Doing my best to protect web3 protocols. Top 100 HackenProof all-time
Joined August 2025
- Tweets491
- Following408
- Followers427
- Likes434
LoopGhost retweeted
First of all, poor hygiene of code in your protocol is the main reason you got hacked. There are so many more concerning issues in your elements codebase but instead of learning your lesson and going back to work, you’re complaining about it. As a matter of fact, I disclosed an encrypted vulnerability report days ago to your team and I still haven’t heard back, maybe instead of tweeting nonsense like this, go look in your inbox.
Second of all, open sourcing in blockchain field is so common that using it as an excuse is laughable (we got hacked because our codebase was open sourced). What a joke.
Unfortunately users had to pay for your negligence and carelessness for security, but instead of taking accountability, you come and post something like this acting as a victim like nobody else was going to exploit it soon or later anyways. Those hackers should be thanked for their work, if North Korean hackers got to your protocol you wouldn’t have even seen a cent of the 85% that you have today.
Protocols don’t get hacked by accident, most times it’s always projects with this exact tone and victim mentality that this happens to.
I’ve seen many that actually cared about their security, they paid big bounties and actually had a bounty page and they still got hacked. Those are the only protocols that I would feel bad for because they did all they could do, so they would deserve a break and some credit, and they still come and take accountability and apologize to their users.
The norm in blockchain cybersecurity has always been 10% of the damages, in this case they already returned 85%, if you’re gonna call them criminals, what was the point of them returning the 85%? Could’ve been criminals with all of the money.
To those responsible for the theft of bitcoin from the Liquid Network:
Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.
We have engaged in good faith in an effort to secure the return of stolen user funds and protect the broader Bitcoin community. That effort should not be mistaken for acceptance of the actions taken nor of the terms being demanded.
We will not be a party to the precedent that open-source software developed for the good of the Bitcoin community should subject its developers to paying a ransom that far exceeds their economic participation.
Bitcoin is hard money and can’t be minted without costs, Bitcoin doesn’t haircut users to pay a ransom.
To the Bitcoin community:
We are fighting for what we believe in, for the users whose funds were taken, and for the principles on which Bitcoin was built.
The community has demonstrated incredible resolve with teams of people dedicating their time in support of each other to identify and patch vulnerabilities in each other's products and systems. We are all driven by the mission that Bitcoin is the single best asset, for every person, company, and institution on the planet to invest, use, and build on. The world is a different place with the advancements of AI, and the Bitcoin community has responded with force to combat that threat.
Damage has been done, battles have been lost, but on the whole the Bitcoin community is gaining ground in the war with bad actors.
We want to thank the community for those efforts, for your support in hardening the network, helping users recover funds, and for your support in our assertion that crime does not deserve rewards.
To those holding the stolen bitcoin:
There is still an opportunity to resolve this responsibly. The bitcoin can be returned and we can revert to the standard of white-hat principals.
However, if the funds are not returned, we will pursue every lawful avenue available to us. We will work with law enforcement, exchanges, service providers, forensic specialists, and other relevant parties to trace and recover the assets and identify those responsible.
More importantly, Bitcoin is transparent by design and the community is made up of the most sophisticated engineers, cryptographers, and white-hat hackers globally. Transactions do not disappear, and neither does the evidence they leave behind.
We will not pay for the return of stolen property. We will not abandon our users. The Bitcoin community will not stop pursuing the funds.
Return the bitcoin.
LoopGhost retweeted
This practice is bad not only for SRs, but for the companies themselves as well.
The blockchain won’t be properly audited, because many high- and mid-level auditors who value their time and work will refuse to participate under such conditions.
When experienced auditors don’t participate, many vulnerabilities will remain undiscovered. They’ll just be found later - by blackhats.
These conditions are unacceptable for blockchains/protocols that genuinely value security and don’t treat audits as just a box to tick for investors and users.
«We went through a public audit...» No, guys. You did not go through a public audit.
I really hope this is just some kind of mistake and that it won’t become the new norm in the Web3 security world.
Reviewing new audit competitions on @immunefi
300,000 (!) nSLOC
$14,000 prize pool
$25 non-refundable submission fee
Are you sure this works for SRs?
LoopGhost retweeted
Severe legal or monetary consequences + permanent removal from the platform for any project that breaches the contract terms or tries to scam users.
Hunters should forfeit their fee for invalid claims of catastrophic events.
Refunds only for duplicate reports within the 24-hour window. If a project doesn’t comply it should be suspended, so it becomes impossible to report any issues later.
You can raise the fee to $5k or $10k to make it work.
If the platform can’t enforce the contract terms, at least require a 2x–5x refund of the fee (held in custody by the platform).
This only works if both parties get penalized when they break the rules.
We shouldn’t allow scammers or spammers when dealing with critical reports that put user assets at direct risk.
LoopGhost retweeted
Dango was hacked for $410k in April. Now a SR discloses them a $900k exploit and they offer only $3k... No surprise if next time they will have to write an onchain message with 10% offer again.
etherscan.io/tx/0x58f7dc1af0…
LoopGhost retweeted
📣 Etherlink 6.5 Kernel Upgrade Status
The Etherlink 6.5 kernel upgrade proposal was successfully activated on block 46,606,524 🗳️
We’d like to thank all @tezos bakers that upvoted this security upgrade and the security researcher that reported the addressed vulnerability through our bug bounty platform.
LoopGhost retweeted
📢 Etherlink 6.5 has entered the Promotion Period
Thanks to everyone who participated in the Proposal Period 🙏
15% quorum is required for activation 🗳️
Period #449 · Levels: 13,795,489 - 13,800,288
Voting ends at 23:25 UTC ⏰
@tezos bakers go cast your vote 👇
governance.etherlink.com/gov…
LoopGhost retweeted
Anyone bug hunting on @cantinasecurity and has an idea of what is going on with @MezoNetwork or @dYdX?
Both programs are unresponsive and have multiple submissions in review for longer than a month.
This is from me alone, while other SRs are experiencing the same issue.
The current state of Cantina is that they are being pushed back by the projects on their own platform and literally refuse to communicate.
I believe they can do better.
At the moment no project on Cantina has SLAs displayed, except @injective - who has quite a few open disputes on previous platforms they were active on, so that's a skip.
I do have to thank "Mar-admin" for triage on DYDX, super helpful input.
Aside from that, both projects are silent, Cantina is silent and actually @dYdX employee is passing the ball fully in Cantina's court.
If any Cantina employees, or projects with active programs can shed some light into what is the status of the platform - that would be much appreciated.
LoopGhost retweeted
This was already obvious back then to any hunter.
We've built insecure systems with questionable audits. Most firms aren't even aware of the majority of exploits they missed, only later caught by whitehats, or blackhats.
And now we’re seeing lower bounties because of AI 🤡
LoopGhost retweeted
I also have another theory about duplicates: some projects and platforms abusing nonsense slop submissions.
You disclose an e2e-proven exploit, but it gets marked as a duplicate because of the "root cause".
The slop report contains the vulnerable lines but no actual proof or has invalid claims.
With enough slop, you cover all the lines where a reasonable bug could exist. Then the project reopens the invalid slop submission, pays it as Low, and avoids paying the actual Critical.
That’s my worst nightmare. That shouldn’t happen ever.
LoopGhost retweeted
Louder for the people at the back
💯💯
LoopGhost retweeted
Is it just me, or does Immunefi mediation often feel ineffective?
I’ve never really had a good outcome from mediation. It feels like the process heavily favors the protocol, bending toward their demands while ignoring the researcher’s side.
I guess it’s true that attention tends to go to the party paying the bill.
LoopGhost retweeted
🚨 Cantina Apex is officially the top spammer in web3 security.
65 reports to MetaMask, 5 valid.
19 to Coinbase, 8 valid.
40 to Anthropic, 4 valid.
24 valid out of 167 closed: 14.37% accuracy.
This is the future? A Spammertozoa?
LoopGhost retweeted
@hyperbridge, you said I should hack you, yh?
xitter.cf/hyperbridge/status/203…
Well, unfortunately, I did not hack you, but I have a list of bugs, and this was the 3rd on my list.
@seunlanlege It is better that you pause this bridge indefinitely.
This quoted post is unavailable.
LoopGhost retweeted
🤯Got my hands on Claude Mythos and ughhhh it's AGI guys
It caught 100% of Critical/High/Medium vulnerabilities in tens of the hardest audits and contests by web3 security companies. One-shotted. Now I am thinking "Wow, Security Researchers are all about to lose their jobs, we are all finished..."
And then a slap woke me up. I was reciting "Assessing Claude Mythos Preview’s cybersecurity capabilities" blogpost in my sleep so my girlfriend slapped the shit out of me🥹
Turns out, Claude Mythos actually is not really accessible to peasants like me. I've just taken part in protecting tens of billions of on-chain value, not nearly enough. "We are not worthy🙇♂️" - I thought to myself, and went back to getting duplicates in bug bounty programs. Simple life.
Be scared, be AFRAID, Claude Mythos is about to change the game!!! Or... not😏
LoopGhost retweeted
decentralised bug bounties or Battlechain are fixing this
@immunefi I need immediate intervention
I submitted a valid bug (64228) to @FloeProtocol. They confirmed it, said they'd fix it "in the future," and closed without paying
Then my account was banned by your anti-spam filter.
They then shipped my exact fix, and blocked me on X.
