Honored to testify to Homeland Security and joint session on AI, Quantum and Cybersecurity. Full info below

Everyone is coming to Solana. 𝕏 integrated Solana. XRP expanded to Solana. Visa is settling on Solana. Mastercard supports Solana. Chiliz expanded to Solana. Bitget integrated Solana Pay. Stripe supports payments on Solana. PayPal launched PYUSD on Solana. Cash App supports USDC on Solana. Coinbase integrated Solana DEX trading. BlackRock brought BUIDL to Solana. J.P. Morgan has used Solana for tokenized commercial paper. Franklin Templeton brought BENJI to Solana. Ondo brought 200+ tokenized stocks & ETFs to Solana. Western Union launched USDPT on Solana. MoneyGram integrated Solana. VanEck brought VBILL to Solana. What's next?👀

I really don't think people are understanding the @HacktronAI HEIF Heist moment properly. Before AI, what class of attacker do you think would be capable of discovering a silently fixed upstream image parser vulnerability w/o a CVE assigned nor patched in distro packages, exploiting against modern Linux w/ ASLR, and then using it to pop top-tier tech companies w/o them noticing? I have *never* seen bug bounty researchers land something like that. Have you?

Lily Hansen-Gillis of @tetradigitalgrp on why they brought Canada's first regulated stablecoin to Solana. "We didn't pick Solana for speed. It's not just a network for retail. It's a network we can take to a large institution considering onchain rails for how they manage their finances. If they want to settle in CADD, Solana is a very viable option."

Rachel Conlan, Chief Strategy Officer at the Solana Foundation, on the token supercycle. "As I look at Solana, not just the developers but the broad range of projects, and the centerpiece it occupies in the ecosystem, it's at that juncture of being part of the next stage: the total reimagination and rebuilding of financial infrastructure. We're now in the stage of becoming part of the technology layer of the future of finance." @RachelConlan @FINTECHTVglobal @RemyBlaireNews

Private researcher reported a security vulnerability to Chromium on August 4. The fix went into the public source code but Chrome users never got it due to patching timelines. Two Chinese groups, apparently read that public fix, built an exploit chain from it and started phishing NGOs on September 1 using identical code. Technically an N-day but for anyone actually running Chrome, a zero-day. Here the public patch knowledge worked as an instruction manual. Open source means everyone can read the fix. With AI, some people just operationalise the knowledge faster. volexity.com/blog/2026/09/09…

Frontier Traders Season 1 is live. $1M+ in rewards. 8 weeks of trading. Eight finalists. One World Champion, crowned live in London this November. frontiertraders.com/seasons/…

While hands in front of face may catch some deepfakes, there’s a more important lesson here. Don’t clone and run untrusted code on your machine. Ever. Use ephemeral dev boxes/VMs.

I’ve joined @SolanaFndn as Chief Strategy Officer. What excites me is Solana’s position to bring Internet Capital Markets to life: connecting assets, trading and payments on one global network, open to anyone, around the clock. You can already see it happening: $200M in tokenised equities traded in a single day, with roughly 63% outside US market hours. My focus is helping drive the next phase of growth, bringing more institutions, enterprises, builders and users into that opportunity. Thank you to @calilyliu and the team for the warm welcome. Excited to get going. 💜 coindesk.com/business/2026/0…

The @SolanaFndn just open-sourced Microscope, a free monitoring & alerting tool for Solana programs. We've tested it out. Its skills map alerts to our STRIDE security framework so the responding team has context to start from during an incident. github.com/solana-foundation…

Letters of marque and reprisal might be our best chance against cybercrime. I spoke with security and legal experts, plus former DOJ and military for this @LawofCodeFM episode on cyber letters of marque. Featuring @ARedbord of TRM, @perkinscr97 of Franklin Crypto, @_mwc of Solana Foundation, @NelsonMRosario of Rosario Tech Law, and Camelia Lopez Shoemaker of Holland & Knight. This covers the role of these letters in the American Revolution, privateers, prize courts and a White House memo that trends toward implementing a modern version for cyberspace. Timestamps: 0:00 The $200 billion problem 2:16 The Model T and the FBI 4:18 Pig butchering 7:03 History 7:50 The high seas and the internet 8:30 Marque vs. reprisal 11:35 American Revolution 14:08 Building a (private) navy 17:25 The Constitution 18:40 The Paris Declaration 20:34 Pirates or privateers? 22:12 The five-part system 22:40 Why government can't scale 23:30 The Fourth Amendment 25:26 Suspicious Activity Reports 28:23 Recent memorandum 30:40 The bond 32:34 The blockchain 33:49 Latest from U.S. gov't 34:56 The attribution problem 36:30 Who's involved today? 37:49 The Beacon Network 39:16 Pre-clearance and due process 41:10 Reporting cybercrime 44:26 International law Thank you to the presenting sponsor of this episode, @altitude. Nothing in this podcast is legal or investment advice.

Mempool scanners: now front-running hackers too

Scammers found a way to make people drain their own wallets without sending them a phishing link. They uploaded YouTube tutorials showing people how to build an AI crypto trading bot with Claude. People followed the tutorial themselves. Copied the code. Deployed the smart contract themselves. Funded it from their own wallets. And approved every transaction themselves. Except the “trading bot” had no trading logic. It was built to send their ETH straight to the scammers. 224 wallets lost 274.6 ETH, worth about $517,000 when it was stolen. The median victim lost 1 ETH. Some victims even got an error after getting drained telling them to deposit another 50% to fix the bot. They literally got people to build, fund and approve their own wallet drainer. You've got to be very careful this days

This is the messy middle. A moment in the transition from old to new. The free market will play out here with many impacts. If this works for the company bottom line, they’ll keep leaning in. Talented developers may leave but if it works, it works. This will butt up with inevitable friction on quality, compliance, security. But those things too are largely solvable in most generic software. This will commoditize software creation for the general use case into something that looks far different than 12 months ago. Then there’s a reckoning on where the “developers” go. The “just press enter” work will go to the lowest cost because the skill set needs drops. The high value engineering work shifts to orchestrating the automation. An “AI software architect” or such And none of this applies to high risk critical systems Those systems will have the most interesting transition with a huge push and pull between wanting to adopt AI coding for efficiency and the critical need for precision. We’ll see an adoption of ai coding to be sure, but more likely increasing use of ai for all of the safety checks around every step (ai security reviews per PR, formal verification, continuously maintained end to end threat models etc). But again, we’re in the messy middle. Embrace, learn, and leverage capabilities vs just being mindless cog in the machine.

1/ The @SECGov just issued an innovation exemption for onchain securities trading. This framework has the potential to move trillions of dollars in existing financial assets onto “public, permissionless” blockchains like @solana, positioning the US as the home of internet capital markets.

The "whiteboard defense:" I should be able to pull you aside at any moment and ask you to explain any customer-facing system you've shipped. You should be able to clearly explain how it works and defend the decisions you made. This is my benchmark for responsible AI usage. I don't expect line-level familiarity with the code. I don't care if you remember the exact function name or implementation detail. You may not even know it. I don't care. But if I ask "why did you do X instead of Y?", "what happens if this actor behaves maliciously?", "what data structure did you use here and why?", or "where does this fail?" you should be able to answer confidently. For PoCs, demos, experiments, whatever: I don't care. Generate 100% of it and understand none of it. Speed over quality every time in those specific scenarios. But if you're shipping customer-facing work, you can't be shipping things you don't understand at a high level.

RT @toly: Yes, this is disappointing. Yes, the USA remains one of the last g20 economies without a crypto bill. The tiny sliver of silver…

Yes. This ⤵️