4 months ago we both quit our jobs to build something we believe in Met by coincidence, won a hackathon, and never stopped building We just submitted Proof of Exploit to @colosseum 🔓 Here's what we've built, why we built it and how we got here 🧵

September was our biggest month yet Started in Bali, ended at the @SuperteamBR Garage in Brazil In between: a full relaunch, our first ambassador cohort, a reworked audit workflow & heads down building for @colosseum Our recap is live👇

⁠Three weeks ago we were in Bali. Working from our villa every day, ordering food in, laptops by the pool Locked in, barely leaving the villa Then @RegiRegiRegi123 jumped on a call with @shimas_sol, just catching up ⁠By the end of it, he had me completely convinced: we had to come to the Garage in Brazil 🇧🇷 It was 11pm. @SyotoshiX was still working, with his laptop by the pool in the dark "We need to go to Brazil" ⁠He looked up from his laptop. "What?" ⁠Two minutes later, he was convinced and we booked the flight the next morning ⁠Five flights later (Indonesia → Bangkok → Vietnam → Netherlands → USA → Brazil), we're at the @SuperteamBR Garage Thank you @kukasolana, @shimas_sol and @kauenet for the spontaneous invite and for treating us so well ⁠We have big things cooking for @colosseum and Superteam members. Stay tuned.

Millions of dollars in NFTs were vulnerable until a whitehat hacker @0xQuit took it upon himself to rescue them! Here is the story: A massive hack just took place via the @MagicEden NFT marketplace A bug in an old smart contract used by the marketplace, allowed hackers to use an old wallet approval from users to steal their NFTs and approved balances! The marketplace itself was already gone, but the wallet approvals users granted years ago were still sitting onchain That meant NFTs could be pulled from those wallets without the owner signing anything new After a few initial reports, the scale started to become more obvious, this was not a one-off theft It was an open door across a huge set of leftover approvals On the newer version of the contract an emergency pause could be triggered but this was not possible on the older version of the contract @0xQuit quickly realized this and started going to work in a race against the malicious hackers The goal was simple, steal the vulnerable assets and secure them before the malicious hackers could do so By morning, the whitehat managed to secure more than $5.7M in NFTs Unfortunately the malicious hackers realized not only NFTs but also approved WETH and USDC balances could be stolen The total reported theft (beyond the rescued NFTs) has been estimated at $2.8M+ but would have been significantly bigger without the hero whitehat hacker coming to the rescue!

The future of Solana just changed because of a few last-minute calls by @mert In case you missed it, @solana wrapped up a governance fight and one of the proposals came down to a hair Here is what happened: > The first proposal changes voting for Solana: who gets a say & what it takes for a change to go through It passed quickly > The second proposal was the real fight. It reduces the amount of new solana:So11111111111111111111111111111111111111112 printed per year for staking & validator rewards > Hours before the deadline it was still short. Then @krakenfx’s big validator flipped from no to yes, Galaxy moved with it, and Mert kept calling until the votes landed In the end the vote passed with 67%, just 0.33% above the threshold! > The third proposal wanted to change fees so the network would burn a lot more SOL It failed after too many people sat it out or disagreed Solana now has clearer rules and a path to print less SOL, but the big daily burn is off the table This goes to show how the last few votes on a proposal can change the course of direction for the entire network

Avici, a Solana-based neobank got drained for over $1M last night @avici didn't write the code that failed. They built on Rain's infrastructure, and they got exploited What happened: > @raincards smart contracts were running an old version with a flaw in how they checked permissions > The attacker got the program to accept signatures it shouldn't have > Made themselves admin on people's collateral accounts, then withdrew their money > The attackers then bridged the funds from Solana to ETH and laundered them through Tornado Cash Rain has upgraded the contracts and halted activity. Avici has confirmed the issue, pledged full refunds, and reported it to the FBI The lesson isn't about Rain or Avici. It's that you inherit the security (flaws) of everything you build on

Getting the work done, anywhere, anytime Prepping the security audit pipeline for benchmarking 💥

After wrapping up day 2 of @CoinfestAsia in Bali, we’re still processing how different this one felt compared to most crypto events we’ve been to At the majority of conferences and festivals, the room is usually full of builders, developers, founders, and people already deep in the space This event felt different, many local Indonesian students and young people who came specifically to learn Not necessarily to network for jobs or raise money, not to flex their projects, just genuinely curious about crypto, asking basic to intermediate questions, taking notes, and wanting to understand how this whole thing actually works The hunger for knowledge was very real. It felt less like an industry meetup and more like watching the next wave of local crypto natives form in real time Indonesia’s adoption story is still in that pure education phase in a lot of places, and you could feel it at Coinfest Day 2 of Coinfest we spent at the @MeteoraAG x @bitget side event Great location at a private villa village with a little night market of food & drink stands and a nice environment to meet people We ended up having some genuinely interesting conversations with people from both the local and international side Met @Friday_SOL & @Efunderf from @SuperteamINDO to discuss how we can collaborate and help Indonesian builders ship secure code Bullish on Indonesia! 🇮🇩

Time for a little recap of what we have been doing at Proof of Exploit for the past weeks 👇 4 weeks ago we won the @islanddao hackathon with a fully automated Solana security auditing tool We could've just run with it. Instead we spent the last 4 weeks talking to founders, builders and @SuperteamTH What we heard changed everything. Founders didn't want just another automated auditing tool. They wanted a real human to confirm their code was safe to deploy. So we tore up the original plan and rebuilt it. Proof of Exploit is now THE security audit company for @solana projects. Here's the gap we're filling: Traditional firms charge a high amount most builders can't afford, to check known attack patterns AND deep edge cases. But most teams don't need the edge cases yet. Those matter once you have real TVL. Before that, it's the known attack patterns that drain projects. So that's what we check, at a fraction of the cost. Automation does the repetitive work. A security expert reviews every result and signs off on quality. You get proven vulnerabilities, the fixes, and a Proof of Exploit badge to show you take security seriously. We help every builder ship with confidence.

We had an amazing day at the @SuperteamTH coworking session today Superteam asked us to give a workshop on how to ship on @solana without getting hacked 💥 So we flew to Bangkok, gave the workshop & spoke to some amazing fellow builders and founders Great to see the interest we are getting from early stage founders to get audited by @proofofexploit Excited to keep the momentum going, improving our product and helping more builders ship securely! ⚒️