Bug bounty industry in Web3 is fully broken; unverified AI slop is making companies leave the platforms that don't verify submissions correctly.
Hopefully these companies will establish their own bug bounties. Feel free to reach out to if you need help with verification
Kotya Security retweeted
How does an AI security agent turn thousands of raw claims into a short list of real bugs?
@kotyasec explains the verification method and the role of local models.
Assumption → Independent review → Attempt to disprove → More evidence → Severity
Where precision and recall meet: each output enters the pipeline as intel and becomes a finding once every step validates it.
Read the full article 🔽
Down in the mines, mining vulnerabilities 💎 since the start of the year
Thinking of achieving 1000 vulns by the end of the year, but lets see
Bug bounty in web3 now is so broken
- it’s not okay to pay for submitting bugs
- it’s not okay to pay for passing KYC
- it’s not okay to pay for escalating issues
- it’s not okay to pay when your have several rejected findings in a row
Probably better platforms will appear soon
Kotya Security retweeted
The second session of our AI x Security Happy Hour featured a workshop led by @KotyaSec on our latest AI-augmented review method to surface bugs at scale: vulnerability mining.
Auditing is now a coverage game: running AI agents until coverage saturates, sometimes surfacing 1,000+ findings in a single protocol. Human verification and triage remain key steps.
He also explained how prior knowledge becomes the basis for new discovery, encoded into a set of review strategies, including invariant-based and property-and-specification review.
How vulnerability mining is pushing auditing beyond the limits of manual review 🔽
youtu.be/lnHTqQ3H7oE?si=lK01…
I think this is a very significant event for Web3. Back in the days, Ethereum had to execute a hard fork to fix a catastrophic event for the chain.
Nowadays, it's okay that a set of Security councils updates the chain back and forth to fix a problem of other projects.
The Arbitrum Security Council has taken emergency action to freeze the 30,766 ETH being held in the address on Arbitrum One that is connected to the KelpDAO exploit. The Security Council acted with input from law enforcement as to the exploiter’s identity, and, at all times, weighed its commitment to the security and integrity of the Arbitrum community without impacting any Arbitrum users or applications.
After significant technical diligence and deliberation, the Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or Arbitrum users.
As of April 20 11:26pm ET the funds have been successfully transferred to an intermediary frozen wallet. They are no longer accessible to the address that originally held the funds, and can only be moved by further action by Arbitrum governance, which will be coordinated with relevant parties.
Kotya Security retweeted
Q1 2026 - DeFi attacks have already exceeded $137M in total losses. Roughly $9M was recovered.
The pattern is not new: Integer overflow. Oracle manipulation. Reentrancy. Flash loan abuse. Compromised keys.
We analyzed five of the largest incidents with our @KotyaSec.
Full trend analysis and write-up:
Finding crits, as usual 🤯
📢 March update on fuzzing efforts at @ConsensysAudits (w/ colleagues at @tu_wien): found 9 bugs (5 soundness, 3 completeness, 1 logic) across 4 projects (Corset, gnark, Noir, Ziren)! 🔥
Glad to help secure the ecosystem, @Consensys @gnark_team @LineaBuild @NoirLang @ProjectZKM!
Kotya Security retweeted
🖤Hackers with hearts showed up 📷
Look at all of you.
Our gatherings are for people who genuinely care about this space.
The builders, the researchers, the ones who stick around through cycles.
Grateful for everyone who came through.
@EthCC
On Wednesday, we're hosting dinner for a smaller group. If you're leading a project and security is on your mind, link 👇
Kotya Security retweeted
Consensys Diligence is heading to @EthCC! 🇫🇷
Good time to talk security, AI-assisted auditing and ZK fuzzing.
If you're planning an audit, connect with our team in Cannes:
- @T_Birb
- @KotyaSec
- @nicht_tintin
Kotya Security retweeted
Over-prompting dropped discovery rates from 50% to 20%. Structured workflows produce results an auditor can actually evaluate.
"Prompting AI is like giving tasks to an intern - you have to be very specific to get results." - @KotyaSec
Kotya Security retweeted
$1.9 billion stolen in 28 days.
That was February 2025.
Felt like the right time to share what we learned.
Our 2025 Security Recap brings together a year of documenting, analyzing, and learning alongside the industry. 192 incidents. $3.14 billion in losses.
The exploits that shaped the year and the patterns everyone building in Web3 needs to understand.
Some hard truths. Some open questions. We hope it's useful.
Full report below 👇
Kotya Security retweeted
Thanks for the love @GalloDaSballo. Likewise, huge respect for your contributions.
We know we’ve been pretty quiet. Just off in our corner breaking things and building tools like always.
2025 was about becoming independent. Now that the base is solid we promise to share more in 2026.
If you’re building anything on the EVM and don’t know about Consensys Diligence Tools
You’re likely just rewriting stuff they did years ago
Crazy how many times we’ve ended up finding tools and techniques we considered new as repos from them
Huge shoutout to an insane technical team that should hire a marketer asap
Kotya Security retweeted
If you’re building anything on the EVM and don’t know about Consensys Diligence Tools
You’re likely just rewriting stuff they did years ago
Crazy how many times we’ve ended up finding tools and techniques we considered new as repos from them
Huge shoutout to an insane technical team that should hire a marketer asap
Come to my talk in Buenos Aires! There will be examples based on past exploits, why war rooms are so important
When the next exploit hits, will your team be ready?
Uladzislau Yarashuk, Security Auditor at @ConsensysAudits, will speak at DSS about how to build a DeFi war room before a crisis, designing protocols, playbooks, and partnerships that turn chaos into coordination.
Kotya Security retweeted
Every audit report and protocol doc has smart contract diagrams, but none speak the same language.
At DSS, @sick_nerdballer from @ConsensysAudits introduces SCDS, a shared standard for architecture, flow, and threat model diagrams that makes systems easier to understand.
Market manipulation attack on the one of the biggest CEXs, with the type of vulnerability, which is super common for exchanges.
That's why we beleive in decentralized and transparent technoligies!
The Oct 11 Crypto Crash — What Really Happened
TL;DR:
Roughly $60–90M of $USDe was dumped on Binance, along with $wBETH and $BNSOL, exploiting a pricing flaw that valued collateral using Binance’s own order-book data instead of external oracles.
That localized depeg triggered $500M–$1B in forced liquidations, cascaded into $19B+ globally, and earned the attackers about $192M via $1.1B in BTC/ETH shorts opened on Hyperliquid hours earlier, but minutes before Trump tariff announcement.
It wasn’t a USDe failure!! It was Binance’s design flaw, timed with macro panic (Trump’s tariffs) for cover.
What looked like chaos was actually a coordinated exploitation of Binance’s internal pricing system, amplified by a macro shock and systemic leverage.
1️⃣ The Setup
Binance’s Unified Account let traders use assets like USDe, wBETH, and BNSOL as collateral.
Instead of oracle or redemption prices, Binance valued these using its own spot market - a major vulnerability.
On Oct 6, Binance announced a fix to move to oracle-based pricing, but rollout wasn’t until Oct 14, leaving an 8-day window.
2️⃣ The Exploit
During that window, sophisticated actors manipulated Binance’s order books, dumping ~$60–90M of USDe, driving it to $0.65 on Binance only (still ~$1 elsewhere).
Because the Unified Account marked collateral to internal prices, this instantly wiped margin value and triggered $500M–$1B in forced liquidations.
Then, Trump’s 100% China tariff headline hit, magnifying panic and liquidity stress.
3️⃣ The Profit Engine
The same day, fresh wallets on Hyperliquid opened $1.1B in BTC/ETH shorts, funded by $110M USDC from Arbitrum-linked sources.
As the Binance cascade unfolded, BTC and ETH cratered, those shorts netted $192M in profit before closing out at the bottom.
Timing, precision, and funding paths all suggest coordination.
4️⃣ The Contagion
Binance liquidations dumped BTC/ETH/ALTs into thin books.
Other exchanges mirrored the collapse through cross-market bots.
Market makers hedged across venues were forced to unwind everywhere.
Result: $19B+ global liquidations, with many alts down 50–70% intraday, all triggered by <$100M of manipulated collateral.
5️⃣ Who’s at fault?
Binance: design flaw + delay in oracle rollout = root cause.
Exploiters: executed and timed the manipulation, profited via external shorts.
Ethena (USDe): not at fault - protocol stayed 1:1 collateralized, redemptions normal, peg held everywhere else.
6️⃣ Aftermath
Binance admitted “platform-related issues,” promised compensation for affected margin/futures/loan users, and rolled out minimum price floors + oracle integration.
USDe remained operational, and the incident is now a case study in how exchange-side pricing errors can trigger system-wide liquidations.
Bottom line:
A ~$90M dump on Binance and a $1.1B leveraged short elsewhere sparked a $19B bloodbath.
Not a stablecoin failure, but a masterclass in exploiting flawed collateral valuation during peak macro stress.
We have been nominated 2 times, 3 will be a lucky number when we are finally elected!
Thanks @cp0xdotcom for the support!
One step closer to securing a spot in the @Arbitrum Security Council. 🫡




















