Our Open-Source project is now live! You can start using it to build and orchestrate your own AI-powered vulnerability research workflows. If you enjoy it, we'd really appreciate it if you: Give the repository a star on GitHub github.com/Kritt-ai/open-kri… Share it with your friends and fellow researchers Let us know what you think - we're actively improving it and would love your feedback. Join our Discord community: discord.gg/JJr2CbBjc

And here I am, having reported vulnerabilities throughout my career that could have resulted in a total of several billions (yes, with a B, > $2B) being *stolen*, while my total earnings are around $2M. So what's the lesson the industry is teaching researchers? That next time we should steal the funds first, then negotiate a "responsible disclosure," return 80–90%, and walk away with 10–20%? Obviously, no. But it's insane that the incentives can make that rhetorical question even possible. The bounty world is broken. Blackhats exploit a protocol and get treated like kings in negotiations. Meanwhile, whitehats disclose the exact same kind of vulnerability privately, prevent any damage from happening, and then spend months arguing with projects that try to downgrade the finding and pay the bare minimum. I'm fighting several cases like this right now. Millions of dollars protected, vulnerabilities responsibly disclosed, and yet projects still don't want to pay the amounts they themselves advertised. We should be making responsible disclosure the overwhelmingly obvious choice. Instead, the current state of Web3 is doing its absolute best to discourage whitehats while creating increasingly attractive incentives for blackhats and "grayhats". Those incentives are backwards, and eventually the ecosystem pays the price.

I read KiiChain’s postmortem and realized something pretty crazy. About 3 weeks ago, we privately reported a critical exploit chain to another Cosmos-based project that reached the same unsafe StateDB subtraction through a completely different path. Thankfully, they confirmed and fixed it really quickly. These weren’t the exact exploit chain, but they shared the same unsafe StateDB balance primitive: a native balance subtraction that could wrap around in `uint256`. Letting it underflow is an important primitive, but the subtraction alone isn’t enough to steal anything. Normally, the EVM checks that an account has enough balance before subtracting. To exploit this, you still need another state or accounting bug that breaks that assumption, and then a way to turn the broken balance into real money. So this does NOT mean every Cosmos EVM chain was exploitable. It depends on the implementation and how each chain keeps its Cosmos and EVM balances in sync. Sadly, we made a mistake: we didn’t go looking through every other chain that might have had the same primitive. I tried to understand why, and I think there are 2 main reasons: 1. We focus our research on targets that have bug bounty programs. We didn’t even know some of these other chains existed, and we weren’t aware of a bounty program for projects like KiiChain. Blackhats don’t have that restriction. 2. The underflow primitive on its own isn’t enough to steal funds. An affected project would also need a separate bug that makes the underflow reachable and exploitable. This made us wrongly assume the issue was specific to the project we were reviewing. I’m genuinely sad that we didn’t connect the dots before real users got hurt. But on the bright side, our report helped protect literally tens of millions of dollars (no exaggeration) on the chain we reviewed (though we haven't gotten paid for this one yet). I think this incident shows why bug bounty programs and responsible disclosure matter. It also shows why security updates need to be coordinated between upstream maintainers and the downstream projects using their code.

While hacks are ramping up in 2026, bounties are falling behind... Among 19 active Immunefi programs that changed their max payout, only 1 increased it. The other 18 cut it - some by a lot.

Make sure you're free on August 10 :)

Hell yeah!!!! 🎉🔥 This is exactly the vision we had for Open-Kritt: empowering creative researchers with better tools so they can find even more vulnerabilities. Seeing people use it to discover real issues is the best validation we could ask for. Keep crushing it!

Okay, that's seriously impressive. 🤯 Just 10 days after it's release, I think this officially marks the first confirmed Critical vulnerability found using Open-Kritt! @Kritt_AI Huge congratulations - amazing work!!

Love to see that!

Researchers are already finding valid vulnerabilities with Open-Kritt! Don’t sleep on it and miss out. Whether you’re just getting started or you’re an experienced bug bounty hunter, Open-Kritt can help you automate repetitive analysis, build custom AI workflows, and amplify your research. Build your edge. Create your own workflows. Find more bugs.

Fun bug :)

I've seen quite a few people disappointed that Open-Kritt @Kritt_AI currently only ships with two sample workflows and doesn't include our "secret sauce." I have two thoughts on that: 1. More workflows are coming. We're going to release additional workflows over time. If we published everything on day one, how will we keep you all engaged in the project? 2. We are not going to release all of our private workflows, and you shouldn't want us to. If your strategy is to rely on our workflows to find bug bounties, I think that's the wrong approach. The moment a workflow becomes public, everyone can run it against every target. Everyone finds the same vulnerabilities, and it becomes a race to report first. Statistically, that's not a race you're likely to win. And after the obvious findings are gone, that workflow stops producing interesting results. That's true for every public security tool. To me, a good security tool isn't one that magically prints bounties. It's one that amplifies your knowledge, your creativity, and your edge. That's what we built Open-Kritt for. Don't think of it as "our workflows." Think of it as a toolbox for building your own workflows - ones that reflect how you think, the techniques you believe in, and the advantages you have over everyone else. There is no magic workflow that consistently finds great bugs. The edge has always been the researcher - and Open-Kritt is meant to make that researcher more powerful.

In retrospect, the most important shift in Web3 security maybe what happened on Immunefi in the first half of 2026. In April, a security researcher used an AI agent to help uncover a $100,000 critical vulnerability in production. In June, a team won a $500,000 audit competition and earned $78,150 using a security research workflow built around AI. And behind those headline results are hundreds of reports submitted by security researchers using AI workflows and help protocols prevent millions of dollars in losses. The best teams on Immunefi are building AI into their process to expand what skilled researchers can do. Security research is beginning to split into two eras: before AI and after. This week, one of the best creators of AI-assisted security workflows is joining The Immunefi Show to share how they use AI to find real vulnerabilities. Guess who?

More bookmarks than likes 👀 If you’re trying to reproduce this workflow, don’t sweat it. We’re releasing it in our open-source, together with a few others.

Something we respect about @_blockian is they do not talk much. They just keep showing up on the payouts list. This is their third big payout in a matter of weeks. Well deserved!

Waiting to try Open-Kritt? Here’s your chance! Join the beta testing 🙌🏼

Small correction 😅 Looks like I wasn’t 100% clear. open·kritt isn’t available just yet! We’re putting the finishing touches on it and fixing the last few bugs before release. (Should be in a couple of days) In the meantime, you can join the waitlist by leaving your email and we’ll notify you as soon as it’s live.

Kritt is coming by @_blockian @ControlZ_1337

Here it comes @Kritt_AI