Engineering Director for Cryptography at Trail of Bits
Joined April 2022
- Tweets114
- Following155
- Followers447
- Likes52
If your company culture sucks, your employees might apply for another job at a fake NK company and accidentally install malware on their work machine
Binance claiming this happened to them and led to the theft of $6B
Is good culture a critical cybersecurity control in 2026?
Jim Miller retweeted
Special election day blog by the @trailofbits crypto team. Learn how electronic voting works:
nitter.gq/TheMijCipher/status/21…
Happy Election Day.
As everyone manually fills in the bubbles in their ballots today, you may have wondered why we still use paper-based voting
my teammate wrote up a nice explainer of how cryptography is used for electronic voting and why we still use paper ballots nationally
A cryptographically verified tally doesn't mean every vote is legitimate. Paper ballots still matter: they provide an audit record independent of software. We explain how electronic voting works, and how cryptography can make paper-based elections more trustworthy. blog.trailofbits.com/2026/11…
My teammate “proved” Fermat’s Last Theorem and did something Fermat or anyone else couldn’t do: made it small enough to fit in the margin
Last week, @AnthropicAI formalized Fermat's Last Theorem in 13 million lines of Lean code.
We "proved" that same theorem in 20 lines by exploiting a bug we found in Lean. blog.trailofbits.com/2026/09…
Patch the Planet is our joint initiative with @OpenAI to help maintainers strengthen critical open-source software.
In one week, we used Codex and GPT-5.5-Cyber to find hundreds of bugs inside OSS like cURL, Python, and the Go project. 37 patches merged, with more in flight. 🧵
Re Zcash vuln: yes, ZK exploits are undetectable. Here's a slide from my 2023 RWC Fiat-Shamir talk where we found Incognito Chain had an undetectable print free money vuln for over 4 years. These issues happen all the time in ZK systems. Formal verification is not a silver bullet
ZK is a sharp double-edged sword. The same technology that offers private transactions, private identity services, and private voting also enables undetectable money theft, undetectable identify theft, and undetectable election hacking
What a class act. Please don’t forget how kind, hard working, generous, and cracked you are too, my friend.
Since this has blown up, I’d like to shout out all the other trans founders. I won’t name them out of respect for their privacy.
There aren’t a lot of us out there and it’s hard. All the ones I’ve met are incredibly hard working, kind, and generous people, not to mention completely fucking cracked.
Shit like this happens all the time but that’s life, can’t make everyone like you. :/ Life is not easy—for anyone
5
165
Jim Miller retweeted
Congrats to Ryan Keegan for being the first to exploit the simulator we used to validate the secret quantum circuits: blog.trailofbits.com/2026/04…
It kills me that the (now fixed) bugs were simple (we didn't port the op validation code from C++ to Rust!), but that's to be expected.
Jim Miller retweeted
Going further, there’s a way to protect the guest program even against potential compiler bugs: formally verify the guest RISC-V assembly code, like I’m experimenting with in evm-asm.
Jim Miller retweeted
Great write up of how Trail of Bits was able to find vulnerabilities in Google’s zero knowledge prover and generate a fake proof:
blog.trailofbits.com/2026/04…
Jim Miller retweeted
Google used a ZK proof to disclose a quantum breakthrough that cuts the cost of breaking cryptocurrency by 20x without handing attackers the circuit. We found anyone could forge a “proof” of an even stronger attack. 🧵
Jim Miller retweeted
Lets break down these attacks:
nitter.gq/tjade273/status/197310…
First up is wiretap.fail
The key insight is that TEEs do not randomize their memory encryption. This is because the encrypted data needs to fit in the same space as the plaintext, so there is no room for a nonce or IV.
The typical cipher mode is AES-XEX or the related AES-XTS.
en.m.wikipedia.org/wiki/Xor%…
Every memory location acts like an independently keyed cipher, so it’s not quite ECB Tux level bad, there is a sort of _temporal tux_ problem. Every time a value is encrypted at a particular memory location, the ciphertext is the same.
IMO these two attacks spell the beginning of the end for SGX, TDX and SEV-SNP in self-hosted contexts. These DRAM bus attacks were always the glaring hole in the threat model, and I expect DDR5 to fall soon as well.
These attacks are explicitly written out of the threat model so they won’t be patched by Intel and AMD, and it’s not clear how they could do so anyway.
My colleagues wrote a great explainer on the historic hack from today and what it means for the industry. Must read 👇
The $1.5B Bybit hack marks a new era in cryptocurrency security. Attackers have moved beyond technical exploits to sophisticated operational attacks. Read our initial analysis of this historic breach and its industry-wide implications: blog.trailofbits.com/2025/02…
Jim Miller retweeted
The $1.5B Bybit hack marks a new era in cryptocurrency security. Attackers have moved beyond technical exploits to sophisticated operational attacks. Read our initial analysis of this historic breach and its industry-wide implications: blog.trailofbits.com/2025/02…
Start the year off right and register/submit a talk for the Real World MPC workshop! The MPC Alliance is hosting this as a co-located event for Real World Crypto, and the CFP is now open and accepting talks across a wide variety of MPC topics 🙂. Details and links are in 🧵
The RWMPC workshop will be a 1 day event on March 25 in Sofia, Bulgaria. The content will cover a variety of practical MPC use cases: currently accepting potential talks across real-world deployments, standards, security, formal verification, legal implications, and more!
1
1
131