non fungible dad security researcher
Joined April 2018
- Tweets2.2K
- Following1.1K
- Followers342
- Likes1.7K
RustyRabbit retweeted
Disappointed by the European Central Bank’s (ECB) and European Banking Authority’s (EBA) responses to the MiCA consultation.
They are not only advocating for a prohibition on paying yield on stablecoins, but also for restrictions on CASPs providing access to DeFi, including protocols offering yield on non-MiCA-authorized stablecoins, without providing a clear framework for how access to DeFi should work in practice.
They also suggest that CASPs offering access to DeFi should restrict it to certain groups of users through so-called “suitability tests,” alongside a potential certification regime for DeFi lending protocols.
It is unclear how these requirements would work in practice. If regulators determine which protocols are deemed suitable for European users, the result risks looking very different from the open DeFi that exists today.
Instead, we could end up with more walled gardens that undermine the liquidity and network effects of open financial networks, ultimately limiting Europeans’ ability to access new ways to grow and preserve wealth.
These proposals are presented as measures to “protect consumers.” But excessive restrictions can instead create more friction for innovation and slow the development of open, transparent, and auditable financial infrastructure that can benefit consumers.
The reality is that onchain finance, including stablecoins, DeFi, and tokenized securities, has the potential to reshape financial infrastructure by reducing friction, increasing transparency, and expanding access to financial opportunities.
European consumers and businesses stand to benefit significantly from this transformation, particularly if the companies building this infrastructure can continue to build and compete from within Europe.
Meanwhile, U.S. regulators, including the SEC and CFTC, have increasingly taken a more pragmatic approach toward enabling onchain financial innovation.
European regulators should put users and their interests at the center of the framework. Banks and other incumbents should be able to adapt their businesses to serve users in an increasingly onchain economy, rather than relying on artificial restrictions that risk increasing costs and reducing access for Europeans as the rest of the world moves onchain.
DeFi will win.
RustyRabbit retweeted
true, but most users don't understand how their hardware wallet works 👇
the most important thing related to immutability (your privater keys will never be exfiltrated) is which chipset signs, and can that chipset be updated?
a hww is made of two chipsets: an MCU (general purpose microprocessor, not built for security, upgradable on 100% of devices) plus a secure element.
90% of hwws sign on the MCU. Which btw means your private keys leave the secure element for a not so secure microprocessor every single time you sign.
very few hwws sign inside the secure element. To our knowledge:
— Ledger does BUT the secure element is remote upgradable. Which is what happened in 2023, which means the behaviour of the secure element can change and an upgrade can exfiltrate secrets.
— Tangem does, from what we can tell. It's closed source, so we can't verify.
— @keycard_ shell does. the secure element is the card. it generates the keys, stores them, signs with them. And the applet is locked at production and is thus immutable. not upgradable by you, by us, or by a subpoena.
if you don't want to trust our factory process at all: buy a blank javacard, load the applet yourself from our github and lock the card. the whole stack is open and verifiable, all 100% of it.
there's a cost for this architecture though: immutable means new signature primitives need a new card. we think that's the right trade, and javacards are both the cheapest secure elements on the market and the only ones you can build yourself.
our view: a hardware wallet should be an upgradable, stateless interface talking to an immutable secure element. upgrade the thing that shows you what you're signing. never the thing that holds your keys.
that's what we tried to build with @keycard_ shell, and it's open source with permissive MIT license (sw, hw, mechanics) for any one to build this type of architecture.
RustyRabbit retweeted
PLEASE every protocol read this. Your bug bounty submission might be malicious:
The incident was the result of a sophisticated, multi-stage attack that combined social engineering with a trojanised proof-of-concept test suite.
The attacker initially established credibility by submitting a plausible responsible-disclosure report describing a potential reward-distribution front-running vulnerability in the vault contracts. The report referenced legitimate-sounding contract functions, followed a standard vulnerability disclosure format, and offered to collaborate on mitigation steps. These elements appear to have been deliberately crafted to encourage our team to review and execute the attached proof-of-concept.
RustyRabbit retweeted
The scary part about Anthorpic's Fable nerf is not that it refuses to answer biology or cryptography. It's that it foreshadows what's coming. A world where a couple companies decide what you can and cannot do. They're building a new ruling class and you're not in it...
RustyRabbit retweeted
this rug was quite well-hidden actually
🚨SlowMist TI Alert🚨
💸 Loss: 14.411518807585587 ETH
🔍 Root Cause: Storage slot collision between `ATOHook.rewards` mapping slot and Solady `ReentrancyGuard` fixed slot (`0x02215292eb9609279094554c6e223f800950648ddfa3da30329838d6c170928d`). The `nonReentrant` modifier in `getReward()` writes sentinel value `0xffffffffffffff` to the guard slot, which is simultaneously read as `rewards[attackContract]` due to the collision. This inflated reward is paid as ETH each call, allowing 200 repeated claims.
📌 Attacker (EOA): 0x2d2aafc193c24e59bd16139056ac9b4df4d37ad0
📌 Victim Contract: 0xa10de71ddb4e0d51938ef6e0118822e157a62888
📌 Attack Contract: 0x2441e480f62bf609a08da09143e4baf8a817d757
Storage collision between reward accounting and reentrancy guard enables unlimited reward drainage.
Powered by #SlowMist.AI
etherscan.io/tx/0xe4e2cc3b06…
RustyRabbit retweeted
People do not trace back the bugs and validate them, people do no use false claim filter for maybe third run to validate bugs, they just submit what the Ai report to them.
RustyRabbit retweeted
You think there's been lots of hacks?
There are companies right now replacing software that was working perfectly well for years, that we can inspect and find bugs in...
with "agents" we can't inspect, commanded by prompts that influence its output in ways we can't map, and that are mathematically incapable of separating instructions from untrusted data.
All of that for 1,000,000,000x the compute cost, and an error rate orders of magnitude worse than before.
Since businesses now apparently exist to be AI customers and justify AI valuations instead of providing products and making profits, you can expect the trend to keep going for a while.
RustyRabbit retweeted
layerzero attack was not rpc poisoning
in networking poisoning is when the attacker outside the trust boundary taints a shared lookup (dns, arp, cache). the consumer has no reason to distrust the source.
this was not that.
the attackers got inside layerzero's trust boundary. they accessed the rpc list, compromised two nodes the dvn depended on, and swapped the op-geth binaries. that's an infra breach within the perimeter. supply-chain shaped, not network shaped.
and the payload was surgical. the malicious binary cloaked by ip, served forged payload only to the dvn, told the truth to scan and every other caller, then self-destructed to wipe logs and binaries.
rpc poisoning makes it sound like something that happened to the infra from the outside. the real story is a targeted implant operating inside the trust boundary.
that's a meaningfully scarier attack than the label suggests.
RustyRabbit retweeted
Kraken Security Update
We are currently being extorted by a criminal group threatening to release videos of our internal systems with client data shown if we do not comply with their demands. It’s important to start with the most important points: our systems were never breached; funds were never at risk; we will not pay these criminals; we will not ever negotiate with bad actors.
Kraken identified and shut down two instances of inappropriate access to limited client support data.
In February 2025, we received a tip from a trusted source regarding a video shared on a criminal forum that appeared to show access to our client support systems. We immediately launched an investigation and quickly identified the individual involved as a member of our support team. Their access was revoked immediately, a full investigation was conducted, additional security controls were put in place and a limited number of affected clients were notified.
Since then, we have been collaborating with industry partners and law enforcement to investigate and disrupt insider recruitment efforts targeting not only crypto companies, but also gaming and telecommunications organizations.
More recently, we received another tip, along with a new video showing similar activity. We quickly identified the individual involved and terminated their access. As before, we acted immediately to revoke access, conduct a full investigation, and notify the small number of affected clients.
Across both incidents, only a very small number of client accounts were potentially viewed - approximately 2,000 in total (0.02% of clients).
Shortly after access was terminated, we began receiving extortion demands. The criminals threatened to distribute materials from both the February 2025 incident and the recent incident to media outlets and on social media if we did not comply. We will not pay these criminals.
Based on intelligence gathered across both incidents, along with extensive ongoing analysis, we believe there is sufficient evidence to support the identification and arrest of those responsible.
We are actively working with federal law enforcement across multiple jurisdictions to pursue all individuals involved and bring them to justice.
Due to the ongoing investigation, we cannot share additional details at this time. However, anyone with relevant information is encouraged to contact us directly.
The security of our clients is our highest priority, and we remain fully committed to combating the growing global threat of insider recruitment and constantly enhancing our security practices to combat new threats.
Note: If you are a client potentially affected by this, you've already been notified.
RustyRabbit retweeted
- Drafted a blog post
- Used an LLM to meticulously improve the argument over 4 hours.
- Wow, feeling great, it’s so convincing!
- Fun idea let’s ask it to argue the opposite.
- LLM demolishes the entire argument and convinces me that the opposite is in fact true.
- lol
The LLMs may elicit an opinion when asked but are extremely competent in arguing almost any direction. This is actually super useful as a tool for forming your own opinions, just make sure to ask different directions and be careful with the sycophancy.
RustyRabbit retweeted
security auditors only have 5 moods:
1. fk I hit the Claude limit again
2. how we gonna get rich
3. random 2 am motivation
4. intense loneliness
5. my family needs me
RustyRabbit retweeted
These days, in almost all my discussions I get asked what I think about AI and the future of security, so I figured I should share it here
Short version: I try not to have a strong opinion yet. We are clearly in a transition phase, and outside of people working directly on foundation models, no one really has a solid view of where this is going
Over the past months, LLMs improved a lot. The releases at the end of 2025 were a real step change. In practice, most people I know (myself included) have barely written code in the past 2-3 months. For security, we went from "this is fun" to "this is actually useful"
Right now, the best mental model I have is that we effectively jumped from having no tooling to having an advanced static analyzer or fuzzer. A lot of bugs that used to take time to find can now be surfaced quickly
Does that mean security researchers disappear in 2 years? Based on today’s tech, I do not think so. There are a lot of bugs to be found. Some are found by humans, some by traditional techniques, and now some by LLMs. But it does not mean all bugs get found. If anything, history suggests there are always more bugs than anyone expects, and that gap does not go away easily
The real question is: do LLMs get another capability jump, or just steady iteration? There are reasonable arguments both ways. To be honest, I do not have enough understanding of how these models evolve to have a confident answer. And anyone giving a very definite answer is probably overconfident, unless they are working directly on the models
Depending on that, the role of security researchers could change a lot, including the way we work. The demand could decrease if models get very strong at finding bugs. But it could also increase if the amount of code grows faster than the models’ ability to reason about it. We could even end up with a shortage of experienced researchers in a few years if fewer juniors enter the field while seniors move elsewhere. It is hard to predict because everything depends on how model capabilities evolve
On the business side, I am skeptical about "AI audit as a service". If models keep improving, it is hard to see how these companies compete with native offerings from OpenAI or Anthropic. Especially if those providers stop exposing raw capabilities and push everyone into their own products. I tried codex security, and while it is not perfect, it is clear where this is going. Mythos / Capybara seem to be around the corner, and it will be interesting to see how far it goes
My current bet is that within a few months, tools like codex or claude security will be great at finding blockchain issues, and they will integrate directly into most dev pipelines. At that point, the marginal value of an extra "AI audit SaaS" becomes limited
So what to do as a security researcher? Be adaptive. This is a transition period, and things will likely move fast in 2026. Stay curious, and keep working on skills that give you an edge. Regularly reassess where you are strong or weak, and where AI helps you versus where it replaces you. If you like challenges, see AI as one that pushes you to improve
Also, be careful with what people call "cognitive debt" or "brain rot". I was skeptical at first, but I do see it now. The more I rely on LLMs during an audit, the more I lose part of the intuition that I normally build while going deep into code. That intuition is still critical to find complex bugs. I have not found the right balance yet, but it is something to watch
It probably makes sense to revisit your view on LLMs every 3-6 months. I have already been wrong a few times on this, and I am fine with that, as long as I don’t get locked into a fixed view
Finally, a lot of people focus on the downside for security researchers. But there are also upsides. I can explore codebases much faster, build custom tooling easily, and spend less time on boring tasks. Maybe it’s my last few years/months as a security researcher, maybe not. But at least LLMs let me have some fun before doomsday 😅
RustyRabbit retweeted
Introducing the Agent Virtual Machine (AVM)
Think V8 for agents.
AI agents are currently running on your computer with no unified security, no resource limits, and no visibility into what data they're sending out. Every agent framework builds its own security model, its own sandboxing, its own permission system. You configure each one separately. You audit each one separately. You hope you didn't miss anything in any of them.
The AVM changes this.
It's a single runtime daemon (avmd) that sits between every agent framework and your operating system. Install it once, configure one policy file, and every agent on your machine runs inside it - regardless of which framework built it. The AVM enforces security (91-pattern injection scanner, tool/file/network ACLs, approval prompts), protects your privacy (classifies every outbound byte for PII, credentials, and financial data - blocks or alerts in real-time), and governs resources (you say "50% CPU, 4GB RAM" and the AVM fair-shares it across all agents, halting any that exceed their budget). One config. One audit command. One kill switch.
The architectural model is V8 for agents. Chrome, Node.js, and Deno are different products but they share V8 as their execution engine. Agent frameworks bring the UX. The AVM brings the trust. Where needed, AVM can also generate zero-knowledge proofs of agent execution via 25 purpose-built opcodes and 6 proof systems, providing the foundational pillar for the agent-to-agent economy.
AVM v0.1.0 - Changelog
- Security gate: 5-layer injection scanner with 91 compiled regex patterns. Every input and output scanned. Fail-closed - nothing passes without clearing the gate.
- Privacy layer: Classifies all outbound data for PII, credentials, and financial info (27 detection patterns + Luhn validation). Block, ask, warn, or allow per category. Tamper-evident hash-chained log of every egress event.
- Resource governor: User sets system-wide caps (CPU/memory/disk/network). AVM fair-shares across all agents. Gas budget per agent - when gas runs out, execution halts. No agent starves your machine.
- Sandbox execution: Real code execution in isolated process sandboxes (rlimits, env sanitization) or Docker containers (--cap-drop ALL, --network none, --read-only). AVM auto-selects the tier - agents never choose their own sandbox.
- Approval flow: Dangerous operations (file writes, shell commands, network requests) trigger interactive approval prompts. 5-minute timeout auto-denies. Every decision logged.
- CLI dashboard: hyperspace-avm top shows all running agents, resource usage, gas budgets, security events, and privacy stats in one live-updating screen.
- Node.js SDK: Zero-dependency hyperspace/avm package. AVM.tryConnect() for graceful fallback - if avmd isn't running, the agent framework uses its own execution path. OpenClaw adapter example included.
- One config for all agents: ~/.hyperspace/avm-policy.json governs every agent framework on your machine. One file. One audit. One kill switch.
RustyRabbit retweeted
JP Morgan's CISO wrote an open letter about agentic AI access management. AI agents are starting to act autonomously across systems, reading emails, executing code, calling APIs. Each one needs credentials, permissions, and guardrails.
We haven't figured out how to manage human access properly (38% of ex-employees still have access). Now we're handing keys to autonomous agents.
The access-trust gap isn't closing. It's about to get exponentially wider.
RustyRabbit retweeted
Your hardware wallet can receive a firmware update that changes how your keys are used. 🔐
Ours can't.
Not by hackers. Not by us. Not by anyone.
Here's why that matters 👇
keycard.tech/en/blog/a-keyca…
