CLOUD | PYTHON | Security isn't an option | Crypto bounty hunter | Don't just announce the sunset, help the users get their funds out. Hire me.

Mars
Joined February 2021
If the protocol failed, users shouldn’t have to “claim” their own money back. A hill I’m willing to die on: If a hack compromises the protocol (not individual wallets), why aren’t funds automatically airdropped back to the owners? Adding a claim window and invalidating claims if someone isn’t on X or wherever the announcement was made is so unfair. If my funds were staked on protocol X and it gets hacked, do you really think I’ve consented to a silent expiration date on recovery? I never authorised the hack. I shouldn’t have to monitor social media to reclaim what was mine. "Dormant Asset Management: At the conclusion of the 180-day claim window, propose new allocation for unclaimed dormant assets via separate governance proposal." @Balancer and every other protocol - users shouldn’t have to monitor X/forums to reclaim funds lost due to protocol-level failures.
1
1
13
983
Humans being will do everything else other than the right thing no matter what type of assurance they gave you. Terrible species.
46
0xvagabond.base.eth(base/eth) retweeted
It might be useful to look at the post-incident analysis of a similar incident from ~1 year ago this is the best thread that captures the incident over time & links to various announcements, investigative details, post-mortems, and $$$ analysis: research.lido.fi/t/security-…
1
1
24
3,850
0xvagabond.base.eth(base/eth) retweeted
⚡️JUST IN: ZachXBT says victims SCAMMED him out of a $100K cut after he recovered their stolen Bitcoin. He says several victims GHOSTED him, as they stopped replying once their funds were returned, despite remaining active online.
108
66
21
1,154
124,897
0xvagabond.base.eth(base/eth) retweeted
At 9AM EST today somebody abused a bug in Payment Processor V2 to steal 10 Meebits, 50 Otherdeeds, 10 WoW, and 235 Desperate Apewives. It wasn't until over 12 hours later that somebody reported it to me, and upon digging in I realized that a great many NFTs were subject to the same exploit. I got in touch with the team over at LimitBreak and they quickly paused Payment Processor V3, which was subject to the same exploit. Unfortunately, V2 was not pausable, so the only path towards protecting affected assets was to run a whitehat operation. Similarly, V3 on ApeChain is temporarily in a state where it cannot be paused, so ApeChain assets approved to V3 needed to be saved as well. All in all, we rescued 23,155 NFTs worth north of $5.7M USD. We later discovered that a similar exploit could be used in reverse to steal WETH. 660 WETH was at risk, which we unfortunately were not fast enough to recover. Apologies to those affected. Shout out to @Boomskite for flagging the initial exploit tx to me, and @coffeedev @0xjustadev and @whiteoakkong for acting quickly and assisting with the recovery. All NFTs are safely relocated. Soon, owners will be able claim them back after revoking the exploitable approvals. Addresses to revoke below.
664
642
349
3,215
518,939
0xvagabond.base.eth(base/eth) retweeted
Replying to @aaakasei
Likely got rugged by another person this month I recovered $275K stolen by Indian call scammers. Have been ghosted for 4 weeks about my % while they’re active on X. Since June 2026 it’s now been three people rugging me for ~$100K total reward…. Has ruined my motivation to reply to cold messages and only reply to referrals from strong mutuals.
173
70
21
1,570
129,478
Hey @grok, you've seen my work aaround unclaimed funds nd sure I'd appreciate if you can vouch me into @evan_van_ness dms.
52
0xvagabond.base.eth(base/eth) retweeted
Frontrunning attacks: simplified. Full guide is in the first comment.
2
2
12
880
0xvagabond.base.eth(base/eth) retweeted
🧵 The first mistake in a DFIR engagement often isn't in the investigation. It's in the access. Choose the wrong entry method and you risk alerting the attacker, corrupting evidence, or missing artifacts entirely before the investigation has even started. Access isn't a formality. It's the foundation every finding will be built on. Get it wrong and the rest doesn't matter 🔎
2
1
1
6
1,395
Don't give them the airtime, they'll end up farming us.
Hey @opensea if you were waiting for the right time to drop your token it’s probably now 😅
1
92
0xvagabond.base.eth(base/eth) retweeted
I considered whitehat hacking it - with the project being dead it was unlikely we would get a response from their team, and given how trivial the bug was to exploit, I wouldn’t be surprised if it gets hacked at some point. 🧵(7/15)
1
1
5
771
Zach said we should dump the hardware wallets and go for an iPhone and sure, he was right. But for those expecting to be spoonfed: don’t go around installing random apps on that phone. Treat it like a hardware wallet, not a hoe-like device that connects to anything that comes knocking.
⚠️ALERT: An app called FomoPeek has been caught stealing private keys and seed phrases from iPhones. SlowMist says versions 1.1 to 1.2 contain malicious code that exploits iOS vulnerabilities to gain the highest level of device access. Once the exploit succeeds, wallet data, login credentials, chat history and files from ALL apps on the device can be accessed. Binance is urging anyone who installed FomoPeek to delete it immediately, create a new wallet on a clean device and transfer all assets.
84
0xvagabond.base.eth(base/eth) retweeted
I've built my first functional saas @angelo_intel
1
2
3
127
0xvagabond.base.eth(base/eth) retweeted
i've since end of June posted many mini-episodes on @runwayseries and they've organically with no marketing from me worked surprisingly well runwayseries.co i'll post about them individually soon
2
1
41
0xvagabond.base.eth(base/eth) retweeted
Update on @YamFinance governance takeover The attacker executed proposal #45 and took Timelock admin. They then cut the Timelock delay from 5 days to 12 hours and made themselves gov of Yam's old UMA farming contracts. Calling _settleExpired() released the WETH collateral from their expired uGAS positions. The attacker then pulled everything out with the gov-only masterFallback function, which lets the gov make any call from the contract. Extracted (~$121K): • UMAFarmingMar (uGAS-MAR21): 23.50 WETH + 763 UMA etherscan.io/address/0xffb60… • UMAFarmingFeb (uGAS-FEB21): 24.59 WETH etherscan.io/address/0xc0AE1… The proceeds (48.15 ETH) were cashed out via FixedFloat.
Community alert: Defimon detected a governance takeover attempt of @YamFinance Attacker self-delegated ~504K $YAM (~3.3% of supply, just over the quorum) and submitted YamGovernorAlpha proposal #45 with an empty description ("0x"). The single action calls setPendingAdmin(attacker) on the YAM Timelock. If the vote passes and executes, the attacker becomes pendingAdmin and can acceptAdmin to seize full control of the Timelock - admin of all YAM protocol contracts and the DAO treasury. There is ~$337K at risk. The protocol is dormant, so if you hold YAM vote against before block 25897343 (around 34 hours left). TX: etherscan.io/tx/0xf3c9b1d709… Attacker: etherscan.io/address/0x26881…
5
4
3
35
7,462
0xvagabond.base.eth(base/eth) retweeted
SQL injection is great, but what if you can't see the response? Enter Blind SQL Injection! In this walkthrough, we exfiltrate the administrator's password from the database from a blind SQLi using DNS 👀 Check it out, and follow along here (it's free) 👇 portswigger.net/web-security…
2
14
111
6,653
0xvagabond.base.eth(base/eth) retweeted
Shout out to @ambire @BitgetWallet & @metamask for protecting users from Address Poisoning Attacks. Hopefully other wallets can follow suit and these people can stop spamming our networks.
I tested 9 wallets if they would detect an address poisoning attack. Only 3 warned me about the potential poisoned address. ☠️ Which wallets warned me, which didn't, and how should wallets warn users when they detect an attack?
1
6
50
1,911
0xvagabond.base.eth(base/eth) retweeted
shoutout to 2018 meta transactions
Here's a guide @austingriffith wrote on how to do this, and links to the implementation from August 2018 medium.com/@austin_48503/eth…
3
1
31
3,762
0xvagabond.base.eth(base/eth) retweeted
🧠 Most defenders assume owning a child domain keeps an attacker contained. It doesn't. Learn exactly how Domain Admin becomes Enterprise Admin without cracking a single password 👉 tryhackme.com/room/childdoma…
2
1
65
10,405
0xvagabond.base.eth(base/eth) retweeted
bitcoin just set the bounty for exploit first, report and return later at 15%. bounty on reporting without exploiting most btc projects is………$0. lol.
3,400 BTC just returned to the liquid federation. Looks like ~600 BTC stayed behind.
22
35
9
462
46,070