Soulbound Security

Last week @Binance lost about $6.3B, reportedly starting from one engineer's compromised laptop, weeks after @Bitget lost more than $350M. When everyone's keys and records sit in one place, one weak point is enough. We built Soulbound transfer cards so giving crypto to a person never means handing anyone a password, a wallet connection or a record that links you. 💸 Senders: your Soulbound ID and the signed purpose of every transfer are recorded on @arbitrum. The card itself is built off chain and never tied to that record. 💰Recipients: nothing to connect, nothing to sign. Four checks stop wrong or blocked addresses before anything moves. 🫰Requests: donation pages are frozen once published, show the publisher's Soulbound ID, and link only to verified accounts. How it works, with a live charity request and a 100 USDC transfer card, security code included, as the examples: blog.soulbound.finance/p/the…

Beta feedback, shipped same day: transfer cards now show only the digits that matter. 0.01 ETH, not 0.0010. Same precision underneath, less noise on the card. Thank you to everyone testing. Keep it coming. 🚀 Security code is "soulbound" FCFS! 💸

Feedback welcome from beta users on the site design, flow and ease of use. Better feedback will result in better give aways! 🚀 DM us.

At @techtides_hq, our CEO @GolfPirate369 and Dr Clare Ryan took on what a machine should decide when an AI agent attacks at machine speed, and what must stay human. Our answer: make that line part of the protocol, not a prompt. Soulbound Auth lets agents act alone within their on-chain permits, and anything beyond stops at a person’s hardware key. Founders, investors and institutions told us early-stage teams need this built for where they are, so we’re shaping our blockchain and agentic AI security work for pre-Series A startups. blog.soulbound.finance/p/sba…

Protocol admin consoles and treasury hot wallets still sit behind passwords, codes, and API keys, and compromised keys are crypto's top source of losses. SBA-Auth, open source today: one enrolled key per operator, every action checked before it runs. Your checks run once, at enrollment: identity, approvals, scope. Bound to a non-transferable Soulbound ID on @arbitrum or any EVM chain. Then every action: signature, ID, permits. Nothing on the server can act. Built for the kind of operations behind @aave, @Uniswap, and @LidoFinance, and the @SafeLabs_ signers guarding them: pause, upgrade, withdraw. The signer's device shows the action in words, and the server refuses if it doesn't match what runs. Same rules for AI agents trading on @HyperliquidX or launched on @virtuals_io. Within their permits they move at machine speed. Beyond them, they stop at a human's hardware key. A prompt-injected agent can propose. It can't sign. AGPL-3.0. Audited, every finding public. Post: blog.soulbound.finance/p/sba… Code: github.com/SoulboundSecurity…

Our founder Christopher Clark joins Dr. Clare Ryan of @ItusProtect at @techtides_hq on 27 Oct, walking through a full-spectrum compromise driven by AI agents: employee spoofing, social engineering, exploitation and action on target. When red and blue teams both run on AI, can humans keep up? Chris takes the business owner and CISO seat, and Clare brings the insurance and regulatory lens. We're proud to sponsor TechTides and the evening social. Come find us for a @SoulboundSec pint glass 🍺 📍 Millennium Forum, Derry~Londonderry 🎟️ eventbrite.ie/e/techtides-de… @Derry_Chamber #TechTides #AgenticAI #Cybersecurity

31337 Security Research: One zero drained $190M from the @nomadxyz_ bridge. A routine upgrade left the zero root pre-approved. Every message that had never been proven resolved to that same zero, so the trust gate waved it through. The first exploit transactions went privately through @flashbots, until a third exploiter called the contract directly and published the payload. More than 300 addresses then copied it, kept its @MoonbeamNetwork origin, and swapped in their own recipients, tokens and amounts. The bridge was empty in about eight hours. In Dec 2025 the @FTC announced a proposed settlement with Illusory Systems, the company behind Nomad, alleging the June 2022 upgrade shipped inadequately tested code. An upgrade that breaks a state invariant is now a regulatory matter, not bad luck. New research from the Soulbound Security 31337 team, with credit to @coinbase, @Mandiant and @PeckShieldAlert for the original analysis. blog.soulbound.finance/p/whe…

Learn more about Soulbound.finance and secure private transfers of @ethereum, @USDC and @WrappedBTC.

Where does privacy actually live? We reviewed the three architectures: 🪙 Privacy coins (@monero @Zcash): privacy lives in the asset. Strong crypto, but you convert in and out through exchanges that keep delisting you, and the EU bars CASPs from them in July 2027. ⛓️ Privacy chains (@aztecnetwork @AleoHQ @SecretNetwork @namada): privacy lives in the domain. Private inside, but the bridge is a public choke point logging amount and timing, and your USDC arrives wrapped. 💸 Transaction-level: same chain + tokens. We security-reviewed PrivacyBoost, an advanced mixer. Different job. @SoulboundSec : immutable, unconditional exit, EIP-712 attestation per transfer. @PrivacyBoost : upgradeable proxy, snapshot-gated exit, no identity layer. blog.soulbound.finance/p/whe…

We completed an external stress test of our home chain @arbitrum. Deployed 256 immutable contracts, processed 4.27 million events across 305 transactions in a deliberate saturation burn — ~0.099 ETH total spend. Sequencer absorbed it without degradation. Block production held at full pace. L2 base fee responded predictably to load. Architecture passed. 14,000+ redemptions in two weeks, zero failures. Thanks @arbitrum @offchainlabs for the rails that made this test both possible and survivable. Verified contracts: arbiscan.io/address/0x50B6c6…

All 196 pending redemptions delivered in in less < 5 seconds in batches of up to 45, sorted by token to maximize privacy. Restarted with new RPC providers. Platform remains paused while we re-engage privacy matrix sentinel wallets. And yes.. this is ALL our admin can see. No transfer codes, no sender or recipient eth or soulbound IDs, only the transaction hash of the batch. Client side encryption and full seperation (even in our DB and admin) of sender and recipient down to the batch level.