Security Researcher | Software Engineer | Founder @ Ark Systems | Member @SuperteamBLKN @ZenDAO
On The Blockchain
Joined April 2010
- Tweets332
- Following289
- Followers74
- Likes915
this is one of the main issues with our industry. expecting a random person who has basiclly never used crypto to have all of this figured out, together with seed phrases, multi wallets, private keys, bridging the same currency across chains, not getting rugged on some random ass bundled up pump fun token that is on the front page of phantom wallet, is frikin mad.
we should do better, @Ledger in this particular case.
or just tell "the retail" to keep using western union to send money across.
Karlo Hubak 🏖️ 💻 retweeted
🚨We now have a live website for new guests that would like to come on the podcast! 🚨
You can self-submit and I will review all submissions personally. The idea is to build a queue of potential guests so that I can put out more episodes on a consistent basis going forward.
Check it out here: bountyhunt3rz.fm/
Thank you to the champion @khubak for putting this whole thing together
Claude 5.5 max ultracode totally lost its capability to determine what he should spend 6 hours on and when not to do that.. now its 3 hours minimum for _everything_
Karlo Hubak 🏖️ 💻 retweeted
Basically no one in my life other than people who were already coding are using LLMs to code. Some minor exceptions but they were already engineering adjacent or highly interested in app development already. Classic thing where software people think everyone sees the world they do. Grow up and get back to work.
dino for grabs, only up from here
24 hours left to bring Deaton, the first ever tokenized dinosaur, to @Solana
Own a piece of history: app.jurassic.finance
actually crazy this is happening.
The European Parliament voted AGAINST Chat Control. 314 to 276.
And it passed anyway.
Let me tell you how: they needed 361 votes to say no. On the last day before vacation. Every empty seat counted as a yes.
They lost the vote. They won the law.
That’s not democracy. That’s a trick. #ChatControl
was a fun one. big thanks to the whole crew that made this. I've especially liked READMEs tieing each chapter to the official rust book. guess it's time to catch up on @rektoff_xyz web3 sec bootcamp.
prompt your agent to parse your git history for secrets while you take lunch, rotate them if he finds any. its that simple.
we are all concerned with the token economics favouring the blackhats - while a simple git scraper enabled a 1.7M hack today. Commit pushed to github in '24 btw. How do we recommend dApps to our friends and family with such things happening?
🚨Taiko drained for ~$1.7M. Root cause: a private key committed to a public GitHub repo.
enclave-key.pem, the RSA key used to sign all of Taiko's SGX enclaves, sat in the public taikoxyz/raiko repo. That key is the whole trust model.
The attacker derived MrSigner from the public key, signed their own malicious enclave with the leaked key, and registered as a trusted prover. The L1 contracts trust any enclave whose MrSigner matches. It matched.
From there: forged SGX attestations on fake L2 blocks, processMessage() sets the message to RETRIABLE, retryMessage() does zero proof verification, funds leave.
No key theft. No social engineering. No SGX exploit. Just a .pem in a public repo.
Good opportunity to recall that SGX is broken. But here, nobody even had to break it.
It's just yet another key management failure. The whole system was only ever as strong as the secrecy of one RSA key, and that secrecy depended on a human not running git add . on the wrong folder. AI greps every commit of every public repo at machine speed. Assume that is already happening.
The only real exit: a verifier that checks a succinct validity proof of the L2 state transition. It trusts no enclave, no MrSigner, no operator discipline. It checks the math. In that world this exact attack becomes cryptographically impossible rather than operationally unlikely, because there is no privileged key whose leak forges the entire system. There is just a proof.
Stay safe.
