CEO & co-founder @therealgregoai | host of @bountyhunt3rz podcast | top ranked whitehat on @immunefi https://xitter.cf/t.co/vWgt74l17W
LIFE ... on the blockchain
Joined September 2011
- Tweets4.6K
- Following3.7K
- Followers10K
- Likes25.2K
We recently started hunting bugs outside of Web3 using @therealgregoAI with impressive results
This is one of the first vulnerabilities we have been able to disclose (with many more to come)
TLDR: Apple's PCC revocation check was a no-op and revoked nodes kept getting the mesh keys for in-flight Apple Intelligence data
Fixed in 26.4. Happy halloween! 🎃
@elonmusk a humble request for full markdown support in X articles as technical write-ups become difficult to accurately comprehend without it
riptide retweeted
Close to 1,000 people registered for Risky Business, Singapore. Only 110 made it into the room.
Tight curation makes for great conversations, and plenty of great conversations were had.
Thank you to the builders, protocols and capital allocators who kicked off their @token2049 week with us.
See you at the next one. 🫡
riptide retweeted
One of the top AI hackers on Immunefi @0xriptide:
"AI is bringing back the same bugs we saw five years ago. We're not seeing anything new.
Developers will naturally get lazy and start vibe coding everything.
What will separate teams is how they build. Some will take shortcuts, while others will stay focused on security and building things right."
Full interview below.
A note to those building on chain in 2026:
vibe coding + high code velocity + bull market pace + rapid TVL growth = bugs galore
we see many teams building skyscrapers on sand with a "fix it later" mentality
initially this works and they think they are geniuses
... but eventually
someone will find the big, protocol wrecking, critical bug
capital flight and brand destruction happens overnight
entire savings lost, lives ruined financially, lawsuits filed, death threats received
i've seen it happen time and time again and it will happen to YOU if this is your approach to building on the blockchain
riptide's recommendations:
1) find a balance between securing the code and shipping fast. the security strategy should not be to push critical fixes like OTA updates for an XBOX game when any significant TVL is at risk.
2) invest in top tier human security talent. AI + expert SRs are a force multiplier. get a team that builds with a security first mindset from day 1.
3) properly incentivize responsible disclosure and treat your whitehats like kings. they are your last defense and will go out of their way to ensure your success if treated well
remember that you may only get one shot at building a successful project that makes you millions of dollars ...
best of luck anon
have you ever wanted to come on the now legendary @bountyhunt3rz pod?
now is your chance anon SR
🚨We now have a live website for new guests that would like to come on the podcast! 🚨
You can self-submit and I will review all submissions personally. The idea is to build a queue of potential guests so that I can put out more episodes on a consistent basis going forward.
Check it out here: bountyhunt3rz.fm/
Thank you to the champion @khubak for putting this whole thing together
looks like a whitehat got tired of running sims and wanted to feel something …
caught on purpose or missed a step?
The funds from the $3.8M NEAR Intents hack were sent back in full.
We are stopping the investigation.
Please use bug bounties instead of disrupting the services.
riptide retweeted
yBorg applications close tonight!
We've got a pretty stacked lineup for speaker workshops
xitter.cf/yAuditDAO/status/21020…
Details:
- We'll be building harnesses and ai tooling which will be used on live audits
- The program is 100% free
- Kicks off next week on September 28
- Lasts for 4 weeks
Here's the application:
forms.gle/K4EnfzPUcToFxN8k8
riptide retweeted
"How would a human even find this?"
Justus Hanna (@0xriptide) on the $250K bug his AI caught: it chained multiple vulnerability classes with an edge-case timing exploit. The probability of a human reaching that same conclusion? Very low.
🎧 CypherTalk: podbean.com/ep/pb-e9u3w-1b5f…
if you will be at @token2049 in SG this year
our team @therealgregoAI will be hosting an event here: luma.com/dupkf78j
Thank you for having me on @beyer_st
New @cyphertalkmedia episode: our co-founder @beyer_st sits down with @0xriptide of @therealgregoAI.
Chaining vulnerabilities with AI, the $27.7M exploit it caught, and what's left for the human auditor.
riptide retweeted
The convo, we've all been having "Crypto was made for AI Agents"
⏯️youtu.be/6rT4PpcCa1k
with @milan_dereede from @NanoGPTcom, @0xriptide CEO @therealgregoAI , Donald Founder @glossifi, Devon Marten, Co Founder @blocksight_ai and moderated by @TheDesertLynx
Satoshi Stage, Common S3nse Amsterdam
riptide retweeted
If you think AI security tools are just cheap scanners that dump 20 pages of false positives, this conversation is worth listening to.
This week’s Security Voices features @flack00n, Head of Bugs at @therealgregoAI .
From @bountyhunt3rz with @0xriptide.
What I found interesting wasn’t just the $500K+ in bounties or the $27.7M they helped save.
It was how they think about depth, verification, and why they still don’t trust AI 100%.
Some thoughts from the conversation 👇
riptide retweeted
Finding bugs that humans miss ... while staying extremely humble
An AI security agent now ranks #17 on the Immunefi leaderboard.
In 2026 alone, it has found 3 valid Critical vulnerabilities and 5 Highs, earning more than $197,000 in bounties.
The AI security agent race is clearly not slowing down.
If you’re building an AI security agent and have been hunting on Immunefi, DM us. We’d love to see what you’re working on, support your training with our Studio Review product, and help amplify your work.
Congrats, @therealgregoAI! 🤖
riptide retweeted
If protocols actually consider taking hundreds of millions in user funds then returning 85% of it as legit and “whitehat”
Then they should be honest and upfront about it.
State it clearly in their public comms, docs, the code itself.
From launch. Not after the hack happened.
Announce an escrow wallet you can move funds at risk to, and expect to receive 15% of the amount. Or even just move 85% and keep the 15% already.
Make it clear to the world this is authorized use of the software and therefore cannot be prosecuted. Sign documents stating it clearly.
And let users know it and decide if they are ok with it.
Otherwise you’re just subsidizing lack of ethics and exploiting people who work with you in good faith.
And that in my opinion makes you worse than a black hat.
Again it happens
To what end?
> found a vulnerability with ~$9–15m immediately drainable
> got duplicated by a 6+ week-old report
> thought "wtf, are they reckless?"
> original reporter hadn't found my permissionless (and imho beautiful) exploitation path
> they mitigated my trick right after my report got triaged
Now I get $0 and the original reporter likely gets $10k at best. Or even a "won't fix", since last I checked they had only mitigated my trick.
Now laugh.
And that's one of the reasons bounties are incidental for me: I get curious about a project, find something, send it straight to security@ (or equivalent), and move on. I'm lucky to be able to do this for fun rather than need.
The illusion of invulnerability in crypto:
Founders have high self-esteem and high optimism which conflicts with properly preparing for and dealing with negative events
The rare founder who has been through a hack before is usually the only exception
How many signs to you need to see before you prioritize security?
Do you think it won’t happen to you?
You, as a founder, are entrusted with investor capital to watch the gates and yet, time after time the same story repeats itself
Do better
… and DM for audits
No, Liquid Network / Blockstream did not run a public security bug bounty program.
Elements (the software powering Liquid) and related projects only had a standard responsible disclosure policy: report privately via PGP-encrypted email to securityblockstream.com. No rewards or formal bounty platform (Immunefi, HackerOne, etc.) were offered for vulnerabilities.
They occasionally posted development bounties for features (e.g. wallet kits), but nothing covering protocol or consensus bugs.