Harry Crabtree 🦀 @HarryGbc

The sophistication of these attacks are getting insane. Today's victim: BITGET. $351.6 million gone from hot and warm wallets this morning. Biggest crypto hack of 2026. Biggest exchange breach since Bybit. CEO Gracy Chen: the private keys were never stolen. Attackers hit a critical backend system in Bitget’s wallet stack, spoofed the transaction data, and walked it through the exchange’s own authorization process. The keys did their job. They signed what the system told them to sign. “Not a private key compromise” is technically true. It is also the least reassuring true sentence in this story. If fake transaction data can enter your authorization pipeline and leave it approved, the key is beside the point. The failure sat upstream: in the layer that decides what gets signed. This is a much more dificult problem than custody. Difficult to audit and build processes to protect against. $351.6M total, hot and warm wallets ~$192M across 15 transfers, 7 assets; ETH the largest slice at 44.4% $464M User Protection Fund covers the loss in full Withdrawals paused. Deposits and trading still live. Chen flagged IPs matching VPN patterns used by a DPRK group. On-chain analyst Specter traced bridged XRP back to AFX Trade exploit funds from July: attributed to TraderTraitor.

In conclusion - defense in depth suggests you should fix *everything*. But the vast majority of exploit paths identified have significant practical mitigations and the actual rate of defects/exploits has remained largely flat when compared to human first attackers. Use AI, but don't buy the hype

GS-InfoSec @GsInfosystems

a week ago

Project Glasswing stats have been updated. Less than half a percent of CVE’s have been exploited in the wild. Link: github.com/patrickmgarrit…

5 30 141 41K 123

Balancer is dying. Here is how and why, and how you can avoid the same fate. x.com/i/article/2099…

Less of an update on this one, and more of a thought partnership. 2. Early thoughts: Manyways Quests 🏹 Teaching friends, family, and teams to use coding agents in their daily workflows has made me want to build more around enablement. Give it a read. x.com/i/article/2098…

With that .85% ($45,000) burn, we've now burned in total 1.85% ($100,000) of robinhood:0xa26992c4268a8a78a4d872fe4bdad2ed03ac287d. 🔥

Hello, you can call me T. Apologies in advance for the long-winded intro to the project. Over the last few days, I’ve watched attempt after attempt to launch an inference router fail. Most were thin wrappers around basic model-to-model requests, built without any sense of what a real router could become. Then, time and again, the teams rugged. It has been frustrating to watch because the first version is not difficult to build. A live catalog, metered requests, honest pricing, one balance and reliable access are all shippable (You can already do this in Manyways). The harder part is staying to build the full system people were promised. My goal is to make $MANY the currency that powers democratized inference. Fees generated by the token would flow into a shared inference balance that pays for real requests across model providers. As the token is used, the pool grows. As people use the pool, they get access to models and give us the data needed to build better routing. Every request still has a real cost, so the balance, spending limits and routes should be visible. If the pool can fund a month of inference, we should say that. If it can fund years, we should show that too. I want the economics tied to something people can use and inspect. In 2021, Robinhood showed how much demand appears when you remove commissions, minimums and ceremony from markets. I want to bring that instinct to intelligence: fewer accounts, fewer paywalls and a much lower barrier between a person with an idea and the models that can help them build it. Manyways already starts with free model comparisons and one wallet-funded API. The larger mission is to turn $MANY fees into shared access, then keep widening that access as the network grows. I want to build an inference economy where the token continuously buys the thing it represents: intelligence people can use. Come give it a try @ manyways.dev -T

Sports betting, Creatine & Crypto The holy trifecta.

I just found a confirmed bug on @immunefi as a chief finder #immunefitribe immunefi.com/s/ss/?severity…

Robinhood Chain...... x.com/i/article/2089…

Every founder asks what an audit costs. Almost nobody asks how long it lasts. Kind of strange don’t ya think, because you'd never buy anything else this way. You'd never lease equipment without asking about depreciation. You'd never buy insurance without checking the coverage period. But teams spend $80k on an audit and never ask the only question that determines its value: What is this worth after my next release? Because an audit doesn't have a price. It has a depreciation curve. It's worth the most on the day it's delivered and loses value with every merge, every dependency bump, every config change, every new integration. This is what I call Audit Durability. How long an audit's assurances actually survive contact with your roadmap. What can we as a team do to extend this coverage? And for most fast-shipping teams, the honest answer is quite a lot with the correct framework. Now run the real maths: $80k audit ÷ 12 months of assumed coverage = feels reasonable. $80k audit ÷ 6 weeks of actual Audit Durability = the most expensive PDF you own. The audit industry sells you the first calculation. Your attackers are working off the second one.

This one aged well….

Harry Crabtree 🦀 @HarryGbc

2 months ago

🚀 StonkBrokers on Robinhood Chain, Robinhood officially launched its own permissionless Layer 2 (built on Arbitrum) on July 1, 2026. The chain is designed for tokenized real-world assets, stock tokens, and DeFi. Right in that window, one project stole the spotlight:

7 1 24 1K 1

Spoke to @HarryGbc on the state of risk in DeFi and what we are building at @Verdict_Finance The future will be risk averse as institutions come on board and agents are batch killed for underperformance. youtube.com/watch?v=NyyvLi…

We studied 556 DeFi hacks ($16.6 billion in losses) before writing a single rating criterion. Here's what actually breaks. And why "it's audited" predicted almost none of it. First, the number that should reorder every security budget in this industry: 56% of all recorded DeFi loss never touched a smart contract. $9.4 billion walked out through keys, custodians, frontends, and operational failure. The code was fine. The full breakdown: ~56% ($9.4B): infrastructure, compromised keys, custodial breaches, frontend hijacks ~33% ($5.6B): on-chain contract logic ~9% ($1.5B): governance capture, dependencies, rugpulls Three domains. Three different owners. One tool covers none of them alone. Now look at where the industry spends. Almost all of it goes to audits, which only address the 33%. And an audit is a snapshot of one commit on one day. The code you ship next month isn't the code that was audited. The biggest loss domain gets the least scrutiny. This month a perp protocol was drained of $ 23.7M. It had passed six audits. The attacker didnt touch contract logic. They compromised a signer key. Every one of those six audits scoped off-chain key management out. Six audits. Zero coverage of the surface that mattered. The deeper problem: risk in DeFi is inherited, not isolated. Flawless code reading a manipulable oracle inherits that oracle's risk. A contained logic bug plus an EOA admin key is catastrophic where each alone is medium. An attacker takes the cheapest path in. Nobody scores the dependency graph. So nobody sees it. We took the full loss record and worked backwards. Every recurring failure mode became a testable defensive requirement: "to prevent X, a protocol must do Y." 62 requirement classes. Built from observed loss, not theoretical threat models. That's the foundation under @Verdict_Finance: Ratings across the whole stack: protocol, chain, oracle, token, org, bridge, vault Operational assessment on the surface audits can't see Contract scanning between audits Cover that turns the rating into a live price The question the market keeps asking is "is it audited." The question that would have caught most of $16.6B is "what does this protocol inherit." We're building the infrastructure that answers the second one. Follow along and see our journey.

The trust layer for DeFi deserves a home that reflects it. verdict.finance just got a makeover. Built for the institutions, protocols, and allocators who need more than vibes before they deploy capital. Go take a look. verdict.finance

x.com/i/article/2082…

Defi hacks have cost protocols ~$16Billion in losses. They fall into 3 camps: Infra: private keys, custody breach, infra and frontend hijacks. Logic: smart contract exploits. Ecosystem: governance dependencies, team failures. We need a trust layer for defi which addresses all three. Thats why we are building @Verdict_Finance Infra is addressed by our Pre Launch Risk Assessment. Logic is addressed by WhiteHat our in house triage system and code level Ratings. Ecosystem is addressed by our Ratings system which incorporates the above two in a dependency graph. We need defi to stop becoming a magnet for scammers. We think we have the solution.

The Finding Paid Zero. The Method Was Real. Small shop, serious methodology. I submitted a BeaconKit finding through Immunefi. BeaconKit is the consensus layer behind Berachain. The report was closed as out of scope. The project still confirmed the code trace was accurate and the PoC was reproducible. A bug can be technically real and still pay zero. That’s the line this thread is about.

Running back one of the oldest tricks in the book of 2021 NFT projects… A giveaway. I’ll personally design and name a @Spritehoodio NFT and mint it for the winner as token #3 in the collection Like, RT, follow @Spritehoodio to enter I have strict rules to prevent cheating

x.com/i/article/2080…