You Build. We Defend. Since 2014 protecting critical decentralized systems: L1 nodes, smart contracts audits, wallets, web3 dApps, exchanges, bridges.
Joined July 2014
- Tweets2.3K
- Following797
- Followers3.2K
- Likes3.4K
Pinned Tweet
Coinspect is now a Ledger security audit partner for Ledger wallet apps!
As one of Ledger's approved audit partners, we bring our crypto and embedded security expertise to help developers find and fix vulnerabilities before release.
Building a Ledger app? Let's talk.
Qubic's Math.random() wallet drain is another example of a vulnerability Coinspect has been warning about for months.
Coinspect Security retweeted
"iPhones are safer than hardware wallets."
Check Calif's research.
Ledger attackers physically implanted hardware. They didn't remotely break into the device.
AI is making remote 0day exploits cheaper. It has not changed the value of reduced attack surface and physical isolation
web3 frontend security: A dApp can serve malicious code to just one user while everyone else sees a normal site.
DappFence doesn’t need to recognize the attack to block the code.
It verifies that frontend code is authorized, without waiting for a report or a blocklist update.👇
Coinspect Security retweeted
Meet DSS 2026 speaker @0xmatebabe.
“Ill Bloom: Finding and Responding to a Wallet-Generation Flaw That Exposed Millions”
Open a talk and save it to your agenda.
defisecuritysummit.org/2026/…
Tickets: luma.com/9qtxqqxx
ALT DSS 2026 speaker announcement card for Joaquin Pereyra: Ill Bloom: Finding and Responding to a Wallet-Generation Flaw That Exposed Millions
Coinspect Security retweeted
What was vulnerable: Station Desktop (the 2019-2021 Electron wallet) generated BIP39 seed entropy with crypto-js 3.x WordArray.random() - a PRNG, not a secure RNG. Same class as Coinspect's 'Ill Bloom' (CVE-2026-71851). github.com/advisories/GHSA-r… /2
If you suspect Ill Bloom or another weak wallet generation vulnerability is being exploited on a blockchain not currently covered by our datasets, please get in touch with us.
We can expand coverage where there is evidence of affected wallets.
We've spent over a decade securing crypto systems and wallets.
Our Ledger app audits go beyond native code vulnerabilities to cover business logic bugs, unsafe smart contract interactions, phishing risks and exploitable gaps in clear signing.
Learn more about Ledger audit requirements:
developers.ledger.com/docs/d…
1/ We've been making steady progress on DappFence.
The goal is simple but ambitious: dApp users shouldn’t have to blindly trust whatever content and code intermediate providers serve. The browser should be able to verify that the frontend is authentic.
3/ This is an important distinction:
Frontend integrity is relatively easy to demonstrate on a static site. Making it work with modern frameworks, server-side rendering, and real deployment pipelines is the harder problem.
That's where much of our recent work has gone.
4/ Our vision is that securing decentralized systems can't stop at smart contracts.
Users interact through browsers, wallets and frontends.
DF is still a work in progress. Check the current code, testing and integration work happening in public:
github.com/coinspect/dappfen…
1/ Wallet teams: Your users can switch wallets and carry the a vulnerability with them.
If a mnemonic was generated by a broken PRNG, importing it into a new wallet does not make it safe.
That’s the problem Unlukey is built to solve.
5/ The check is private by design.
The mnemonic never leaves the wallet.
No address lookup.
No central service that needs to know what the user is checking.
Wallets can check locally against the published and reproducible datasets.
6/ This is where wallet teams can help.
A weak mnemonic can stay in use for years, even after the original app is gone. Users import it, receiving funds and assuming everything is fine.
Integrate Unlukey and warn them before an attacker finds them.
github.com/coinspect/unlukey
