Web3 Cybersecurity | $300M+ in Crypto Recovered Security Risk Management, Threat Intelligence, Incident Response
Joined March 2024
- Tweets266
- Following50
- Followers6.6K
- Likes67
Pinned Tweet
North Korea stole $6B from Binance this past week.
Our lead engineer was one of the first to spot it and pushed early for the call to Tether while funds could still be frozen.
Thank you to @tayvano_ and @Unchained_pod for the shoutout.
Proud of our continued partnership with @1inch 🤝.
They’ve integrated TIPzs into their illicit funds screening stack, setting a new standard for detecting high-risk asset flows in DeFi: a unified feed from independent contributors, refreshed every few seconds, so high-risk swaps can be blocked before funds leave users’ wallets.
Sign up for the platform: zeroshadow.io/services/threa…
If you want to catch stolen funds, you need to move fast.
1inch has integrated @zeroshadow_io's TIPzs: the threat intelligence platform that helps us block illicit addresses within 2-10 seconds of verification.
The result? More victims get their assets back.
It’s the latest addition to the best risk-control and user protection stack in DeFi.
zeroShadow retweeted
If you want to catch stolen funds, you need to move fast.
1inch has integrated @zeroshadow_io's TIPzs: the threat intelligence platform that helps us block illicit addresses within 2-10 seconds of verification.
The result? More victims get their assets back.
It’s the latest addition to the best risk-control and user protection stack in DeFi.
Join the discussion at STG-3 Online Symposium: The Binance Hack What We Know
Our CEO Casey with @AvishaiY, @sodabubblelabs) and Dan Danay (Verdict Machine) to talk through how it happened, how the industry responded, and what it means for your own firm.
- How the attack unfolded, from one compromised engineer's laptop to funds moving across ten blockchains
- The response: on-chain freezes by stablecoin issuers, Binance covering customer losses, and what recovery really looks like
- Why the same attackers keep getting in, and what to change now: keys, people, data and AI
5 November, 2:00 PM UK / 9:00 AM EST. Online, 60 minutes, with open Q&A.
Part of the STG-3 Online Symposium, Cyber security, partnered with @XDCNetwork
Register: portal.stg-3.com/events/bina…
🚨If you are ever targeted in a wrench attack or threatened with physical violence for your crypto: comply.
Your life is more important than your assets.
Once you are in a safe place, speed is everything.
Call the police immediately, then contact @SEAL_911 on Telegram t.me/seal_911_bot.
Share the transaction hashes and attacker addresses as fast as possible so they can trace the movement and relay the data.
In a recent incident, this sequence made all the difference.
A victim was subjected to a violent robbery and had their funds stolen.
Once they reached safety, they contacted SEAL 911 with the transaction details.
SEAL verified the incident and pushed the attacker addresses directly into TIPzs, zeroShadow's threat intel platform that feeds live incident data straight to exchange screening systems.
Seconds later, the criminals attempted to swap the stolen assets at an exchange.
Because TIPzs pushes threat data to connected platforms in under two seconds, the intelligence landed ahead of the deposit.
The exchange caught the incoming transaction and froze the funds on arrival.
SEAL 911, zeroShadow, the exchange team, and law enforcement are now coordinating to follow the legal process and help the victim recover their assets.
Prioritize your physical safety first.
After that, fast reporting is what makes intercepting and freezing the stolen funds possible.
Thank you to SEAL 911, the exchange team and law enforcement for working together with us and showing how the private and public sectors can work together and do our part to effectively help those who are victimized and deserve all the help they can get.
🧵Bitget suffered not one, but two zero-day exploits during their 24th September hack of $387M USD. Although further details may yet arise, the use of a zero-day exploit shows a growing sophistication in the way that DPRK target victims and extract value. Is Web3 security doomed? [1/3]
We reported the increased use of supply chain based attacks in our March 2026 blog post with Sodot (now @moonpay), noting at least 53 attacks using a third party access point in 2025. That trend has not only continued but grown. Besides Bitget, notable other entry points this year included the HTTP client from Axios in April and Gnosis Pay on Safes in June. [2/3]
Teams should focus on strengthening detection, containment and operational resilience to minimize the impact when preventative controls fail. With these practices in place, you can do a lot to harden your security posture against zero-day threats. Read our blog for specifics zeroshadow.io/blog/bitget-ha… [3/3]
Huge thank you to all our TIPzs network partners who are working around the clock to support Bitget in their hour of need.
This anonymised chart represents thousands of direct blocks executed across our network to help protect the ecosystem. [1/5]
Our friends at Chainflip nitter.gq/SavcatEth/status/21048… and NEAR Protocol nitter.gq/AlexAuroraDev/status/2… have already shared their frontline work.
Seeing engineering teams mobilize to protect Bitget for no financial gain shows what true community defense looks like. [4/5]
TOKEN2049 Singapore 🇸🇬
We're excited to be on the ground for one of the biggest events of the year.
See you there 👋
zeroShadow retweeted
20 BTC returned 🎉
A lot of moving parts between @SEAL_911 @zeroshadow_io @D_A_R_TRescue and an anonymous whitehat who is real MVP here. steptoe.com/en/news-publicat…
zeroShadow retweeted
Compromised by 🇰🇵: December 2024
Telegram taken over: August 2026
Going 20 months undetected is a new record for me. It's crazy how long these guys will wait.
Props to @_clemens__ for spreading the word to protect others 🤝
I have been hacked by the DPRK. Here's how it happened:
In December 2024, a contact that i had met in person several weeks earlier messaged me on telegram asking for a meeting, just like my fake account is now doing. Upon joining the call, the audio wasn't working and then my contact pinged me to update my video call software (Microsoft Teams, which i usually never use), as soon as I clicked that link, my entire device was compromised.
Text book social engineering and urgency in a key moment were all that was needed to get comfy on my device. Although I deleted all files and did several malware sweeps, I did not fully factory reset my device.
21 months later, this piece of malware became active and took over my PC and the result is 8 years of telegram history and contacts now in the hand of a group linked to north korea.
I sincerely hope none of you have tried joining any of the calls with "me" or worse fallen into their trap. A huge thank you to @tanuki42_ who has been tracing this groups activities and has been extremely helpful in getting my compromised accounts deleted after telegram support proved useless.
If you think this couldn't happen to you, here is who you are dealing with: nitter.gq/tanuki42_/status/20975…
securelist.com/bluenoroff-ap…
zeroShadow retweeted
15 firms are undergoing accreditation with SEAL Certifications and taking on audit engagements right now — smart contracts, incident response, treasury security, multisig ops, and more!
If your protocol hasn't scoped an audit yet, reach out directly to a Certification Partner today:
securityalliance.org/our-wor…
@AdevarLabs @audit_wizard @BlockSecTeam @chain_security @Composable_Sec @ConsensysAudits @DefiSafety @hackenclub @HackenProof @SecurityOak @opsek_io @sigp_io @Wonderland @zellic_io @zeroshadow_io
Over 50 BTC from the ColdCard Exploit was rescued by whitehats and was since deposited into the Crypto Recovery Trust, a purpose-built Wyoming statutory trust created and advised by national security attorneys at Steptoe LLP.
If you were a victim of the exploit, please check if your wallet qualifies for recovery via cryptorecoverytrust.com/
Read the full details at
assetrecovery.io/blog/coldca…
