CypherTalk

Griff Green is back, about six months after his first appearance, and this time Jade and co-host Stefan Beyer get him talking about communal security and where TheDAO Security Fund has got to. Griff runs the fund, founded Giveth and DappNode, led the original DAO white-hat cleanup, and sits on the Arbitrum and ENS Security Councils.

The line that sticks from this one: private keys are crypto’s original sin. Griff doesn’t hold back on it. It’s 2026, everyone’s been hacked, and the way we still onboard a new person is a raw private key and twelve seed words, where one bad click and it’s all gone. No bank works like that, because nobody would want it to. What he wants instead is vaults, smart-contract wallets, MPC setups like Turnkey (which Giveth now uses), things with daily limits, allowlists and an escape hatch if you get hacked. Non-custodial, but actually safe. He argues crypto could even be safer than a bank, because it can get rid of custodial risk entirely.

First though, the fund. Round one handed out over $1.6M to 135 projects through quadratic funding, and the big lesson was how many people wanted to chip in for security, and how much they left on the table simply because they didn’t give themselves enough lead time to fundraise. So round two is built differently. Funding comes out against milestones, at least a third of every budget is tied to actual adoption, and an initiative has to raise 25% from the community before it can touch the DAO’s ~400 ETH. Then 200 Ethereum security badge holders vote on what gets funded using participatory budgeting (Stefan, to Griff’s disbelief, didn’t make the badge-holder cut). The whole design is about beating the free-rider problem: only fund the things the community actually puts money behind. The initiatives range from a privacy-preserving EDR tool to a service that screens job applicants for North Korean operatives.

Then they get into the pound of cure. Griff walks through the KelpDAO exploit, how a LayerZero/RSETH issue let likely North Korean attackers borrow around $71M against duplicated collateral on Arbitrum, and how the Arbitrum Security Council stepped in with an L1 transaction to freeze it. He can’t discuss the internal debate (there’s an NDA), but he’s completely open about where he stands: on “code is law” versus stepping in, he’s an extremist, if you can stop North Korea walking off with $71M, you do it, every time. From there it widens out into the legal headaches that followed, why hackers now bridge funds off-chain to dodge exactly this kind of freeze, and a genuinely sobering stretch on how crypto’s weak security ends up funding real-world harm, from state actors to the scam compounds operating across Southeast Asia.

Key Topics

TheDAO Security Fund round two: milestone funding, co-funding as a filter, and badge-holder voting

The KelpDAO exploit, the Arbitrum Security Council freeze, and “code is law” versus intervention

Why private keys are crypto’s original sin, and the case for vaults and smart-contract wallets

Chapters

00:00 Introduction and Welcoming Griff Back

01:03 Griff’s Origin Story: The DAO, Giveth, and DappNode

04:11 TheDAO Security Fund: From the 2016 Cleanup to Today

07:21 Staking Rewards, Not Principal: How the Fund Works

09:51 Round One in Review: $1.6M, 135 Projects, and the Appetite to Fund Security

11:16 Why Round Two Is Different: Lead Time and Leaving Money on the Table

14:37 Solving the Free-Rider Problem: Co-Funding as a Filter

16:52 Adoption Milestones and Starting Small Businesses, Not Just Tools

21:05 How Initiatives Are Ranked: 200 Badge Holders and Participatory Budgeting

26:27 Real-Time Results and Leaning Into Community Signal

31:43 How to Get Involved

41:44 Shared Infrastructure: Why One Team’s Weakness Hits Everyone

43:05 The KelpDAO Exploit and the Arbitrum Security Council Freeze

49:19 The Legal Challenge and the Wider Impact of Intervention

53:03 Where Griff Draws the Line on Intervention

56:16 Is Crypto a Net Positive? Scam Compounds and Funding Atrocities

01:00:38 The Most Underfunded Security Issue: Wallets

01:04:32 Beyond the EOA: Vaults, Turnkey, and Smart-Contract Wallets

01:07:16 Hardware Wallets, Ledger Spyware, and Why Vaults Still Win

Resources and Links

Griff’s first episode: https://www.podbean.com/ep/pb-fzeke-1a801d4 

Griff on X: https://x.com/griffgreen

TheDAO Security Fund: https://initiatives.thedao.fund

SEAL 911 (Telegram): @seal_911_bot

Oak Security’s Research: https://research.oaksecurity.io/

Title: The Quantum Threat, and Learning to Love It, with Colton Dillion & Dr. Richard Carback (Quip)

Jade Doherty and Stefan Beyer speak to Colton Dillion and Dr. Richard Carback of Quip, the team building what they call the worldwide quantum computer. Quip is both a fix for the post-quantum problem and a marketplace monetising idle time on quantum computers, with quantum-resistant wallets that wrap existing ones on Ethereum, Solana, and a Bitcoin L2.

The heart of the episode is the timeline. Rick walks through how Quip’s Quantum Doomsday Clock lands on roughly March 2028, the collision of two underestimated forces: exponential qubit growth and error-rate reduction, which has crushed the estimated requirement from 20 million qubits to IonQ’s claimed 20,000. Stefan presses on how much is hype versus real threat in a field as closed as the AI labs, and it turns genuinely unnerving: a quantum break is indistinguishable from any ordinary hack, there are 6-7 million vulnerable Bitcoin addresses (including two Binance wallets holding ~$20B), and Colton sketches a plausible attack where someone quietly drains old whale wallets, buys puts, then reveals Satoshi’s coins have moved.

But why should you “stop worrying and learn to love the quantum.”? They make the case for defense-in-depth and hybrid signatures (where the fallback is never worse than today), why this is Y2K-like, a real deadline with no fixed date, likely a large no-op precisely because serious people are acting. They cover the roadmaps underway (Bitcoin’s BIP 360, Ethereum, Solana), looming government mandates, why insurance markets will price this before regulators, and the hard problem of upgrading not one chain but every bridge, oracle, and validator set.

Rick is clear that Quip is not a privacy project and isn’t inventing exotic maths, deliberately using vanilla, battle-tested constructions, because, as Stefan notes, real-world losses come from operational mistakes, not broken cryptography. The episode closes on Quip’s products (the bridgeless QuipSwap protocol Oak audited, proof of useful work, a quantum randomness function) and the brighter side of quantum: chemical modelling, materials simulation, and one day simulating the universe.

Key Topics

The quantum threat timeline, and why a break looks exactly like an ordinary hack

Hybrid signatures, defense-in-depth, and the migration problem across chains

Quip’s “worldwide quantum computer”: quantum-resistant wallets, proof of useful work, and the compute marketplace

Chapters

00:00 Introduction and Two Very Different Backgrounds

02:09 What Quip Is: Post-Quantum Fix and Quantum Marketplace

04:59 From a Defense Project to “Harvest Now, Decrypt Later”

07:04 The Quantum Doomsday Clock: How You Get to March 2028

08:36 Exponential Growth, Error Rates, and the Collapsing Qubit Count

12:43 How Much Is Hype vs Real Threat?

17:24 Are the Vendors Holding Back? The Secret-Facility Question

20:40 What It Means for Blockchains: Vulnerable Addresses and a Plausible Attack

23:30 Rescuing Wallets, Zero-Knowledge Seed Proofs, and Chain Roadmaps

25:16 The Missing Deadline: Why This Is Harder Than Y2K

30:51 Privacy, Built In From the Start

35:07 Selling Quantum Security Without Fear-Marketing

38:00 Quantum Resistance as an Insurance Policy, and Government Mandates

40:36 Can Decentralised Communities Fix This in Time?

48:33 Quip’s Products: Wallets, QuipSwap, Proof of Useful Work, QVRF

53:53 Open-Source Tools for Developers

57:21 The One Thing to Do in the Next 12 Months

01:01:00 Learning to Love the Quantum: The Upside

Resources and Links

Colton on X: https://x.com/cadillion

Rick on X: https://x.com/rcarback 

Quip Network: https://quip.network

Oak Security’s Research: https://research.oaksecurity.io/

Have you heard of Brave? Today we are joined by Kyle Den Hartog, a security engineer at the privacy browser. His path runs from penetration testing to self-sovereign identity to Web3, and that bridge between the Web2 and Web3 worlds runs through the whole conversation.

They start with how Brave made privacy mainstream: sane defaults and treating privacy as an emergent property that has to be fought for at every layer, with surveillance capitalism as the threat model rather than Tor-style maximalism. From there, why the biggest problems are no longer smart-contract bugs but browser and interface attacks, and a sharp point about domain expertise: crypto wallet teams often don't realise the browser already solves their problems (MetaMask's phishing list vs Safe Browsing, Rabby leaking browsing history vs hash-prefixing). It's also why Brave built its wallet into the browser rather than as an extension.

The most provocative stretch is Kyle's argument that Web3 is accidentally reintroducing cross-origin tracking. A wallet address is just a cookie: shared across sites on "connect," and far more revealing than any third-party cookie because it exposes where, when, and how much you spend. His fix is the thick client, moving transaction-building into the wallet so untrusted sites never receive the address.

The conversation then ranges across why zero-knowledge proofs aren't the panacea they're treated as (the "20 questions" problem), how ZK-gated compliance can recreate the gatekeeping Web3 set out to escape, why the early internet's lack of an identity layer was a feature, and a thoughtful take on age verification. Kyle closes on what Web2 and Web3 get wrong about each other, and his practical privacy advice beyond switching to Brave: a reputable audited VPN, then moving off the platforms that track you most.

Key Topics

How Brave made privacy mainstream, and the browser as the real attack surface

Why a wallet address is the new tracking cookie, and the "thick client" fix

The limits of zero-knowledge proofs, identity, and getting age verification right

Chapters

00:00 Introduction

00:35 From Penetration Testing to Self-Sovereign Identity to Brave

01:49 Making Privacy Mainstream: Sane Defaults and Emergent Privacy

04:34 The Brave Wallet, BAT, and Rethinking What the Infrastructure Is For

07:07 The Browser as Attack Surface: What Browsers Can Actually Do

10:06 Why Crypto Wallet Teams Miss What the Browser Already Solves

13:55 Why the Brave Wallet Is Built In, Not an Extension

16:02 Web2 Guy or Web3 Guy? Why Brave Over a Pure Web3 Protocol

19:05 How the Brave Wallet Compares, and the Pivot to Payments

21:56 How Web3 Is Reintroducing Cross-Origin Tracking

24:55 The Wallet as Cookie: Leaking Where You Spend Your Money

26:59 The "Thick Client" Fix

29:47 Are Zero-Knowledge Proofs a Silver Bullet? The 20 Questions Problem

34:20 Recreating Centralised Gatekeeping and the KYC Tension

38:27 Why the Early Internet Had No Identity Layer

42:00 Getting Age Verification Right: Moderation vs Who Decides

49:02 AI at Brave, and AI as a Tool

50:36 What Web2 and Web3 Get Wrong About Each Other

52:31 Practical Privacy Advice Beyond Switching to Brave

54:12 Where to Find Kyle, and What's Next for the Wallet

Resources and Links

Kyle on X: https://x.com/PryvitKyle

Kyle's website and blog: https://kyledenhartog.com

Brave: https://brave.com

Oak Security's Research: https://research.oaksecurity.io/

Jade Doherty and Stefan Beyer speak to Justus Hanna, co-founder and CEO of Grego AI, a bug bounty hunter turned founder building AI that finds vulnerabilities human auditors miss.

Justus's path runs from hacking Novell networks as a kid, to Bitcoin in 2011, to picking up bug bounty hunting from scratch after a Wall Street layoff. The turning point came when his future co-founder showed him a system that found a high-severity bug in Lido's dual governance module, at a moment when every other AI bug hunter was producing pure slop. What sold him: the AI found bugs humans couldn't, faster and cheaper.

He explains Deep Invariant Analysis as a proprietary harness orchestrating hundreds of specialised agents across many models, built to go five or six layers deep into complex systems and chain exploits a human would be very unlikely to reach. They tackle the big claims head-on: the $27.7M exploit prevented, the $250K bounty, why the protocol stayed unnamed, and the awkward truth that verifying an "AI-only" find still comes down to reputation.

On the anxiety every auditor feels, Justus argues the harness is the moat, precisely because it's model-agnostic, and there's a candid detour on frontier-lab hype and safety theatre. The episode closes philosophically: his vision of an always-on "security operating system", and his advice to researchers, don't skip the manual apprenticeship. Learn the craft from first principles, then use AI as a superpower on top. Be Iron Man, not obsolete.

Key Topics

AI-assisted vulnerability discovery, Deep Invariant Analysis, and the harness-as-moat

Verifying AI-found bugs, disclosure, and the incentive problem in bug bounties

The future of the human auditor, and security as an always-on operating system

Chapters

00:00 Introduction

00:24 From Novell Networks and Bitcoin to Bug Bounty Hunting

02:17 The Turning Point: Seeing Greg's System Find a Lido Bug

04:57 The Moment AI Beat the Human: Report Depth, PoCs, and Speed

06:29 What's Actually Different: Going Five or Six Layers Deep

10:58 Deep Invariant Analysis, the Harness, and Coordinating Agents

13:59 The 48-Hour Guarantee and the Human-in-the-Loop

15:43 The $27.7M Exploit, the $250K Bounty, and Verifying AI Findings

19:50 Bugs in Heavily-Audited Protocols: Is the Human Auditor Cooked?

24:39 Will the Models Eat the Harness? Why the Harness Is the Moat

27:26 Frontier Lab Hype, Safety Theatre, and IPO Incentives

28:24 The Vision: A Security Operating System Beyond Web3

31:52 The Attacker-Defender Asymmetry and Safeguards on Models

34:38 The Incentive Problem and Aligning White-Hat Rewards

37:09 False Positives, Slop, and Disclosure Bottlenecks

39:20 What a Major AI Lab Wanted to Know

41:02 The Role of Security Professionals in Two Years

45:22 The Apprenticeship Question: Learning the Craft Before the Tools

48:03 Training Juniors, CTFs, and Spotting AI-Generated Work

49:45 Where to Find Justus and Grego AI

Resources and Links

Justus on X: https://x.com/0xriptide

Grego AI: https://grego.ai

Oak Security's Research: https://research.oaksecurity.io/

Jade Doherty and Stefan Beyer speak to Lorenzo Sicilia, Head of Technology at the Arbitrum Foundation, whose path into crypto runs through ConsenSys, Casval, and Outlier Ventures.

They open with the distinction that shapes everything else: the Foundation is the steward and legal wrapper of the DAO, not the team behind the tech. Lorenzo unpacks how it ran the Arbitrum Audit Program on the DAO's behalf, vetting a shortlist of thirteen audit firms and funding early-stage teams, and gets into the hard parts with Stefan: the "rubber stamp" risk when a Foundation-blessed audit becomes a trust signal, the friction of re-auditing when each iteration costs $50K to $250K, and the brutal cost-per-line metric the program can now benchmark across firms.

On security responsibility, Lorenzo is precise: the Foundation has none in the formal sense. Incidents fall to a 12-member Security Council, elected and rotated by the DAO. From there the conversation turns to what keeps him up at night, the L1-L2 trust boundary and the bridge, and why fraud proofs through BoLD have improved the picture, landing on his own preference for "code is law" while acknowledging where reality forces harder trade-offs.

The technical heart is Stylus, Arbitrum's WASM environment for writing contracts in Rust alongside the EVM. Lorenzo is unromantic about it: a second runtime widens the attack surface, and while safe Rust has real advantages, no language removes the authorisation, economic, and oracle pitfalls that actually cause losses, treating any language as "safe" is a mental trap. The episode also covers the freshly-shipped ZK-on-BoLD upgrade, the road to real-time proving, and why AI currently hands the red team a big advantage over the blue team, though Lorenzo is optimistic defenders can turn the same tooling back on their own code.

He closes with hard-won advice: authenticity and persistence over a polished demo, understand your oracles and dependencies, get key management right, and know when to switch from "fake it till you make it" to full paranoia, because in this industry, you don't get a discount.

Key Topics

The Arbitrum Audit Program, and the "rubber stamp" problem with Foundation-backed audits

Decentralised security responsibility: the Security Council, the L1-L2 boundary, and BoLD

Stylus and WASM security, ZK-on-BoLD, real-time proving, and AI's red-team advantage

Chapters

00:00 Introduction

00:35 From ConsenSys and Outlier Ventures to the Arbitrum Foundation

04:11 What the Foundation Actually Does, and How It Differs from Offchain Labs

06:50 The Audit Program: How It Works and Who Funds It

10:18 The "Rubber Stamp" Problem and Vetting Audit Firms

13:18 Early-Stage vs Mature Teams: Who the Program Is For

14:54 What's Next: Additional Tools, AI, and the Limits of Scope

17:15 Lessons From the First Iteration, and Cost-Per-Line Benchmarking

21:11 The Foundation's Responsibility and the Security Council

24:49 What Keeps Him Up at Night: The L1-L2 Boundary and Bridges

29:16 Security Policy, Bug Bounties, and Disclosure Across the Ecosystem

30:48 Stylus: Does a WASM Runtime Widen the Attack Surface?

34:49 Safe Rust vs Solidity, Tooling Gaps, and the "Mental Trap"

39:13 Adding ZK to BoLD, and the Multi-Prover Approach

42:20 Real-Time Proving and Where Arbitrum Is Heading

45:20 ZK for Compression vs ZK for Privacy

46:24 AI in 2026: Red Team vs Blue Team, and AI Slop

50:31 Judging Teams: Authenticity, Resilience, and Real Problems

53:33 The Biggest Security Mistakes New Teams Make

55:25 The Foundation's Security Vision for the Next Few Years

57:52 One Piece of Advice: Dependencies, Keys, and Knowing When to Get Paranoid

Resources and Links

Lorenzo on X: https://x.com/aboutlo

Arbitrum: https://arbitrum.io

Oak Security's Research: https://research.oaksecurity.io/

Jade and Stefan speak to Robert de Groot, a core contributor to Web3Privacy Now, the research collective and think tank behind the Cypherpunk Congress, and CFO at Gain.

Robert starts from an unexpected place: privacy isn't really about hiding; it's about autonomy, the ability to choose what you reveal, to whom, when, and in what form. He connects it to something bigger than data leakage, the loss of the room to experiment and to fail, and the quiet self-censorship that creeps in when everything is recorded. From there the conversation opens onto the spectrum of privacy, from the journalist in a conflict zone who will work from a terminal if it keeps them alive, to the rest of us who just want a group chat that isn't intercepted and won't tolerate bad UX to get it.

A big thread is the gap between personal privacy and business compliance, and why the two still don't align. Robert explains how Web3Privacy Now evaluates the 800-plus projects in its Explorer (the "hard variables," verifiable code over marketing claims), why "zero knowledge" and "private" have become marketing terms, and why privacy adoption lags even when the tooling is ready, the preventive-measure problem, the group effect, and cookie-banner fatigue. On the compliance side, he maps the middle ground: opt-in reporting, viewing keys, and selective disclosure (picking up the thread from our Jordi Baylina episode), including a one-time key you could hand your tax auditor and be notified when it's used. 

He argues privacy will increasingly become a market-integrity feature, not just a civil-liberties one, shielding transaction amounts from competitors and MEV bots while keeping endpoints verifiable, and he closes on RWAs, why so many tokenisation projects quietly died on double-accounting overhead, and what "compliant by default" finally changes.

Key Topics

Privacy as autonomy, and the spectrum from uncompromisable to everyday

The gap between personal privacy and business compliance, and the middle-ground tools that bridge it

Privacy as a market-integrity feature for RWAs and institutional adoption

Chapters

00:00 Introduction

01:06 Why He Started Worrying About Privacy: Autonomy and Self-Censorship

04:58 Surveillance, Society, and the Loss of Room to Fail

06:01 What the Ethereum Community Really Thinks About Privacy

08:36 The Gap Between Personal Privacy and Business Compliance

10:54 What Web3Privacy Now Actually Does

13:45 Evaluating Projects: Hard Variables and Verifiable Code

17:01 When "Zero Knowledge" and "Private" Are Just Marketing

19:39 The Cypherpunk Congress and Why Privacy Matters Now

24:00 Tooling Is Ready, So Why Does Adoption Lag?

28:49 Compartmentalization, Intent, and Privacy by Default

34:38 GDPR, Cookie Fatigue, and Whether Regulation Backfires

39:49 Privacy vs Compliance: Does Privacy Make Regulators Nervous?

42:14 The Middle Ground: Opt-In Reporting, Viewing Keys, Selective Disclosure

45:31 Selective Disclosure and the Jordi Baylina Thread

46:10 RWAs, Institutions, and Why Tokenisation Projects Kept Dying

53:03 Privacy as a Market-Integrity Feature: MEV, Front-Running, and Competition Law

55:43 The Most Useful Thing an Ordinary Person Can Do

58:30 Where to Find Robert

Resources and Links

Robert on X: https://x.com/robdotrego

Web3Privacy Now: https://web3privacy.info

Cypherpunk Congress: https://congress.web3privacy.info/

Event: https://luma.com/spsnos9t

Oak Security's Research: https://research.oaksecurity.io/

After several episodes focused on security, this one turns to privacy, with Emanuele Francioni, co-founder and CEO of Dusk, a blockchain built for privacy and institutional use cases.

Emanuele traces the through-line from a contrarian 2018 thesis to a live network to abstract financial instruments away from the intermediaries that leak both value and data. A core thread is the counterintuitive relationship between privacy and regulation. He disentangles anonymity from confidentiality, shows how privacy actually underpins rules like GDPR, DORA, and insider-trading law, and explains how Dusk encodes KYC, jurisdiction, and limits directly into the protocol.

Then it gets harder: on a privacy chain, a vulnerability can be exploited in the dark. Emanuele uses the recent Zcash unbounded-mint bug to explain why Dusk's approach has to be proactive, why the team shipped three security upgrades this year (Aegis and Boreas among them), and why simplicity is the best safeguard. On the AI arms race he's candid, seeing Fable in action for three days genuinely scared him, but his conclusion is pointed: AI doesn't replace security expertise; it makes it more valuable.

Key Topics

Privacy vs confidentiality vs anonymity, and why privacy underpins regulation

Encoding regulatory compliance directly into a protocol

Securing a privacy-preserving chain, and the AI arms race in security

Chapters

00:00 Introduction

01:05 Founding Dusk in 2018 and the Road to PLONK

07:14 How Privacy Fits the Regulatory Space

08:00 Anonymity vs Confidentiality: Disentangling "Privacy"

15:11 Selective Disclosure and Working With Regulators

21:30 Encoding KYC, Jurisdiction, and Limits Into the Protocol

24:25 How Privacy Changes the Approach to Security

27:12 The Zcash Unbounded-Mint Bug and Why Privacy Must Be Proactive

29:30 The Security Arms Race and Five Attack Attempts This Year

34:50 Why Simplicity Is the Best Safeguard

36:12 The Complexity Trade-Off: Custom VM, Sandboxing, Immutable Contracts

40:14 Shrinking the Layer One: Dusk EVM and a Privacy-Preserving L2

43:21 The AI Arms Race: Aegis, Boreas, and Restructuring Into "Pods"

50:22 Cross-Pollination: Pulling Ideas From Biology Into Software

55:10 Where AI Helps in Security, and Where Humans Still Matter

1:02:19 Oak's Research: Minor Human Intervention, Completely Different Output

1:04:27 Surprising Findings in Aegis: the BLS Truncation Bug

1:06:45 Boreas: a Live Incident and Real-Time Response

1:11:00 Operational Security, Supply Chain, and AI-Era Hiring

1:16:56 Wrap-Up

Resources and Links

Emanuele on X: https://x.com/autholykos

Dusk: https://dusk.network

Oak Security's Research: https://research.oaksecurity.io/

Most of our guests come at security from the outside, as auditors and researchers. Antonio Viggiano sits on the other side of the table: he's a Senior Security Engineer at the Monad Foundation, working on protocol fuzzing for the chain's consensus and execution clients.

Monad's architecture makes that a genuinely different problem. Unlike Ethereum, with its many interchangeable clients, Monad has a single pair: a C++ execution client and a Rust consensus client, both built by Category Labs. That tight coupling buys optimisations, but it also means a bug that looks real in one client is often quietly mitigated by the other. Test one in isolation and you drown in false positives.

That's where Monad Bugfinder came from, and the origin story is the opposite of what most people assume. It didn't start as a bug finder at all. It started as a triager, because the team was being flooded with AI-generated reports: convincing write-ups, plausible proofs of concept, and hours of human time spent working out which ones were real. Bug hunters optimise for recall. When you're the one receiving the reports, you need precision. Antonio walks through the validation gates that made the difference, why AI has a higher false positive rate than humans, and why the best human reviewers still find twice as many bugs as the best AI systems.

Key Topics

AI-assisted vulnerability discovery and triage

Invariant testing and protocol fuzzing

In-house security teams at protocols

Chapters

00:00 Introduction

00:38 From Solidity Developer to Security Engineer

03:10 Founding Recon and Cloud Fuzzing

04:39 What Is Invariant Testing?

06:38 Fuzzing Smart Contracts vs Blockchain Clients

08:41 Tooling Maturity and System Complexity

09:47 Extracting Invariants at the Protocol Level

11:11 Why Most DeFi Teams Don't Know Their Properties

13:29 Monad's Architecture: Two Clients, Tightly Coupled

16:29 Why Single-Client Bugs Create False Positives

17:21 Monad Bugfinder: Why It Started as a Triager

20:19 Precision vs Recall: Finding Bugs vs Receiving Reports

23:54 Inside the Triage Process

25:59 Reconstructing Proofs of Concept End-to-End

27:13 Should Smaller Teams Build Their Own?

30:06 Build vs Buy, and the Attackers Building It Too

32:27 Validation Gates: EIP Support and Differential Testing

35:49 Testing Against Geth and Nethermind

37:43 Local Clusters and Controllable Validators

42:00 Do AI Reports Have More False Positives?

44:37 The Economics: AI Tokens vs Audit Firms

47:47 Why Humans Still Find Twice as Many Bugs

48:14 When Your Scaffolding Goes Stale

51:52 Offense vs Defense and the Human Weak Link

54:27 The Roadmap: Making the System Generic

56:51 UltraFuzz: Agentic Fuzzing for Solidity

1:00:32 Specifications, Spec Drift, and AI-Written Code

1:04:08 Will AI Ever Write Bug-Free Code?

1:09:45 Where to Find Antonio

Resources and Links

Antonio's X: https://x.com/aviggiano

Monad Bugfinder blog post: https://blog.monad.xyz/blog/monad-bugfinder

UltraFuzz blog post: https://www.monad.xyz/blog/ultrafuzz 

Monad: https://monad.xyz

Oak Security's Research: https://research.oaksecurity.io/

What does it actually mean to be "obsessed with AI for security"? In this episode of CypherTalk, Jade and co-host Stefan Beyer sit down with Prof. Arthur Gervais (UCL, affiliate faculty at UC Berkeley), known for foundational work on MEV, flash loan attacks, and AI-powered smart-contract security.

Arthur's core conviction sets the tone: AI is not a zero-sum game. Strong researchers can now find vulnerabilities ten times faster, and the right response is to onboard everyone as fast as possible rather than lock the tools down. The conversation goes deep on A1, the agentic system his team built that turns any LLM into an end-to-end exploit generator with one unambiguous goal: generate a profit. The hard part, he stresses, isn't building it, it's target selection.

Key Topics

AI for security enhancement

AI-assisted vulnerability detection

Real-time blockchain exploit detection

Chapters

00:00 Introduction to AI and Security

02:29 Arthur's Journey into Information Security

05:05 The Role of AI in Security

07:22 A1: The AI Agent for Exploit Generation

09:38 Autonomy and Ethics of AI Agents

11:53 Harnessing AI for Security Audits

14:15 The Evolution of LLMs and Their Impact

16:33 Dealing with False Positives in AI Security

19:06 The Academic Perspective on AI Research

21:42 Comparing LLMs for Security Tasks

24:05 Future Directions in AI and Security

25:26 The Power Dynamics in AI and Cybersecurity

29:04 Balancing Offensive and Defensive Strategies in AI

31:44 Real-Time Defense Mechanisms in Cybersecurity

34:20 The Role of Tooling in Smart Contract Security

39:04 Human Error vs. Automated Security Tools

41:24 AI's Impact on Social Engineering and Human Error

42:53 Emerging Threats from AI in Cybersecurity

44:17 Teaching Blockchain Security: Common Misconceptions

45:23 Future Directions in Blockchain Security Research

Resources and Links

Arthur’s website: https://arthurgervais.com/

Arthur’s Google Scholar: https://scholar.google.ch/citations?hl=en&user=jLr_xi4AAAAJ&view_op=list_works&sortby=pubdate

Arthur’s X: https://x.com/HatforceSec

Oak Security’s Research: https://research.oaksecurity.io/ 

In this episode, Jade Doherty and Stefan Beyer interview Peter Kacherginsky, founder of BlockThreat, on his quarterly take on blockchain security and recent exploits. They discuss how to utilize threat intelligence, the shift from smart contracts to operational attacks, and the role of AI in cybersecurity.

Topics

Chapters

00:00 Introduction to Block Threat and Peter Kachaginski

01:42 Utilizing Threat Intelligence Effectively

04:31 The Impact of Market Conditions on Security

07:43 Shifts in Attack Vectors: From Smart Contracts to Infrastructure

09:35 Analyzing Major Hacks: Drift and Kelp DAO

13:36 The Importance of Architectural Security

16:47 The Evolving Role of Ethical Security Researchers

20:58 The Future of Security in a Rapidly Changing Landscape

30:10 Navigating Ransomware and Legal Implications

34:41 AI's Role in DeFi Security

43:27 Community-Driven Security Initiatives

49:25 Building a Security Mindset in Teams

51:48 The Centralization Dilemma in Security

Resources

Block Threat Newsletter - https://blockthreat.com 

Oak Security’s report - https://research.oaksecurity.io/ 

Peter’s X - https://x.com/iphelix