
Blockchain Security Engineer @HalbornSecurity (prev @trailofbits) Technical Advisor @GuildAcademy_ Views are mine (obviously!)
Earth 🌎
Joined May 2014
- Tweets173
- Following275
- Followers148
- Likes364
Damilola Edwards retweeted
A good reminder that keeping your code closed-source for security purpose is a bad strategy
If you distribute a binary, treat it as if attackers have the source code
1/ As someone who have worked on reverse engineering for 10+ years, I've never seen this much excitement around it. Great work, @morluto and @reatools!
Since RE is having such a moment 🔥, I figured I'd share some updates from sre-bench.lol/ to help you pick the right model.
Damilola Edwards retweeted
Replying to @Babajiide
They never listened to me re Unbanked. That and "mobile money".
Blame GSMA and Gates Foundation.
Everyone in Nigeria is Underbanked. Even Aliko.
Pause to think about it and it dawns on you that Banks in Nigeria do not do the business of Banking.
Damilola Edwards retweeted
Personal update: I am joining @aave
Over the past few months, I have had the chance to work closely with their engineering team. I have been impressed by how they approach security and by their attention to quality
I am excited to continue helping them secure the future of DeFi
Damilola Edwards retweeted
Unfortunately, I was impacted by today’s layoff by Coinbase.
During my time at @coinbase as a blockchain security engineer, I had the opportunity to work on the smart contracts of multiple high impact projects including:
- The Base Solana bridge.
- The x402 protocol.
- The upcoming Base Azul upgrade .
- Multiple Ecosystem reviews for builders on Base.
- An AI-powered smart contract auditing tool being used internally.
And many other internal projects within @base and @coinbase.
Many thanks to @jessepollak and @sha2nk_ for the opportunity to secure important contracts in crypto and further improve my skills among a high achievers.
This layoff came sudden and unexpected, and I will be looking for my next opportunity as a Blockchain Security Engineer or Smart Contract Engineer.
I’ll also be back to auditing contests and private audits which I haven’t done in a while.
This is an email I sent earlier today to all employees at Coinbase:
Team,
Today I’ve made the difficult decision to reduce the size of Coinbase by ~14%. I want to walk you through why we're doing this now, what it means for those affected, and how this positions us for the future.
Why now
Two forces are converging at the same time. We need to be front footed to respond to both.
First, the market. Coinbase is well-capitalized, has diversified revenue streams, and is well-positioned to weather any storm. Crypto is also on the verge of the next wave of adoption, with stablecoins, prediction markets, tokenization, and more taking off. However, our business is still volatile from quarter to quarter. While we've managed through that cyclicality many times before and come out stronger on the other side, we’re currently in a down market and need to adjust our cost structure now so that we emerge from this period leaner, faster, and more efficient for our next phase of growth.
Second, AI is changing how we work. Over the past year, I’ve watched engineers use AI to ship in days what used to take a team weeks. Non-technical teams are now shipping production code and many of our workflows are being automated. The pace of what's possible with a small, focused team has changed dramatically, and it's accelerating every day.
All of this has led us to an inflection point, not just for Coinbase, but for every company. The biggest risk now is not taking action. We are adjusting early and deliberately to rebuild Coinbase to be lean, fast, and AI-native. We need to return to the speed and focus of our startup founding, with AI at our core.
What this means
To get there, we are not just reducing headcount and cutting costs, we’re fundamentally changing how we operate: rebuilding Coinbase as an intelligence, with humans around the edge aligning it. What does this mean in practice?
- Fewer layers, faster decisions: We are flattening our org structure to 5 layers max below CEO/COO. Layers slow things down and create coordination tax. The future is small, high context teams that can move quickly. Leaders will own much more, with as many as 15+ direct reports. Fewer layers also means a leaner cost structure that is built to perform through all market cycles.
- No pure managers: Every leader at Coinbase must also be a strong and active individual contributor. Managers should be like player-coaches, getting their hands dirty alongside their teams.
- AI-native pods: We’ll be concentrating around AI-native talent who can manage fleets of agents to drive outsized impact. We’ll also be experimenting with reduced pod sizes, including “one person teams” with engineers, designers, and product managers all in one role.
In short: AI is bringing a profound shift in how companies operate, and we’re reshaping Coinbase to lead in this new era. This is a new way of working, and we need to leverage AI across every facet of our jobs.
To those who are affected
I know there are real people behind these decisions — talented colleagues who have poured themselves into this company and our mission. To those of you who will be leaving: thank you. You’ve helped build Coinbase into what it is today, and I am sincerely grateful for everything you've done.
All impacted team members will receive an email to their personal account in the next hour with more information, and an invitation to meet with an HRBP and a senior leader in your organization. Coinbase system access has been removed today. I know this feels sudden and harsh, but it is the only responsible choice given our duty to protect customer information.
To those affected, we will be providing a comprehensive package to support you through this transition. US employees will receive a minimum of 16 weeks base pay (plus 2 weeks per year worked), their next equity vest, and 6 months of COBRA. Employees on a work visa will get extra transition support. Those outside of the US will receive similar support, based on local factors and subject to any consultation requirements.
Coinbase prides itself on talent density. Our employees are among the most talented people in the world, and I have no doubt that your skills and experience will be highly sought after as you pursue your next chapters.
How we move forward
To the team that is staying, I know this is a difficult day. We’re saying goodbye to colleagues and friends you've been in the trenches with. But here’s what I want you to know as we move forward together:
Over the past 13 years, we have weathered four crypto winters, gone public, and built the most trusted platform in our industry. We’ve made it this far by making hard decisions and by always staying focused on our mission. This time will be no different – nothing has changed about the long term outlook of our company or industry. And most importantly, our mission has never been more important for the world. Increasing economic freedom requires a new financial system, and we’re building it.
The Coinbase that emerges from this will be more capable than ever to achieve our mission.
Brian
Damilola Edwards retweeted
These days, in almost all my discussions I get asked what I think about AI and the future of security, so I figured I should share it here
Short version: I try not to have a strong opinion yet. We are clearly in a transition phase, and outside of people working directly on foundation models, no one really has a solid view of where this is going
Over the past months, LLMs improved a lot. The releases at the end of 2025 were a real step change. In practice, most people I know (myself included) have barely written code in the past 2-3 months. For security, we went from "this is fun" to "this is actually useful"
Right now, the best mental model I have is that we effectively jumped from having no tooling to having an advanced static analyzer or fuzzer. A lot of bugs that used to take time to find can now be surfaced quickly
Does that mean security researchers disappear in 2 years? Based on today’s tech, I do not think so. There are a lot of bugs to be found. Some are found by humans, some by traditional techniques, and now some by LLMs. But it does not mean all bugs get found. If anything, history suggests there are always more bugs than anyone expects, and that gap does not go away easily
The real question is: do LLMs get another capability jump, or just steady iteration? There are reasonable arguments both ways. To be honest, I do not have enough understanding of how these models evolve to have a confident answer. And anyone giving a very definite answer is probably overconfident, unless they are working directly on the models
Depending on that, the role of security researchers could change a lot, including the way we work. The demand could decrease if models get very strong at finding bugs. But it could also increase if the amount of code grows faster than the models’ ability to reason about it. We could even end up with a shortage of experienced researchers in a few years if fewer juniors enter the field while seniors move elsewhere. It is hard to predict because everything depends on how model capabilities evolve
On the business side, I am skeptical about "AI audit as a service". If models keep improving, it is hard to see how these companies compete with native offerings from OpenAI or Anthropic. Especially if those providers stop exposing raw capabilities and push everyone into their own products. I tried codex security, and while it is not perfect, it is clear where this is going. Mythos / Capybara seem to be around the corner, and it will be interesting to see how far it goes
My current bet is that within a few months, tools like codex or claude security will be great at finding blockchain issues, and they will integrate directly into most dev pipelines. At that point, the marginal value of an extra "AI audit SaaS" becomes limited
So what to do as a security researcher? Be adaptive. This is a transition period, and things will likely move fast in 2026. Stay curious, and keep working on skills that give you an edge. Regularly reassess where you are strong or weak, and where AI helps you versus where it replaces you. If you like challenges, see AI as one that pushes you to improve
Also, be careful with what people call "cognitive debt" or "brain rot". I was skeptical at first, but I do see it now. The more I rely on LLMs during an audit, the more I lose part of the intuition that I normally build while going deep into code. That intuition is still critical to find complex bugs. I have not found the right balance yet, but it is something to watch
It probably makes sense to revisit your view on LLMs every 3-6 months. I have already been wrong a few times on this, and I am fine with that, as long as I don’t get locked into a fixed view
Finally, a lot of people focus on the downside for security researchers. But there are also upsides. I can explore codebases much faster, build custom tooling easily, and spend less time on boring tasks. Maybe it’s my last few years/months as a security researcher, maybe not. But at least LLMs let me have some fun before doomsday 😅
Damilola Edwards retweeted
Believing Claude finds your questions insightful is like believing the stripper actually likes you
Tried @suno out of curiosity, no music background, just clicking things, and this happened. AI really is the future and the future is already here lol.
Damilola Edwards retweeted
Agriculture not tech would build mass wealth in 🇳🇬 in this decade. 🇳🇬 richest men figured it out early
Damilola Edwards retweeted
What is the key difference between a contest auditor and a private/firm auditor?
In one word: Responsibility
I was a contest auditor for about 2 years and it's a stressful occupation since you have so little certainty and you're constantly arguing on the validity of your findings.
But at the same time, you are not concerned about the overall security of the protocol. You did your job, you found the bugs and hopefully got well rewarded. Is the protocol safe to go live? Hopefully yes, but in all honesty, that's someone else's problem.
This gets turned around completely for private/firm audits. You have a certainty of income and discussions are almost always constructive and positive.
But you bear a heavy responsibility. The protocol came to you and confided their code to you with a burning question:
- Is my code safe?
- Can we deploy?
- Will our dreams get destroyed by a hack if we do?
For all the tiny disclaimers stating we can't guarantee anything, in essence, your mission is to ensure that the code is safe and that they can deploy. But even with the best of efforts, you can never be sure.
About three weeks ago one of our clients went live, a major player on Solana for whom I lead three audits over two months to make sure their launch would go smoothly.
I can tell you, there are very few times in my life where I less stressed.
- Did I miss something?
- Did we think about everything?
- What if they get hacked? Please don't get hacked.
- Watching the Telegram channel, thinking "no news is good news".
- Thankfully everything went well in the end 🙂
So if you're aiming to become a private/firm auditor, I can tell you it is a wonderful occupation. But it does come with a heavy burden of responsibility.
Damilola Edwards retweeted
Combining fuzzing with symbolic execution for smart contracts has never been this easy: gustavo-grieco.github.io/blo…
When I said that some of the best security researchers are not on Twitter, Gustavo (the post's author) is a perfect example
Damilola Edwards retweeted
Massive kudos to @eddiedammy for delivering two power-packed technical sessions last Thursday & Friday evening @GuildAcademy_ 🚀
The students left with answers to every question and a wealth of new knowledge.
Truly an impactful experience — you nailed it, @eddiedammy 🙌
Oil palm farmers, I am currently selling part of our 50,000 oil palm sprouted seeds stock (Tenera hybrid), purchased fron NIFOR and still at their custody, going at a sweet giveaway discounted price, if interested, my dm is open.
Damilola Edwards retweeted
Might be a hot take but “More audits, contests, or bigger bounties” is not always the best advice
What protocols often need the most is internal security
A 7-figure bounty w/o in-house expertise is inefficient. External help is great, but you can’t outsource all your security

















