Pinned Tweet
If the protocol failed, users shouldn’t have to “claim” their own money back.
A hill I’m willing to die on:
If a hack compromises the protocol (not individual wallets), why aren’t funds automatically airdropped back to the owners?
Adding a claim window and invalidating claims if someone isn’t on X or wherever the announcement was made is so unfair.
If my funds were staked on protocol X and it gets hacked, do you really think I’ve consented to a silent expiration date on recovery?
I never authorised the hack. I shouldn’t have to monitor social media to reclaim what was mine.
"Dormant Asset Management: At the conclusion of the 180-day claim window, propose new allocation for unclaimed dormant assets via separate governance proposal."
@Balancer and every other protocol - users shouldn’t have to monitor X/forums to reclaim funds lost due to protocol-level failures.
Humans being will do everything else other than the right thing no matter what type of assurance they gave you.
Terrible species.
It might be useful to look at the post-incident analysis of a similar incident from ~1 year ago
this is the best thread that captures the incident over time & links to various announcements, investigative details, post-mortems, and $$$ analysis:
research.lido.fi/t/security-…
0xvagabond.base.eth(base/eth) retweeted
Replying to @austingriffith
Check out hivesync
I built a protocol that uses @Logos_network messaging to enable agents exchange encrypted messages p2p and coordinate in swarms
Check it out: github.com/daoism-systems/hi…
0xvagabond.base.eth(base/eth) retweeted
⚡️JUST IN: ZachXBT says victims SCAMMED him out of a $100K cut after he recovered their stolen Bitcoin.
He says several victims GHOSTED him, as they stopped replying once their funds were returned, despite remaining active online.
At 9AM EST today somebody abused a bug in Payment Processor V2 to steal 10 Meebits, 50 Otherdeeds, 10 WoW, and 235 Desperate Apewives.
It wasn't until over 12 hours later that somebody reported it to me, and upon digging in I realized that a great many NFTs were subject to the same exploit.
I got in touch with the team over at LimitBreak and they quickly paused Payment Processor V3, which was subject to the same exploit. Unfortunately, V2 was not pausable, so the only path towards protecting affected assets was to run a whitehat operation.
Similarly, V3 on ApeChain is temporarily in a state where it cannot be paused, so ApeChain assets approved to V3 needed to be saved as well.
All in all, we rescued 23,155 NFTs worth north of $5.7M USD.
We later discovered that a similar exploit could be used in reverse to steal WETH. 660 WETH was at risk, which we unfortunately were not fast enough to recover. Apologies to those affected.
Shout out to @Boomskite for flagging the initial exploit tx to me, and @coffeedev @0xjustadev and @whiteoakkong for acting quickly and assisting with the recovery.
All NFTs are safely relocated. Soon, owners will be able claim them back after revoking the exploitable approvals.
Addresses to revoke below.
Replying to @aaakasei
Likely got rugged by another person this month I recovered $275K stolen by Indian call scammers.
Have been ghosted for 4 weeks about my % while they’re active on X.
Since June 2026 it’s now been three people rugging me for ~$100K total reward….
Has ruined my motivation to reply to cold messages and only reply to referrals from strong mutuals.
Hey @grok, you've seen my work aaround unclaimed funds nd sure I'd appreciate if you can vouch me into @evan_van_ness dms.
0xvagabond.base.eth(base/eth) retweeted
Frontrunning attacks: simplified.
Full guide is in the first comment.
0xvagabond.base.eth(base/eth) retweeted
🧵 The first mistake in a DFIR engagement often isn't in the investigation. It's in the access.
Choose the wrong entry method and you risk alerting the attacker, corrupting evidence, or missing artifacts entirely before the investigation has even started.
Access isn't a formality. It's the foundation every finding will be built on.
Get it wrong and the rest doesn't matter 🔎
Don't give them the airtime, they'll end up farming us.
Hey @opensea if you were waiting for the right time to drop your token it’s probably now 😅
Zach said we should dump the hardware wallets and go for an iPhone and sure, he was right.
But for those expecting to be spoonfed: don’t go around installing random apps on that phone. Treat it like a hardware wallet, not a hoe-like device that connects to anything that comes knocking.
⚠️ALERT: An app called FomoPeek has been caught stealing private keys and seed phrases from iPhones.
SlowMist says versions 1.1 to 1.2 contain malicious code that exploits iOS vulnerabilities to gain the highest level of device access.
Once the exploit succeeds, wallet data, login credentials, chat history and files from ALL apps on the device can be accessed.
Binance is urging anyone who installed FomoPeek to delete it immediately, create a new wallet on a clean device and transfer all assets.
I've built my first functional saas
@angelo_intel
i've since end of June posted many mini-episodes on @runwayseries and they've organically with no marketing from me worked surprisingly well
runwayseries.co
i'll post about them individually soon
0xvagabond.base.eth(base/eth) retweeted
Update on @YamFinance governance takeover
The attacker executed proposal #45 and took Timelock admin. They then cut the Timelock delay from 5 days to 12 hours and made themselves gov of Yam's old UMA farming contracts. Calling _settleExpired() released the WETH collateral from their expired uGAS positions. The attacker then pulled everything out with the gov-only masterFallback function, which lets the gov make any call from the contract.
Extracted (~$121K):
• UMAFarmingMar (uGAS-MAR21): 23.50 WETH + 763 UMA
etherscan.io/address/0xffb60…
• UMAFarmingFeb (uGAS-FEB21): 24.59 WETH
etherscan.io/address/0xc0AE1…
The proceeds (48.15 ETH) were cashed out via FixedFloat.
Community alert: Defimon detected a governance takeover attempt of @YamFinance
Attacker self-delegated ~504K $YAM (~3.3% of supply, just over the quorum) and submitted YamGovernorAlpha proposal #45 with an empty description ("0x"). The single action calls setPendingAdmin(attacker) on the YAM Timelock. If the vote passes and executes, the attacker becomes pendingAdmin and can acceptAdmin to seize full control of the Timelock - admin of all YAM protocol contracts and the DAO treasury.
There is ~$337K at risk. The protocol is dormant, so if you hold YAM vote against before block 25897343 (around 34 hours left).
TX: etherscan.io/tx/0xf3c9b1d709…
Attacker: etherscan.io/address/0x26881…
0xvagabond.base.eth(base/eth) retweeted
SQL injection is great, but what if you can't see the response?
Enter Blind SQL Injection!
In this walkthrough, we exfiltrate the administrator's password from the database from a blind SQLi using DNS 👀
Check it out, and follow along here (it's free) 👇
portswigger.net/web-security…
0xvagabond.base.eth(base/eth) retweeted
Shout out to @ambire @BitgetWallet & @metamask for protecting users from Address Poisoning Attacks.
Hopefully other wallets can follow suit and these people can stop spamming our networks.
0xvagabond.base.eth(base/eth) retweeted
shoutout to 2018 meta transactions
Here's a guide @austingriffith wrote on how to do this, and links to the implementation from August 2018
medium.com/@austin_48503/eth…
0xvagabond.base.eth(base/eth) retweeted
🧠 Most defenders assume owning a child domain keeps an attacker contained. It doesn't. Learn exactly how Domain Admin becomes Enterprise Admin without cracking a single password 👉 tryhackme.com/room/childdoma…
































