verification
* 2 upgrades to existing protocols
* 5 new 🔥 protocols across both EVM & Solana
Every day going above & beyond to help keep our clients safe 🫡
2
54
1,478
Raiders retweeted
gm folks - we have a few DevCon tickets to share for FREE.
if you would like us to share them with you, please comment with the reason why you need one & confirm that you have plans to visit the venue tomorrow so ticket doesn't get misused
7
1
6
414
Raiders retweeted
Shout out @__Raiders (front-end) @BengalCatBalu @BenRai_ @infsec_io (smart-contracts) completing @cyfrin private audits helping secure @notesystems 🚀
Off-chain & on-chain always doing our best to help keep our clients safe 🙏
6
8
69
2,548
A compromised DevOps laptop leading to container access and ~$6.3B in unauthorized withdrawals raises the usual questions around least privilege, DevOps pipeline controls, and third-party/supply-chain exposure.
why leave deposits open while the attacker’s full footprint, access paths, and possible privilege escalation to other services/devices are still being investigated?
New deposits look exposed until containment is fully confirmed. A short pause (days, not indefinite) seems the conservative move until the post-mortem is out.
Curious how others are thinking about this.
I want to speak to you directly about what happened.
Bottom line - your money is safe, and we're covering every loss.
Our initial investigation suggests this security incident may have started with a compromised DevOps engineer's laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.
To be clear: the attacker did not simply use one engineer's permissions, and this was not a single "one-click" action. It involved a more complex attack process. Our investigation has not attributed responsibility to any individual.
So far, we have found no evidence of any wallet private key leak.
We'll share a detailed technical post-mortem once the investigation is complete and every fact is verified - and publish an updated Proof of Reserves once remediation is complete.
What you need to know:
• Your funds are safe
• Binance will cover all losses from the SAFU fund and company funds
• Estimated total impact: ~$6.3B, with ~$3B frozen on-chain so far, in coordination with our blockchain partners
• No evidence of any wallet private key leak
• Deposits are unaffected and operating as normal
What we've done:
• Temporarily suspended withdrawals while we complete a security revamp of the withdrawal service and its related addresses
• Revoked the affected address authorizations
• Engaged law enforcement and blockchain intelligence partners to trace and recover funds
Our team hasn't stopped. We're working closely with law enforcement to ensure the matter is handled appropriately - and I'll share what I can, as soon as I can.
1
1
6
637
Raiders retweeted
Running 10 @cyfrin private audits in parallel, finally we did it after hitting our previous max 9 three times this year!
My biggest problem is need to sleep since there's always someone to reply to & demand for quotes is constant.
Doing our best daily to secure our clients 🫡
6
1
65
1,900
every project should just put a proper *security.txt* on their domain (atleast)
that way if a whitehat doesn’t feel like dealing with your bug bounty platform for whatever reason, they can still reach your security team directly with a PGP encrypted report.
don’t make good-faith reports harder than they need to be.
3
1
22
1,876
Raiders retweeted
Happy to share, Cyfrin has wrapped our audit of @notesystems’ front-end, the app for their autocallable barrier notes on tokenized US equities.
Read the full report 👇
github.com/Cyfrin/cyfrin-aud…
Our frontend audit with @cyfrin is complete.
No critical or high findings, and all 7 medium findings resolved.
Report: gitlab.com/notesystems/note-…
Our backend audit is in progress. Across 75 smart contracts, no high or critical issues found.
Mainnet is getting closer.
9
18
66
2,507
Raiders retweeted
3yr speedrun auditor -> executive, ask me anything
October 2022 - started learning solidity as a hobby
March 2023 - focusing on security & began writing my "Deep Dive" series
October 2023 - blessed to join @cyfrin as a full-time smart contract security researcher!
🚀A lot can change in a year if you put your mind to it🚀
16
2
69
4,115
genuine question for anyone running AI in their audit flow: how do you find the blindspots in the AI itself?
you only ever get to review what it reports back but whatever it didn't flag just passes through quietly & not many are checking that part.
that's usually what ends up live g then it's an incident instead of an audit finding.
1
182
Raiders retweeted
I've pushed significant updates to coldclone, a very useful tool for sanitizing foreign repos before engaging with them.
If you're an auditor doing a lot of quoting or a dev downloading new repos to use, running this first is a no-brainer github.com/devdacian/coldclo…
6
6
66
3,819
Raiders retweeted
Happy to announce I've accepted an executive position @cyfrin, formally joining the leadership team as Head of Security Research.
We're working harder than ever to keep our clients safe while scaling our private audit business to handle epic demand.
🙏 Blessed 🙏
79
9
352
7,347
lol, dot.com redirects to @grok bot now - absolute banger move by @elonmusk 🍿🍿
for the time being, let's move to Claude/Cursor until the dust settles and we get a clearer picture of the actual usability/reliability of everything they launched today?
Announcing dots. Dots work 24/7 for you, learn from your feedback, have their own computer, browser and can be connected to over 4k apps in our ecosystem.
They’re powered by Astra our best model yet. Included in your Pro plan, without drawing down on any of your usage. You can even call a dot while it’s working.
We’re getting you started with your primary dot today and soon you’ll be able to create entire teams of them.
1
1
4
783