Just reached rank 30 on @immunefi all-time! This also marks the halfway point on the road to $1 Million! ▓▓▓▓▓░░░░░ $527k / $1M

And here I am, having reported vulnerabilities throughout my career that could have resulted in a total of several billions (yes, with a B, > $2B) being *stolen*, while my total earnings are around $2M. So what's the lesson the industry is teaching researchers? That next time we should steal the funds first, then negotiate a "responsible disclosure," return 80–90%, and walk away with 10–20%? Obviously, no. But it's insane that the incentives can make that rhetorical question even possible. The bounty world is broken. Blackhats exploit a protocol and get treated like kings in negotiations. Meanwhile, whitehats disclose the exact same kind of vulnerability privately, prevent any damage from happening, and then spend months arguing with projects that try to downgrade the finding and pay the bare minimum. I'm fighting several cases like this right now. Millions of dollars protected, vulnerabilities responsibly disclosed, and yet projects still don't want to pay the amounts they themselves advertised. We should be making responsible disclosure the overwhelmingly obvious choice. Instead, the current state of Web3 is doing its absolute best to discourage whitehats while creating increasingly attractive incentives for blackhats and "grayhats". Those incentives are backwards, and eventually the ecosystem pays the price.

I read KiiChain’s postmortem and realized something pretty crazy. About 3 weeks ago, we privately reported a critical exploit chain to another Cosmos-based project that reached the same unsafe StateDB subtraction through a completely different path. Thankfully, they confirmed and fixed it really quickly. These weren’t the exact exploit chain, but they shared the same unsafe StateDB balance primitive: a native balance subtraction that could wrap around in `uint256`. Letting it underflow is an important primitive, but the subtraction alone isn’t enough to steal anything. Normally, the EVM checks that an account has enough balance before subtracting. To exploit this, you still need another state or accounting bug that breaks that assumption, and then a way to turn the broken balance into real money. So this does NOT mean every Cosmos EVM chain was exploitable. It depends on the implementation and how each chain keeps its Cosmos and EVM balances in sync. Sadly, we made a mistake: we didn’t go looking through every other chain that might have had the same primitive. I tried to understand why, and I think there are 2 main reasons: 1. We focus our research on targets that have bug bounty programs. We didn’t even know some of these other chains existed, and we weren’t aware of a bounty program for projects like KiiChain. Blackhats don’t have that restriction. 2. The underflow primitive on its own isn’t enough to steal funds. An affected project would also need a separate bug that makes the underflow reachable and exploitable. This made us wrongly assume the issue was specific to the project we were reviewing. I’m genuinely sad that we didn’t connect the dots before real users got hurt. But on the bright side, our report helped protect literally tens of millions of dollars (no exaggeration) on the chain we reviewed (though we haven't gotten paid for this one yet). I think this incident shows why bug bounty programs and responsible disclosure matter. It also shows why security updates need to be coordinated between upstream maintainers and the downstream projects using their code.

$30,000 in bounty rewards goes to @_blockian! One more achievement, and certainly not the last. Well deserved. Congratulations from HackenProof! 🏆

Our open-source project is out! Go check it out 🥳

Confession time: @ControlZ_1337 didn't manually review a single line of code in this competition. Everything was done through custom AI workflows that we built and orchestrated using our own platform: open·kritt. And as the name suggests, we're open sourcing it. @Kritt_AI We're planning to release it this week (hopefully), so if you don't want to miss it, go follow @Kritt_AI for updates. Our hope is that open·kritt helps more researchers build powerful AI-assisted security workflows and ultimately makes the Web3 ecosystem more secure :)

I think this might be the largest bounty so far for an AI-assisted finding. And yes, confession time: I used the AI tools I’ve been working on over the past few months to help find this bug. I’d love to say it was all me, but that wouldn’t be honest. The world is changing, and AI is clearly becoming a big part of it.

I think this might be the largest bounty so far for an AI-assisted finding. And yes, confession time: I (@ControlZ_1337) used the AI tools I’ve been working on over the past few months to help find this bug. I’d love to say it was all me, but that wouldn’t be honest. The world is changing, and AI is clearly becoming a big part of it.

How did I do on my 2025 New Year’s resolutions? ❌ $1M in revenue -> Failed Total revenue this year across all platforms + audits: $907K ❌ $1M in a single bounty -> Failed Biggest single bounty: $250K on Immunefi ✅ Top #30 on @immunefi -> Success Reached rank #22 just yesterday ✅ Full planche -> Success Can hold a full planche for ~4 seconds Some accomplishments that weren’t on my original list: ✅ Top #10 on @HackenProof At the start of the year I’d never even tried HackenProof, but after @WhiteHatMage went on a journey to other realms, I decided to give it a shot. Had a lot of fun and reached #7 all-time. ✅ Snowboarded for 4 months Took a much-needed break at the start of 2025 to snowboard. Best trip of my life. ✅ Had fun Beat Silksong, E33, and generally learned to slow down a bit. This year taught me that taking breaks and enjoying life actually matters. So while I technically failed most of my 2025 resolutions, it was still a great year overall. Here’s hoping 2026 will be just as good - and that I’ll do a better job sticking to my resolutions this time 😄

Ok, here are the statistics for confirmed and paid findings from the past ~2 months, assisted by the AI tools I’ve been working on: @immunefi : 2 Criticals 1 High 1 Low (marked as Critical but should be downgraded due to default configuration restraints) @HackenProof : 1 High @Hacker0x01: 1 High Private Bug Bounties: 2 Critical 1 Low Total payouts are expected to be roughly ~$400K. Payouts tend to move slowly, so more of the results should become public over time.

🧙‍♂️Wise sage @_blockian once sad: 🧠 DEBUG 📜 "Don’t underestimate the importance of a working debug setup"👇 web3-sec.gitbook.io/art-of-a…

Assume you find a High/Critical vuln in a library forked by many projects. The bug exists in their code right now, and can be exploited against them. Who should pay the bounty?

I think it’s fair to say me and @Schnilch share the first place, only $800 difference, now that’s a close one! Great job my friend! And thanks to @HackenProof and @Somnia_Network

Nicely done @ControlZ_1337

Ok, I think I’ve got it done. Rank 7 @HackenProof all time leaderboard 🤘🏻

Noice

Sounds like @immunefi is cooking

Damn, I thought it would be enough to pass @WhiteHatMage on the @HackenProof leaderboard Oh well, guess I'll keep going

Ok, just wrapped up @expedition33 by @SandfallGames (yes, including Simon), and here’s where I’m at: 1. Easily the best game I’ve played in a while - my heart is broken. 2. Esquie is my spirit animal. 3. Y’all had your chance to find bugs. Now that I’m back, it’s over and I’m about to cook. I’m feeling Wheee

Whoa - we just hit 1K followers! Does this make us official influencers now? In an unrelated subject - SR bath water is up for sale. Let’s go.

🌟 This June, HackenProof paid out $402,800 to ethical hackers! 💰Top payout: $100,000 to @_blockian for an epic find! Join our community of cybersecurity heroes and unlock massive rewards by securing the digital world!