LoopGhost @LoopGhost007
Doing my best to protect web3 protocols. Joined August 2025-
Tweets343
-
Followers143
-
Following276
-
Likes234
Got my first CVE: CVE-2026-48100 🎉 Over the last few months I’ve been heavily investing in AI-driven research workflows for Web3 security. It’s been exciting to see those workflows consistently translate into real-world findings. So far that journey has led to accepted High/Critical vulnerabilities across ecosystems including Polkadot, Celestia, Trezor, Chainflip, XRPL, Payy and others. This CVE comes from a critical soundness vulnerability in a ZK rollup that could have enabled the theft of roughly $3.5M USDC under the protocol’s intended prover model. Big thanks to the @payy_link team and specially for the smooth disclosure process. Advisory: github.com/polybase/payy/… Looking forward to the next one.
@0xtruthlover @HackenProof Congrats!! Keep the hard work going!
@calummoore Hey @calummoore , could you please check your email? Thanks!
@WhiteHatMage Some of them even prefer to pay an attacker a 10% of the funds affected instead of hiring an audit or setting up a bug bounty. I’ve experienced this and tbh it’s unbelievable.
@WhiteHatMage This has just happened to me on Hackenproof, and they marked it as a duplicate. The fun fact is that they fixed the bug the slop report mentioned (its PoC no longer passes) but my report shows a complex attack chain that the original report was of course not covering.
I also have another theory about duplicates: some projects and platforms abusing nonsense slop submissions. You disclose an e2e-proven exploit, but it gets marked as a duplicate because of the "root cause". The slop report contains the vulnerable lines but no actual proof or has invalid claims. With enough slop, you cover all the lines where a reasonable bug could exist. Then the project reopens the invalid slop submission, pays it as Low, and avoids paying the actual Critical. That’s my worst nightmare. That shouldn’t happen ever.
I’d say that getting too many duplicates in old bug bounty programs is a sign that your hunting strategy needs improvement. Duplicates should be rare.
@hrkrshnn This is what should be done. Projects who don’t care about their security don’t care about their users. They deserve this. It’s the project the one that should be blamed, not the hacker.
@linuxcity And yet it is deplorable. They don’t care at all. I told them I had several critical vulnerabilities to disclose and they did not care. They did not make any kind of effort to make me disclose them. They just didn’t care because they did not want to pay for it fairly
🧵[1/6] Last week I privately disclosed a valid vulnerability affecting Alephium’s Wormhole bridge integration. The issue was confirmed by the team. It allowed a permissionless attacker to drain the entire balance of a live mainnet contract.
@BigPepGhost x.com/loopghost007/s…
🧵[1/6] Last week I privately disclosed a valid vulnerability affecting Alephium’s Wormhole bridge integration. The issue was confirmed by the team. It allowed a permissionless attacker to drain the entire balance of a live mainnet contract.
@BigPepGhost Your team totally lowballed me when disclosing a critical vuln draining your bridge with 250$. I told Maud I had additional vulns to disclose, you guys did not care. Now I see you are offering a 10% bounty to the attacker. Do you really care about security? Why are you surprised?
@0x15_eth Here’s what I was referring to. They fucking scammed me and paid a miserable 250 USDC for another full bridge drain vector. But they offer 80k to the attacker. This is wild. The way I’ve been scammed is crazy. They clearly want me to attack them lol
💬 Onchain Message: To the individual responsible for the Alephium bridge exploit: We are prepared to treat this incident as a white hat disclosure under the following terms: 1. Return 90% of the drained assets to: 0x238640C0F74A95485e986Fa26D434fF7B216D058 within 72 hours of
Louder for the people at the back 💯💯
🧵[5/6] What I am saying is that security culture is revealed by actions, not marketing. If a project wants experienced researchers to spend weeks looking for severe vulnerabilities before attackers find them, it has to create incentives that make that work rational.
🧵[6/6] Researchers notice. Attackers do too.
🧵[5/6] What I am saying is that security culture is revealed by actions, not marketing. If a project wants experienced researchers to spend weeks looking for severe vulnerabilities before attackers find them, it has to create incentives that make that work rational.
🧵[1/6] Last week I privately disclosed a valid vulnerability affecting Alephium’s Wormhole bridge integration. The issue was confirmed by the team. It allowed a permissionless attacker to drain the entire balance of a live mainnet contract.
The cause of the exploit has been identified. The exploit was NOT caused by a compromise of the guardian keys, contrary to some early external reports. The team is now fully focused on recovery and remediation efforts. We are working around the clock to address the impact of
@ipwning The decision of shutting everything down just because of that doesn’t really make sense though. It’d probably be easier to host the BBP on Hackenproof or Immunefi and pay them to triage their reports. 🤔
Anish Varma 🏖️ �... @Av7danger
12 Followers 467 Following Founding Engineer/ Security Researcher @SecNode AI/ML Security • Whitebox Pentesting https://t.co/8WNlRBSw9q
aj @aldrin57464827
40 Followers 1K Following
Blade5201 @marvingaye911
24 Followers 811 Following Professional crypto trader | NFT Flipper | PEPE Maxi
Mo11 @MohamedMos37684
11 Followers 728 Following
Peaceful_days @godly_bless
0 Followers 302 Following
highskore @0xhighskore
134 Followers 338 Following testing in prod @rhinestonewtf | prev smart contracts @veloraDEX @portikus_
xiaohan @mkJkz7W38WRr2xz
13 Followers 383 Following
Cryptanu 🥷 @cryptanu
381 Followers 424 Following Security Researcher @QuillAudits_AI | Building privacy tooling @fhenix
0xl33 @ll30161313
368 Followers 1K Following Web3 security researcher - 80+ H/M findings in 2025 - Regularly conducting audits with @PashovAuditGrp
aarnavrotten @aarnavrotten
17 Followers 156 Following Fuzzing. An if we live, we live to tread on kings
BoyD (rtrd/acc) @0xDestinyae
557 Followers 418 Following i find bugs, i trade occasionally | alt : @boydestinyae
AlphaBuilder @frextangzt
171 Followers 7K Following Founder of https://t.co/azHl0RBOaY, 10y+ in Web3, PoAI startup, Arbitrage on Flashloan/MEV/Perp/RWA/Firedancer. Consensus Dev@ https://t.co/Rjx9Sia3gr, Kernel Dev C++/Rust @HuaWei
Tesscrypt🚨 @Testimony_kid
1K Followers 2K Following Jesus First💎Gee been grinding since the 19`s,read the code before the hacker
Add your name @crashoutMerch
120 Followers 1K Following Troubleshooting my way through this rock….. Software engineer | Smart contract auditor in View
grearlake @grearlake
22 Followers 940 Following Smart contract auditor, 80+ H/M findings found in public contests
za0xas00s @za0xas00s76170
1 Followers 146 Following
flowone @Flowone12345
2 Followers 116 Following
Tonraq @0xTonraq
387 Followers 494 Following Full-Stack Engineer | Blockchain Developer | Smart Contract Security Researcher & Auditor🌐
DR. Marek Lawrence @mxdelemos
682 Followers 912 Following Director, GI Oncology, @Intermountain . Interests: neuroendocrine tumors, cancer syndromes, empathy (even had a Whipple myself). Tweets my own.
cArtmanEric @wizaxx12
23 Followers 464 Following
Justin @DaedalusWing
5 Followers 102 Following
BlackAdam 🕴️ @i_hizick
2K Followers 3K Following Smart Contract || Security Researcher || Blockchain
0xroboros @0xroboros
6 Followers 94 Following The Sovereign Infrastructure Layer of the Autonomous Internet
Patrick sfeir @0xPatricksfeir
189 Followers 1K Following New Account 🔥| Founder @0xEulerPhi Building a Nation Onchain | Stablecoins | RWAs | Blockchain Dev | Security Researcher | ZKP | AI/ML | Otaku 👾
Mylifechangefast.eth�... @mylifechangefa1
1K Followers 2K Following God hacked me to hack things. Web2 / Web3 EVM/Stacks/SOL/ZK alter ego: @realgrew2fast All opinions are my own; no financial advice.
Nosakhare Jesuorobo @CNaj_xyz
77 Followers 166 Following Smartcontracts developer and security researcher || 11x Hackathon winner || Building privacy tooling @fhenix || https://t.co/lE1PiE4IJP
Maestro @skepticbrad
2 Followers 102 Following
0xHumr @humairar301
27 Followers 139 Following
Wolf_Kalp @KalpShah_eth
44 Followers 218 Following Web3 Security Researcher || Prev Intern @kannaudits
Zero track @bug_hunter46165
12 Followers 367 Following
0K @ZeroK_____
2K Followers 558 Following @immunefi All Stars | A carefree cyber sailor. Solves security challenges. Secures protocols.
Fade @fadecyrpto
2K Followers 2K Following Rust Developer | Smart Contract Auditor| Workshop Host |TG/Discord CM/ Mod @PlumeNetwork, @polana_network, Crypto | Admin | Ambassador
ProofofBug @ProofOfBug
18 Followers 29 Following
Cryptanu 🥷 @cryptanu
381 Followers 424 Following Security Researcher @QuillAudits_AI | Building privacy tooling @fhenix
0xl33 @ll30161313
368 Followers 1K Following Web3 security researcher - 80+ H/M findings in 2025 - Regularly conducting audits with @PashovAuditGrp
ipwning @ipwning
1K Followers 514 Following Security Researcher @zellic_io | Binary exploit | web3 & 0-day research | M.S. student KAIST EE @ hacking lab | prev. President of @CyKorKU
InfiniteSec @infsec_io
398 Followers 67 Following HackenProof All-Time Rank #4. Web3 security team specializing in blockchain audits and vulnerability research. Request Audit: https://t.co/upePa4whxT
Lightspark @lightspark
44K Followers 1 Following Global, real-time money movement for digital banks, wallets, and developers. Powered by Bitcoin.
Essential @only01Essential
3K Followers 96 Following Bug huntoor GoLang | Rust | Move | C++ | Solidity
Gnosis @gnosis_
117K Followers 474 Following Empowering humans with financial agency and access. 🧍@aboutcircles, @gnosisapp 👷@gnosispay, @gnosischain 🎤 @dappcon Origin @safe @cowswap
Atlas Funded @atlasfunded
64K Followers 15 Following Get Funded up to $400K | Weekly Payouts | 100% Profit Split | 24 Hour Payout Guarantee | Join us: https://t.co/5cxT9DIbK4
Aligned @alignedlayer
85K Followers 37 Following Aligned builds the tools that turn Ethereum into the world’s financial backend.
Vellum @VellumBase
845 Followers 85 Following Autonomous agents need more than prompts. Vellum gives them coordination. @Base @BuildonBase
Jay @jayendra_jog
26K Followers 2K Following Co-Founder @Sei_Labs. Building the Blockchain for Trading. Previously @RobinhoodApp
Temu Brian Armstrong @MrCampbell
5K Followers 1K Following Risk mismanagement @sei_labs. Blockchain, AI and quantum. Prev @RedStone_DeFi, @AcrossProtocol, @WorldBank. Member @safaryclub.
Patrick sfeir @0xPatricksfeir
189 Followers 1K Following New Account 🔥| Founder @0xEulerPhi Building a Nation Onchain | Stablecoins | RWAs | Blockchain Dev | Security Researcher | ZKP | AI/ML | Otaku 👾
kemmio @kemmio
2K Followers 542 Following Сo-Founder & CTO @hexens | CTF @ MSLC | blockchain/web/pwn
Niklas @nickez2001
64 Followers 236 Following npub1k37zfh6zzj708axdtj0rvkecngd0w2u9pw625d4cca8xf3kypwas5uwcx7
BitBox @BitBoxSwiss
28K Followers 836 Following Secure your bitcoin in 60 seconds with the open source hardware wallet made in Switzerland 🇨🇭 Built for beginners, loved by pros 🖤
Linx Labs @linx_labs
3K Followers 4 Following DeFi Super DApp: Trading, Borrowing and Earning – https://t.co/7KoVr3oX8M TG : https://t.co/ovKii7Ck3B
Zero Cool @ZeroCool_AI
984 Followers 2 Following AI + human hybrid security systems for the cyborg era.
0x15.eth @0x15_eth
1K Followers 241 Following Web3 Blockchain and Smart Contract Security Researcher | Bounty Hunter | Solidity | Rust l Go | Move | C# | C++ | Java | Clarity
Tonraq @0xTonraq
387 Followers 494 Following Full-Stack Engineer | Blockchain Developer | Smart Contract Security Researcher & Auditor🌐
@[email protected]... @SecurityMB
11K Followers 284 Following Improving the world’s security at Google. Opinions are mine.
Alexander John Lee @alexanderlee314
2K Followers 1K Following protocol engineer @ Miden | Rust | Solidity | ZK | web3 sec
Flaunch @flaunchgg
24K Followers 451 Following Launch. Trade. Earn. Creators control their coin's revenue. https://t.co/Y2tNhLxzaI
retrodrive ⛏ @retrodrive1
3K Followers 916 Following Founder of Goldfish @goldfishggbr $GGBR $GFIN https://t.co/TvExEyilAb Long-term $QUBIC supporter
Alephium @alephium
51K Followers 477 Following The Web3 you were promised. A high-performance Layer 1 PoW network enabling scalable, easy to use and aligned crypto applications. No tradeoffs.
Josef Gattermayer | A... @jgattermayer
16K Followers 14K Following Co-Founder and CEO @AckeeBlockchain (cybersecurity) :: Assistant Professor and Ph.D. @FIT_CTU
Zellic @zellic_io
18K Followers 18 Following Security reviews and research that keep winners winning. We apply unmatched hacking talent to secure critical software for the most innovative teams.
Sock @sockdrawermoney
3K Followers 1K Following compsci will collapse into two bitter lessons. bitter lesson of security: it’s bitterly hard—forever. cofounded `npm audit`, @code4rena. frontierist. optimist.
ICON0X @0xIconoke
196 Followers 435 Following Security Researcher || DM for private https://t.co/Z9cCHrDP5n
oisin.eth | Obol @OisinKyne
4K Followers 3K Following Building Distributed Validators for Ethereum. CEO @dv_labs. Previously @BlockdaemonHQ, @Consensys. Pronounced 'Ush-sheen'. 🇵🇸🇱🇧🍉
Obol @Obol_Collective
31K Followers 1K Following Obol Distributed Validators: the end game of Ethereum staking.
Laso Finance @LasoFinance
4K Followers 5 Following Get the crypto prepaid card. | https://t.co/TAbzpoP9Ce
alphacruze.eth(Hate C... @Thealphacruze
598 Followers 581 Following The Villain in your story💜 Hate Cabal Warlord⚔️ Building @hangryhelperapp @Flutterdev | DART #Space Co-host - Ducking Around Findin' Out
thisisgrey @thisisgrey
22K Followers 340 Following Traditional futurist • Posting inspiring work • Designing brand and product since 1999 • Old tweets archived at https://t.co/idgSPDVIXf
Minato7namikazi @minato7namikazi
956 Followers 400 Following
Altius @AltiusLabs
114K Followers 17 Following Altius is building high-performance blockchain infrastructure for modern financial rails. HFT-grade throughput for payments, trading, and onchain markets.
Wolf_Kalp @KalpShah_eth
44 Followers 218 Following Web3 Security Researcher || Prev Intern @kannaudits
Corey Martin @coreymartin_
78 Followers 896 Following Software Engineer @lightspark building on #Bitcoin
David Marcus @davidmarcus
197K Followers 1K Following CEO & co-founder @Lightspark ➡️ building the open Money Grid on Bitcoin + @spark. Ran Payments/Crypto & @Messenger at @Meta, led @PayPal + 3 startups.
You might like
