@immunefi All Stars | A carefree cyber sailor. Solves security challenges. Secures protocols.
Multiverse
Joined May 2022
- Tweets5.4K
- Following597
- Followers2.4K
- Likes21.5K
we missed you man, welcome back!
only OGs know who is this legend 🔥
After years of devoting my time to supporting ethical hackers...
I'm now on the journey to becoming one myself.
Hi. I'm known as PappaPug or Oddly in security circles.
You may have seen my profile in the past replying to support requests and hyping up whitehats...
It was my job for years to meet and speak with the best onchain hackers. Many friendships were nurtured during that time.
That path diverged since Dec 2025, and now I'm a free agent, getting back into web3 with two main goals:
1. To hunt, to seek, to provide services and feed my family with the skills and resources I have.
2. To question everything about how things work and understand what's under the carpet in the machinery of code and contracts, so that no one gets hoodwinked by fancy marketing.
Having been a marketer myself, I can smell it from miles away. I'm letting my intellectual curiosity and bubbly personality get carried away on this journey to becoming a world expert on smart contracts and decentralized finance.
See you at the finish line.
Love, PappaPug
Telling me I’m stupid and that I wasted months of my time, only for me to find out you made the whole thing up just to win the argument, is a brilliant move Mr. GPT.
Current contests force you to use AI tools instead of manual auditing . If you check the latest contest you’ll understand why I say this.
Stay safe
#trezor
Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.
We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.
0K retweeted
If you want to submit a strong report, make sure to use Studio Reviews.
Studio Reviews now checks your report for:
• Code behaves as reported
• Attack achieves impact
• Impact mapping
• PoC demonstrates impact
Don't guess why your bug submission might be weak. Test it.
@immunefi Studio review now scores four parts of your claim and surfaces graded submission gaps for you to improve.
Have you tried it yet?
Is this considered whitehat, greyhat, or the bad one?
Blockstream’s Liquid Network (@Liquid_BTC) reportedly hacked by whitehats for 4k bitcoins.
8db751a650ae2f12006b7e8c69a75e4df360e8afd6b9e05ae0b9fa6458a7b140
Hacker message: "we are whitehats. contact us on chain"
c103de95817b43f2df635ec6f35ff126ca26a7c6d20570c4b01866b2b3e69a19
More skilled → should succeed sooner.
The world doesn’t support this equation. Success is complex, and many factors play a role in it.
That’s why whenever someone asks whether i use AI i tell them i don’t use it until i’ve understood the codebase in depth first. relying on AI too early just makes me feel dumb
Many people will disagree with me and might think I’m behind current SRs, but I genuinely prioritize growing my own skills and continue hunting and learning rather than relying on AI to do hunting for me. I will use AI (mostly @Kritt_AI), but only for codebases that I understand deeply.
Bug hunting requires discipline and a willingness to sacrifice your time for an adventure with no guaranteed outcome. You’re searching for something that shouldn’t exist yet, it does EXIST.
I can honestly say I’ve only been doing bug bounty the right way for the past two months only. During that time, I’ve spent countless hours studying, learning, and writing down every valuable insight I could gather from top hunters.
It’s a journey filled with enjoyment, wealth, and sacrifice. If you want to become truly good at it, you have to eliminate most of the distractions around you, then and only then you can dedicate at 80% of your focus to hunting (80% is enough to catch good vulns) .
Distractions are a topic for another day, but I just wanted to share what has been on my mind lately.
0K retweeted
Im not a business guy but it’s hard for me to understand why people that just got 2.5M bounty using AI (assuming it’s true) and think they found the secret sauce to find all bugs would need to raise more money and dilute their equity.
Why not just keep getting more bounties to fund development?
We all know that whitehats with strong skills and use AI effectively are among the most valuable researchers these days. But what if you don’t use AI? Does that mean you’re no longer considered a valuable whitehat, or that Web3 firms won’t recognize your skills?
If that’s the case, then how would you describe the researchers who consistently found critical vulnerabilities and earned millions before AI became a thing?