Complete Lifecycle Security For Onchain Systems. Leading teams choose Sherlock for private audits, AI-native review, bug bounties, and institutional security.
Joined February 2021
- Tweets7.2K
- Following1.9K
- Followers28.4K
- Likes9.2K
Congratulations to the @Onlend_ team on coming out of stealth!
To celebrate, we’re kicking off a public Sherlock Audit Engine engagement on November 23 to review their onchain lending infrastructure.
Public signups are coming soon.
Institutional-size trades. Private quotes. Atomic settlement.
@SwapMonster_ brings request-for-quote trading to Canton, using Daml contracts to exchange assets and payment in one transaction.
Sherlock has completed a collaborative audit of its RFQ exchange. ↓
Sherlock retweeted
And I thought the crypto was faring well in Black October.
Sherlock is dedicating significant resources to operational security for teams this year, including hiring @_AurelienDo, Sherlock's new CISO and Head of OpSec.
Code security losses have become a blip on the radar compared to operational security losses in Web3 this year. I'd like to think that's because Sherlock and others have done their job well in code security.
It's time for us to turn our attention to operational security.
We can't mandate that our audit customers use our operational security services, but going forward we will make it very easy for teams to protect their entire surface area with Sherlock, not just their onchain risks.
A $6.3B hack at the world’s largest crypto exchange is a wake-up call for every organization responsible for protecting funds onchain.
Early findings suggest a compromised engineer’s laptop gave an attacker access to systems used to submit withdrawals. Funds were taken across ten blockchains. The full root cause remains under investigation.
An exchange holding this much customer capital needs controls that contain an intrusion before it becomes billions in unauthorized transfers. Replacing losses afterward cannot substitute for preventing them.
Most of the $6.3B was stolen in roughly 20 minutes.
As more assets move onchain, these failures put more capital at risk. More integrations, providers and privileged accounts create more routes to secure. Attackers already target employees and wallet providers; larger potential payouts give them more incentive.
Teams need to know who can reach their signing infrastructure, what they can authorize, which controls remain independent during a compromise, and how quickly they can detect and stop an intrusion.
We’re putting more of Sherlock’s work into opsec: tracing how access to an organization can become access to its funds, and helping teams close those paths.
In order for the world’s financial system to run onchain, protecting its assets has to mean securing everything with the authority to move them.
A $6.3B hack at the world’s largest crypto exchange is a wake-up call for every organization responsible for protecting funds onchain.
Early findings suggest a compromised engineer’s laptop gave an attacker access to systems used to submit withdrawals. Funds were taken across ten blockchains. The full root cause remains under investigation.
An exchange holding this much customer capital needs controls that contain an intrusion before it becomes billions in unauthorized transfers. Replacing losses afterward cannot substitute for preventing them.
Most of the $6.3B was stolen in roughly 20 minutes.
As more assets move onchain, these failures put more capital at risk. More integrations, providers and privileged accounts create more routes to secure. Attackers already target employees and wallet providers; larger potential payouts give them more incentive.
Teams need to know who can reach their signing infrastructure, what they can authorize, which controls remain independent during a compromise, and how quickly they can detect and stop an intrusion.
We’re putting more of Sherlock’s work into opsec: tracing how access to an organization can become access to its funds, and helping teams close those paths.
In order for the world’s financial system to run onchain, protecting its assets has to mean securing everything with the authority to move them.
Sherlock retweeted
Changing tokenization on-chain on @solana and improving the state of the trenches takes fully custom & in-house novel code. Not many are willing to do that anymore due to high cost of integrations, auditing, and difficulty of building from scratch to get distribution
Way easier to just fork the same shit everyone else is running
To keep up and actually make the platform safer, you can’t just push code to prod after a quick AI checkup and pray it holds
More than ever we need proper quality audits, therefore I can fully recommend @sherlockdefi and it shows as this is already the second audit they’re handling for us
I am really excited about what’s coming next, can’t wait!
Thank you to @sherlockdefi for completing the smart contract audit for RISE V2
Launch details will be announced in the coming days
Sherlock has completed a collaborative audit of RISE V2 by @risedotrich.
V2 brings a reserve-backed rising floor and liquidation-free borrowing to token launches on @solana.
Rewards paid in USDC:
Critical: $50K–$500K
High: up to $50K
Medium: $1K–$10K
Low: up to $1K
Reports must include a coded PoC and run instructions demonstrating an exploit achievable in production.
Get started here: audits.sherlock.xyz/bug-boun…
Sherlock retweeted
Sunday reset 🌱
Tomorrow the market opens, and so do our upgraded vaults: audited by @sherlockdefi, open to everyone.
We've been building toward this one for weeks. See you Monday 🔔
PR changes define the scope. The full repository supplies context. Each model gets a compute budget sized to the code, and judging incorporates protocol assumptions and review history.
Plus curated model bundles with greater savings on deeper reviews and smaller scopes.
Read the full update: sherlock.xyz/post/audit-engi…
We’re excited to welcome @_AurelienDo as Sherlock’s new CISO!
He brings 10+ years of security leadership, most recently in DeFi and institutional finance at Morpho and Société Générale–Forge.
At Sherlock, he’ll lead and build our operational security and incident response services for protocols and financial institutions.
Scope: Kamino Liquidity, KLend, KFarms, KVault, Scope + official web apps.
Onchain findings need a reproducible local validator or LiteSVM PoC. No live exploit testing. KYC required for payment.
Read the full rules and submit through Sherlock.
→ audits.sherlock.xyz/bug-boun…
Sherlock retweeted
Sherlock is powering the onchain economy.
In 2026, our private audits have helped secure ~$24.6B in onchain TVL - from @babylonlabs_io Bitcoin vaults to @centrifuge tokenized assets and @MeteoraAG liquidity infrastructure.
More to come.
Sherlock is powering the onchain economy.
In 2026, our private audits have helped secure ~$24.6B in onchain TVL - from @babylonlabs_io Bitcoin vaults to @centrifuge tokenized assets and @MeteoraAG liquidity infrastructure.
More to come.