The audit model is broken and everyone knows it. You once paid $200k. You wait 8 weeks. You get a PDF. Then your protocol evolves and the audit is already stale. That's not security. That's a snapshot. We started @Fidesiumapp because security should be continuous, not ceremonial. Human auditors catch what machines miss. Automated and AI tools catch what humans can't scale to review. Neither alone is enough. The future isn't audit OR automation. It's both, working together.

OMG @Shanemgillis are you feeling attacked?

When people hear audit, at least in web3, they think code review. This is a dangerously narrow take on security. An audit is defined as "an independent, official examination of an organization's financial records, systems, or quality standards to check if they are accurate and legal." As many of the latest security incidents illustrate, real losses are moving from code to process attacks. Protocols need to broaden the scope of their security thinking. It should be the customer demanding more depth, a more vigorous look at everywhere they are vulnerable.

Well this is just insane. Fortunately it looks like a whitehat has secured the assets.

The sophistication of these attacks are getting insane. Today's victim: BITGET. $351.6 million gone from hot and warm wallets this morning. Biggest crypto hack of 2026. Biggest exchange breach since Bybit. CEO Gracy Chen: the private keys were never stolen. Attackers hit a critical backend system in Bitget’s wallet stack, spoofed the transaction data, and walked it through the exchange’s own authorization process. The keys did their job. They signed what the system told them to sign. “Not a private key compromise” is technically true. It is also the least reassuring true sentence in this story. If fake transaction data can enter your authorization pipeline and leave it approved, the key is beside the point. The failure sat upstream: in the layer that decides what gets signed. This is a much more dificult problem than custody. Difficult to audit and build processes to protect against. $351.6M total, hot and warm wallets ~$192M across 15 transfers, 7 assets; ETH the largest slice at 44.4% $464M User Protection Fund covers the loss in full Withdrawals paused. Deposits and trading still live. Chen flagged IPs matching VPN patterns used by a DPRK group. On-chain analyst Specter traced bridged XRP back to AFX Trade exploit funds from July: attributed to TraderTraitor.

5 questions to ask before hiring a smart contract auditor: 1. Named senior auditors, or whoever's free / contractor? 2. Findings reported live, or only at the end? 3. Policy if they find a live exploit? 4. Can you see a sample report? 5. What's explicitly NOT in scope? #5 matters most.

The 440% jump in on-chain malware commands isn’t a crypto story. It’s an AI + permanence story. Blockchains became uncensorable C2. Open-weight models remove much of the skill gate. State actors showed up. Defense that only looks at Solidity is now the same as having no security. Ask: Should wallets/RPC/infra vendors treat on-chain payload detection as table stakes?

I am also not speaking Solana Breakpoint for @SuperteamUK or @solana notaspeaker.com

How we run an audit, in short: Week 1: manual review against your actual intent, not just the code Week 2: automated tooling + fuzzing on value-moving functions Throughout: critical findings reported as we find them, never batched Ask any auditor to explain their process in 2 sentences.

My Solana High Yearbook says: I am most likely to reply gm with a 6-point security checklist. Checks out. Solana High Forever! solanahigh.com

When a client pushes back on audit depth, that’s not an argument to win. It’s a risk decision. “Do we really need that?” is a fair question. An auditor’s job is to answer it plainly: what you will (and will not) be able to conclude if the work is lighter.

This.

A completed audit is one of the weakest signals of security maturity, and it's treated as one of the strongest. "Audited by X" has become a marketing badge more than a security claim. It says almost nothing about the team’s incident response plan, whether their multisig setup makes sense, or whether they have a fallback plan if the oracle they depend on has a bad day.

Controlling North America (which includes Greenland) gives you a bonus of 5 extra armies at the start of each of your turns in classic Risk. This is a brilliant tactical move.

Breaking: The company who rubber stamped a portfolio of mansions owned by heroin addict as AAA contributing to one of the worst financial crashes in modern history now owns the capability of rating baskets of DeFi. None of this is shade at OpenZeppelin or their team. After ten years of hard work, I would have taken the payday too. And who knows, maybe they will be able to influence the institutions better from the inside than the outside. But security and due dilligence in Defi has just become, somehow, even more important.

Upgradeability is where audited protocols still get wrecked. “We can fix it later” is a standing privilege humans have to guard forever. Non-negotiables: • No solo upgrades, pauses, or param changes • Admin keys on hardware, not laptops or CI secrets • Quarterly role review: access leaves with people • Tested playbook for a bad admin / bad upgrade before you need it Most headline losses weren’t a missed bug. The admin path worked as designed. What’s your privileged-role review actually look like?

Does anyone else feel like the fear machine is running at full volume again. AI WILL TAKE OVER!!! It will become superintelligent. It will decide humans are surplus, cue the breathless TV news segments. I don’t buy the sudden-extinction story. Not because I think the technology is harmless, but because I think the more plausible damage is slower, quieter, and already underway. The real risk is not Skynet. It is cognitive offloading at population scale. We are handing over the work that used to build judgment: drafting, comparing sources, holding an argument in working memory, noticing when something doesn’t add up. The research is already coming out. Michael Gerlich’s 2025 study of 666 people found a clear negative relationship between frequent AI tool use and critical thinking scores. It's called cognitive offloading. When you delegate the hard mental work to the model. Younger users (17–25) showed the highest reliance and the weakest scores. Education helped, but only when people still did the thinking themselves. Students test scores drop by 17%. They look more productive. They have learned less. MIT researchers shows people write essays with ChatGPT found lower neural connectivity and weaker recall of their own text. A 2026 review in Trends in Cognitive Sciences put it cleanly: learned skills atrophy when we offload them. Writing, analysis, diagnosis, design all suffer when we stop practising. This is the slow death, not the robot war. We are creating a generation that can generate a polished answer without being able to defend it. Act2 is worse. Cory Doctorow’s enshittification pattern is already visible in search, social feeds, and marketplaces: first delight users, then lock them in, then extract. LLMs are next. Ads are arriving, sponsored “suggestions.”, affiliate-shaped recommendations. We all know the goal is to sell attention rather than give the best answer, the model’s voice will stop being a tool and start being a channel. Political framing, commercial nudges, and social steering are all on the table and worse. When you no longer generate the first draft of your own thinking, you are easier to steer. None of this requires rouge AGI taking over it requires bad habits. I am not saying be a Luddite, but I am warning about becoming a drone. Models are not a substitute for a prefrontal cortex. Use them as a sparing partner. Demand sources. Keep some work deliberately unaided so the muscle does not atrophy. The civilisation-ending story makes for great click bait, but the land where people cannot think without a prompt window, and prompt windows that increasingly think for someone else’s P&L is the one we should actually worry about.

What week 1 of a Fidesium pentest looks like: Day 1-2: scoping + reading everything you've got Day 3-4: recon + threat modeling Day 5+: active testing, critical findings flagged same-day Optional: Fuzzing and custom testing harnesses You should never be surprised by the final report.