bock @bockus

The LLM subsidy trap is currently playing out exactly like Uber once did. Right now, we're all enjoying "cheap" AI: ChatGPT, Claude, Gemini, Grok, and LLMs that feel almost too good to be true. That's because all of these LLMs are bleeding tens of billions in losses, heavily subsidized by VC and investor money. They're not running a sustainable business yet; they're running a land grab. Just like Uber: Flood the market with artificially low prices. Burn cash to onboard users and crush or marginalize competitors. Uber killed traditional taxis and mini cabs. LLMs are killing entry level creative positions and other jobs. Once dominance is locked in and the weaker players are gone or acquired the prices won't just normalize, they explode past pre-disruption levels. When the AI hype bubble cools, the cheap rides end. Expect LLM inference, API calls, and premium models to get significantly more expensive. The subsidies dry up, compute costs remain brutal, and the winners will price for profit (and then some). The "free/cheap" tier? It will get rate and time limited to uselessness. The winner that survive won't be the most "open." It will be the ones who captured the largest part of market. If you're building on AI tools or relying on them for your business, you need to be ready for this spike. Plan for the post-subsidy world now. The race to AGI (or AGI-adjacent products) is expensive. Someone will eventually have to pay. Spoiler: It's going to be users and enterprises. By that I mean the users.

The deprecated project @aztecnetwork got hit again just days after the first exploit. Interestingly it appears the new hack used a different mechanism.

thisvishalsingh 🪐 Security Researcher @thisvishalsingh

12 hours ago

🚨 Another hit on @aztecnetwork ~$2M ETH just drained from the Private Rollup Bridge. This is a separate incident from the $2.1M drain on the deprecated Aztec Connect contract a few days ago. --- From what I'm seeing, this isn't your typical sloppy reentrancy or obvious

11 11 87 8K 53

@alexhall3 You really are a man of the times!

@czamaru @andrewjscott @7pcventures

@pashov I like breaking things :-D

Immutability is frequently hyped as a core security feature in Web3 and smart contracts. This is routinely pitched as "code is law": once deployed, no one (not even the devs) can tamper with it, rug pull, or silently change rules. For tokens or small anonymous or decentralized setups, this prevents unauthorized modifications, and makes the execution tamper-proof. It's marketed as protection against fraud, backdoors, and centralized control. You'll see this language everywhere: audits, project announcements, marketing ("immutable contracts = maximum security"), and educational content. It's one of the foundational selling points of blockchain. That said, it's a double-edged sword. As we've seen in exploits (like the recent Aztec one) reported by @BullishTimes_ , immutability also locks in bugs forever with no easy fix, which is why upgradeable proxies and other patterns exist, and why audit staleness is a real problem for mutable contracts.

Bullish Times @BullishTimes_

3 days ago

Dead protocol. Live funds. $2.19 million gone. Aztec Connect — a DeFi privacy bridge shut down in March 2023 — was exploited yesterday for $2.19M. The attacker drained 909 ETH, 270,000 DAI, 167 wstETH, and other tokens across seven separate withdrawals. Here's the kicker: Aztec

12 4 10 244 5

@BullishTimes_ Immutable is great for simple tokens, for defi... not so much. No audit can catch everything, novel exploits are discovered all the time. Cyber security is an arms race.

@bosforsafety We have seen a rash of account hacks using this method, then sending malicious meeting links through telegram. This is an excellent post.

@crypgpt_token Risk on cold wallets are minimal only if used correctly with proper opsec in place :-D Stay safe peeps.

@afrochicksnft Killin' it, a definition :-D

In DeFi, a bad upgrade is a loss of funds. In identity, a bad upgrade costs you the user. Soulbound tokens don't transfer. They don't get rewritten. One bad init or upgrade path = permanent damage. Last month we shipped an audit of @sumvin 's soulbound identity contracts. 5 focused passes. ~290 lines of Solidity. 9 findings (0 Critical, 1 High). Low risk overall. Full regression test suite delivered with the report. If you're building identity, attestation, or any issuer-controlled protocol: don't ship blind. Get an audit that ships runnable tests, not just a PDF. Full breakdown in the images.

keyboard_arrow_left Previous keyboard_arrow_right Next

Has anyone played with GLM-5.2 yet? The bench marks look insane and @newsycombinator is reporting the open source model is Zhipu's most capable open-source model to date. news.ycombinator.com/item?id=485186…

We are seeing more web3 devs that are vibe coding entire projects using the latest Claude models. While the models are improving and this looks like a win on the dev side, it carves massive security holes in their stack. Failing to grasp core concepts like access control, bridge verification, or proper key management. Opsec pitfalls get baked in from day one. Config drift, weak assumptions, and blind trust in generated code turn into exploits waiting to happen.

@Fidesiumapp has just completed a full audit for @sumvin Zero Criticals. One High. Low overall risk. Clean, conservative architecture with UUPS upgrades, Safe multi-sig governance, and ERC-7201 storage. We ran our multi-pass framework: protocol mapping, storage flows, inheritance checks, cross-verification, and adversarial modeling. Turned every finding into regression tests. Result: production-ready with guardrails locked in. Read the full breakdown: upgrade safety, deployment hygiene, and why this matters for issuer-controlled primitives.

bock @bockus

a week ago

x.com/i/article/2065…

0 1 3 208 0

x.com/i/article/2065…

Bug bounty platforms will need to up their filters. I have a feeling they will get an influx of submissions this weeks to any open contests. Would love if @HackenProof or @sherlockdefi decided to share numbers!

Claude @claudeai

a week ago

Introducing Claude Fable 5: a Mythos-class model that we’ve made safe for general use. Its capabilities exceed those of any model we’ve ever made generally available.

5K 15K 105K 56.3M 22K

@CapinUK @solana @SuperteamUK @solanaEvents @LDNTechWeek @fabric_vc @wintermute_t @SuperteamTalent @Collector_Crypt @bonk_inu @hackerhouses I think it was mostly the dice! They were so good someone stole 2 of them :-)

@LDNTechWeek day two with @solana Vibe is still strong, sun is out, londonmaxing still works.