The audit model is broken and everyone knows it. You once paid $200k. You wait 8 weeks. You get a PDF. Then your protocol evolves and the audit is already stale. That's not security. That's a snapshot. We started @Fidesiumapp because security should be continuous, not ceremonial. Human auditors catch what machines miss. Automated and AI tools catch what humans can't scale to review. Neither alone is enough. The future isn't audit OR automation. It's both, working together.

I have been thinking a lot about life and cyber security. I was reminded about a quote that I think really sums it up: The curse of discipline is that every day looks the same. The curse of indiscipline is that ever year looks the same. The discipline needed in web 3 security to check the same things over and over, always looking for new vectors of attacks, all so your days look the same. The reward is that the years don't. Endless stories of hacks, opsec failures and thefts. Stay strong fam.

What a great article by @eightbitsim

The £100k tax trap disincentivises working harder. And according to HMRC, one in five businesses close to £90,000 in revenue admit trying to work less as it becomes less worth it once you hit the VAT threshold.

Reduculous @GWRHelp this is your quite car tonight. How can you oversell tickets so bad that this is the state of things. Still packing in.

Bitget, Ledger, Near, Base. Hang in there, it gets worse.

Make Cypto safe

I really don't understand trying to save a couple bucks or a bit faster delivery when purchasing a device to store WEALTH. Also the name @cryptobilis , come on people. #SomePeoplesKids Also of note here, this happened after a management buyout. A management buyout tied to a NDA so strong not even Ledger was notified of the sale.

Fidesium's 7 conference OPSEC rules. Let's not make it easy for them. 1. Don't hand over your unlocked phone. Type the number. Yes it is a pain. Do it yourself anyway. 2. Treat conference Wi-Fi as hostile, if it is sensitive use your cellular data. 3. Do I really need to say this? Don’t plug unknown USB devices into your phone/laptop. 4. Only scan QR codes when you know the source, ie TG / Linkedin. 5. Verify contract addresses and domains independently. 6. Be extremely cautious of “exclusive airdrop,” “investor allocation,” “speaker claim,” and “conference reward” links. 7. Post conference - Review important account login/session activity. Most attacks don’t require zero-days. They require you to be distracted. Stay safe fam.

So I think we have all seen the Uber play enough to understand that Anthropic is offering a heavily subsidised product in hopes that later efficiencies and a bit of price gouging will eventually lead to massive profits for their investors. But... the math isn't mathing for me. With the quality of the smaller free models now being nearly on par, I just don't see it. It is mathematically impossible to get AGI out of an LLM, so what's the play?

Brilliant article by @Certora A clean result from any one method does not mean the protocol is secure overall. Audits asks: “Can an expert find something wrong?” Testing asks: “Does it break under the cases we've tried?” Formal verification asks: “Can we mathematically prove that this specific property cannot break, subject to the stated assumptions?” So the important distinction for projects looking for security or a consumer looking at a protocol is not on “audited” or “verified,” but exactly what was/will be examined.

Incident response checklist, ready before you need it: 1⃣ Named on-call rotation 2⃣ Pre-drafted user comms template 3⃣ Tested pause/circuit-breaker process 4⃣ Direct contacts: auditors, legal, exchange partners 5⃣ Clear decision-maker for "do we pause" Improvised during an incident = mistakes compound.

GM GM thanks @DeanDev10 for the circle map.

Very excited for Breakpoint. Here is a little fun with team @SuperteamUK on the hotest day ove the year. Think I will stick to cyber security though :-D

The report isn't the finish line. We walk every finding through with your team live, then review every fix before calling anything resolved. A fix that introduces a new bug while closing the old one happens more than people expect. Then it is time to look at pen testing and compliance :-D

Single-chain logic bugs are down as a share of major DeFi losses. Cross-chain bridge and messaging failures are up. Your attack surface isn't just your contracts anymore, it's every system your contracts trust. That deserves its own threat model.

Single-chain logic bugs are down as a share of major DeFi losses. Cross-chain bridge and messaging failures are up. Your attack surface isn't just your contracts anymore, it's every system your contracts trust. Everything deserves its own threat model.

Verification post for ETH security badge. 0x3638cE012161156Be382Ba8D1e9712364c6818a8

Oracle manipulation in one line: Read price from one on-chain source, in one block → someone flash-loans enough capital to move that price → drains value → reverts before the block ends. No capital held, just borrowed for a moment. Fix: TWAPs, multiple sources, a real oracle network.

The most common hacks this year aren't reentrancy or oracle manipulation. They’re related to access control:a missing modifier, a function that should be admin-only and isn't, an initializer that can be called twice. Unglamorous. Catastrophic. Difficult to see from the inside.