Next-level vulnerability detection for your contracts on 3 layers using cutting-edge technology.
If you care about your contracts' security, this is it.
Standard monitoring isn't enough anymore. So we built on top of it.
Today we're launching Glider Monitor, built for everyone in Web3 deploying Contracts or Capital.
At its core is Glider - which recognizes any on-chain pattern and tracks it across your contracts continuously, protecting you on multiple fronts.
• Exposure replay: when an exploit hits another protocol, or a novel attack vector surfaces in public research, we replay it against your contracts and tell you if you share the vulnerability - before it reaches you.
• Dependency risk & invariants: your contracts trust oracles, vaults, and third-party code. Glider Monitor maps your full dependency graph automatically and monitors invariants for known risk classes - stale oracles, vault health, stablecoin depegs - plus custom invariants built for your specific risk profile.
• Real-time attack monitoring: continuous observation of your contracts, alerting you the moment you're targeted.
Threats in web3 are continuous.
Now your security matches the pace.
Start with our free tier, <10 contracts, 60 seconds onboarding.
7
601
0xkasper retweeted
Aptos Move VM bug | With @kemmio nitter.gq/i/broadcasts/1qJDzzpbw…
0xkasper retweeted
1/
we found a bug in the Aptos Move VM that put up to $70B at systemic risk. type confusion at the execution layer. a ~90% success rate across hundreds of simulated runs on a 30+ validator cluster. cost to build the attack infrastructure: $3,000.
Conducted by @kemmio , to our knowledge this is the first public research that showcases how to land a sophisticated multi-block attack in real-world environments. It includes mempool feng shui, block production specifics and about a dozen of other primitives and tricks chained to get to near-perfect exploitation results.
Nonetheless, Aptos called it "extremely low exploitability."
[hexens.io/research/aptos-hij…]
0xkasper retweeted
An arbitrary state write bug in Aptos chain was disclosed by @hexens today.
This is the worst kind of bug possible on a chain.
Why? Not only everything on the affected chain can be stolen but also most assets across all chain can be stolen.
Your stablecoins, LSTs, everything
0xkasper retweeted
Hexens Builder Support × @0xPolygon
We’ve partnered with @0xPolygon to allocate dedicated Builder Support slots exclusively for Polygon builders.
Builders get a full Hexens audit, Hexens products, and partner ecosystem access. Eligibility: under $1M raised, pre-first-audit.
Apply: hexens.io/pages/builder-supp…
0xkasper retweeted
Today we're expanding Hexens Builder Support into a full ecosystem program.
Partners across the essential early-stage stack all chipping in to help teams ship safely.
Meet our initial launch partners:
@Spredoio, @Blocksource_co , @ChainstackHQ, @Quicknode, @infura_io, @layer3, @Wonderland, @ISinfra, @Labrys_io, @LunarStrategy, @xyz_remedy
Always room for more partners supporting early-stage builders.
Partners apply here: forms.gle/bwTkGzBTsU4eG2gq6
Builders apply here: hexens.io/pages/builder-supp…
King @andykoo
Apple just released iOS 26.5 and iPadOS 26.5, patching a significant number of security vulnerabilities across core system components - from memory corruption in media handling to sandbox escapes and privacy bypasses.
Among the credited researchers: our own Andy Koo (@andykoo), who discovered CVE-2026-28974 - a double free vulnerability in Spotlight, found using an AI-augmented fuzzing setup.
Update your devices.
Full advisory: support.apple.com/en-us/1271…
3
349
0xkasper retweeted
A growing share of major exploits no longer break contract logic. They break ops workflows, infrastructure assumptions, and key management.
The recent exploits are another example. The contract code is not the only failure point.
This is why our audit practice covers oracle daemons, deployment configurations, off-chain infrastructure, and cloud security, not just Solidity.
We are contributing to a piece with @magmadevs on RPC-layer risks, where trust assumptions are often invisible until they are exploited. More soon.
Attacks like KelpDAO/LZ will keep happening until we close the RPC Security gap.
That's why we're partnering with @cyfrin, @hackenclub, @Hashlock_ and @hexens to help teams harden the layers smart contract audits don't reach.
Learn more and check your exposure to RPC attacks 👇
0xkasper retweeted
This is blackhat behavior. Screw this.
Public disclosure is for bugs you want to PREVENT from being abused. This guy just told everyone how to dump the data while it's still exposed. Once it's dumped, it's over with anyways.
if you've ever used Reframe to get sober, your private journals, your craving logs, what triggered you, how bad it got, your name, your email, all of it is sitting in a database that anyone can read without logging in
i unzipped the app and found a database key in a config file. thats it. thats all it took
357,939 users exposed. disclosed april 7, no response
0xkasper retweeted
Royco Dawn has completed three protocol audits with Hexens.
@hexens is a tier-one auditing firm with a flawless record. Over 300 engagements, $85 billion in protected assets, and a zero post-audit exploit record.
Every engagement runs two fully independent senior teams reviewing the same codebase in parallel. Royco partnered with Hexens for 3 full security engagements for Dawn.
The first two covered all the core Dawn contracts. The third one covered the entry point and integrations which will enable Dawn’s public release.
The engagement went beyond code review. It shaped the final design of the protocol in addition to fortifying its security.
To the Hexens team: thank you. Your contributions on the security and mechanism front were instrumental to making Dawn what it is today.
We are thrilled to have you as a part of our team.
0xkasper retweeted
The ETHSecurity badges distribution from @thedaofund is finished now.
We are proud to share that members of Hexens team are part of this important initiative:
@andykoo — Lead Security Researcher
@p0wn4j — Lead Cryptography Security Researcher
@kemmio — CTO & Co-Founder
TheDAO's mission is to make Ethereum safer, and ETHSecurity is how they vet the researchers capable of contributing to that work.
The final 100 ETHSecurity Badge holders are in!
That brings us to 200 security experts, guiding how TheDAO allocates its funds and also coordinating behind the scenes to make Ethereum safer.
Big thanks to everyone who engaged with the process and helped shape it, and to @bonfiresai for building the tooling that made it possible.
0xkasper retweeted
Live Event | Audit Retrospective | Hexens <> Royco nitter.gq/i/broadcasts/1lKQRvqVA…
0xkasper retweeted
imho one of the most sophisticated exploits on solidity contracts
real OG @0xkasper
Cross-chain bridges remain critical infrastructure, proof verification is the core of their security model.
New disclosure on our research page: a vulnerability in the Polygon Plasma bridge that allowed transaction proofs to be forged.
At the time of discovery, $800M in POL was at risk, exploitable in a single transaction with no prerequisites.
The research covers how the proof verification breaks, how the exploit was built, and what it means for bridge security.
Full technical deep-dive: hexens.io/research/polygon-b…
0xkasper retweeted
Cross-chain bridges remain critical infrastructure, proof verification is the core of their security model.
New disclosure on our research page: a vulnerability in the Polygon Plasma bridge that allowed transaction proofs to be forged.
At the time of discovery, $800M in POL was at risk, exploitable in a single transaction with no prerequisites.
The research covers how the proof verification breaks, how the exploit was built, and what it means for bridge security.
Full technical deep-dive: hexens.io/research/polygon-b…
0xkasper retweeted
Some of the best auditors in the space have teamed up to create incredible challenges for this CTF
Huge shut out to @WhiteHatMage @Montyly @0xEV_om @rileyholterhus @PatrickAlphaC @zachobront @milotruck @0xkasper
This is gonna be absolute madness
If you’ve ever survived one of our CTFs, you know the chaos and fun.
Now imagine that… 5x bigger.
More teams. More exploits. More madness.
Huge thanks to @EthCC for helping make this happen 💙
Are you gonna try to win this CTF, anon? 👀
0xkasper retweeted
Full bug explainer: soliditylang.org/blog/2026/0…
Thanks to @hexens for the discovery and thorough report, @_SEAL_Org and @dedaub for their swift response and help in identifying affected contracts.
0xkasper retweeted
Was curious to find all of the contracts described in Anthropic's article using glider
Vulnerability 1: glide.r.xyz/query/374b7321-4…
Vulnerability 2: while researching the contracts, it turned out that some of the function names shown in PoC had been changed.
So I decided not to post the query, but any of you are welcome to try it by yourself
PS. You will need to run the queries against mainnets. If you're a whitehat with a proven record and still don't have access, dm me
New on our Frontier Red Team blog: We tested whether AIs can exploit blockchain smart contracts.
In simulated testing, AI agents found $4.6M in exploits.
The research (with @MATSprogram and the Anthropic Fellows program) also developed a new benchmark: red.anthropic.com/2025/smart…
0xkasper retweeted
My article “Introduction to cybersecurity in digital assets and cryptocurrencies” is now published by Oxford University Press (Oxford Law Pro).
Web3 cybersec is fundamentally different from traditional IT security & that difference matters legally.
#Cybersecurity #CryptoLaw
🧵
0xkasper retweeted
If you want to end 2025 with extra cash, just join the Glider contest.
Found a Solidity bug? Turn it into a Glider query and get paid.
You'll wrap up 2025 with some extra money and hands-on experience with a first-of-its-kind tech.
Glider contest runs until Dec 31, with over $40,000 left in the pot (up to $2,000 per query).
Don’t slow down just because the year is ending, there might be even more opportunities.
Since December started:
> Landed my biggest audit so far
> Submitted two findings to Immunefi after half a year
> Learned @xyz_remedy's Glider and wrote my first query
> Waiting for mediation on a huge bug found with another whitehat (already fixed)