Tony retweeted
pov: you're a social media manager who's been invited to yet another meeting that you weren't actually needed...
Tony retweeted
The doxxification of CT is increasingly becoming cringe.
I don't want to see ten selfies of you every day on my timeline.
Tweet about crypto, if you want to post selfies go to Instagram
layerzero attack was not rpc poisoning
in networking poisoning is when the attacker outside the trust boundary taints a shared lookup (dns, arp, cache). the consumer has no reason to distrust the source.
this was not that.
the attackers got inside layerzero's trust boundary. they accessed the rpc list, compromised two nodes the dvn depended on, and swapped the op-geth binaries. that's an infra breach within the perimeter. supply-chain shaped, not network shaped.
and the payload was surgical. the malicious binary cloaked by ip, served forged payload only to the dvn, told the truth to scan and every other caller, then self-destructed to wipe logs and binaries.
rpc poisoning makes it sound like something that happened to the infra from the outside. the real story is a targeted implant operating inside the trust boundary.
that's a meaningfully scarier attack than the label suggests.
Tony retweeted
After Aave got bad debt --> normal users rushed to withdraw ETH/stables --> pools slammed to 100% utilization = no one can get out.
Stuck depositors realized they couldn’t withdraw but could still borrow --> they maxed their credit, yanking out as much stables as possible via loans.
Lenders turned into leveraged borrowers on a pool that already had a hole --> risk spirals higher.
Whales/normies/treasuries pulled almost $8B from Aave and derisked on other similar protocols (Morpho, Sky, Fluid, Kamino, etc.) --> bridge/LST collateral is now “radioactive” in the eyes of serious money. Heck, many people won't even deposit USDC/USDT alone. Simply because it's not worth it for 3% APY, since you might lose 100% of your capital.
DeFi works as intended, but at what cost? Will be interesting to see what comes out of this.
Tony retweeted
Root cause now fully on-chain.
The rsETH OFT Adapter on mainnet trusted a LayerZero message from EID 30320, peer 0xc3eACf06…09f58, and released 116,500 rsETH ($293.5M) from escrow in a single lzReceive call.
LayerZero Scan labels that source peer “Kelp DAO.” Meaning it was Kelp’s own legitimately-deployed peer contract, with 308 prior message nonces on that pathway.
This is not setPeer injection. This is key compromise on the source chain.
IMPORTANT: Not a LayerZero protocol bug. An OApp peer-trust bug.
Full forensics, attacker cluster, and Aave bad debt flow in the thread below.
Replying to @dcfgod
@dcfgod is right!
rsETH exploit forensics. Live on-chain.
1/ Attacker wallet:
0x1F4C1c2e610f089D6914c4448E6F21Cb0db3adeF
@aave V3 supply ladder, one wallet: 1 → 400 → 5,000 → 20,000 → 27,999 rsETH.
Textbook test-then-scale. Probe with 1 token, ramp each time the prior clears.
53,400 rsETH from this wallet. ~$134M.
Cluster total: ~116,500 rsETH. ~$290M.
2/ Aave V3 ETH reserve, live:
Supplied: 2.71M WETH ($6.37B)
Borrowed: 2.71M WETH ($6.37B)
Utilization: 100%
Supply APY: 7.36%
Borrow APY: 8.71%
That is the bank run. WETH suppliers are locked. Withdrawals blocked, as first flagged by @Marczeller.
3/ The mechanic.
Attacker drained rsETH (OFT bridge vector, per initial reports). Supplied it as collateral on Aave V3 mainnet. Borrowed max WETH up to liquidation threshold.
Walked.
Kelp paused redemptions. Secondary rsETH liquidity cracked. Aave oracle still marks near peg.
Liquidators cannot close the position at mark. The gap becomes bad debt on the WETH reserve.
4/ Loss waterfall.
a. Umbrella. First live stress test of the Q4 2025 replacement for Safety Module. Will it fully slash aWETH stakers to cover the deficit?
b. Residual haircut flows pro-rata to remaining WETH suppliers.
c. Kelp mainnet rsETH holders are intact. Native ETH backing untouched, circulating supply unchanged. This is not a Kelp mint exploit. It is a bridge theft that became an Aave bad debt via instant cash-out.
5/ The primitive lesson.
Listing an LRT, or any bridged derivative, as collateral means underwriting the entire upstream dependency stack:
- Bridge config and security (@LayerZero_Core OFT here)
- Mint and burn permissions
- Oracle feeds and redemption mechanics
- Fee contracts and wrapper logic
Any single point of failure upstream becomes WETH bad debt downstream.
@StaniKulechov, this is a listing-authority problem more than a token problem. If the stack cannot be fully priced and simulated, do not list it.
Hiring: Head of Social @Offchain
Looking for someone with extensive crypto experience to own our strategy across platforms (including @arbitrum, @prylabs, and @zerodev)
Must be a "player-coach" who can translate technical developments into credible narratives across X, LinkedIn, and YouTube
📍Remote (US / EDT preferred)
Interested? Drop a comment or DM, or tag someone who fits
Users should revoke all approvals made on CoW Swap after 14:54 UTC today. Tools like revoke.cash make this easy to do.
🚨🚨
UPDATE: CoW Swap experienced a DNS hijacking at 14:54 UTC (approximately 90 minutes ago).
The CoW Protocol backend and APIs were not impacted, but we have paused them temporarily as a precaution.
We are now actively working to resolve the situation. Please continue to refrain from using swap dot cow dot fi until we confirm that it is safe to use.
Tony retweeted
I'm about to save you hours of research.
This list of active VCs is for all the founders out there:
→ @a16zcrypto
→ @paradigm
→ @dragonflyvc
→ @CoinbaseAssets
→ @yzilabs
→ @PanteraCapital
→ @coinfund
→ @bcap
→ @robotventures
→ @mhventures
→ @variantfund
→ @Delphi_Ventures
→ @MoonrockCapital
→ @HaunVentures
→ @Rockaway_X
→ @Lemniscap
→ @NFX
(more below)
You're welcome.
Tony retweeted
Average SMM:
→ thinks about posts
→ asks: what should I post today?
→ measures followers and likes
→ reacts to trends
→ delivers content
Top-Tier SMM (me btw):
→ thinks about outcomes
→ asks: what should this account achieve?
→ measures trust, reach, and conversions
→ builds systems
→ delivers results and explains them
There is a clear difference.
If you want posts, hire anyone.
But if you want outcomes, you know who to call
Tony retweeted
🎓 Jupiter Academy just dropped a $10K fund for content creators.
If you'd like to create content for Jupiter Academy this is your chance!
Apply, build, get rewarded.
Tony retweeted

Simon Chadwick 👨🚀@simonch00Apr 8
🇦🇺
AustraliaConnected via Australia App StoreAccount-level information, not a live location or per-post device.
Just released two betas:
Mac app to track your claude and API usage + costs. Get notifs, historical data and alerts when claude is down.
The v1 of the subscription platforms as a webapp. Keep on top of all your monthly costs and discover hidden subs.
Last call: Applications for the Arbitrum Mentorship Program close today.
Get hands-on support from industry leaders, direct access to capital and $100K+ in prizes.
Early-stage teams looking to bring new primitives onchain and contribute to the programmable economy should apply.
Learn more below and apply now. 👇
tally.so/r/aQdj2W
Applications for the Arbitrum Mentorship Program close April 7th.
The programmable economy needs new businesses and we’re backing the next gen of onchain businesses with hands-on support from industry leaders, direct access to capital and 100K+ in prizes.
Here’s why early-stage teams should apply today. 🧵👇
tally.so/r/aQdj2W
Tony retweeted
We respect the decision of Chaos Labs to step down as one of the two risk managers for the Aave DAO.
We want to thank Chaos Labs for their work over the years. They have been a valuable partner to the Aave DAO, and their contributions have helped Aave grow and mature.
There is no disruption to the Aave Protocol, its smart contracts, asset listings, or network deployments, and we will work closely with Chaos Labs during the offboarding process.
Aave operates with a two-layer economic risk model that has been managed by Chaos Labs and LlamaRisk. While this model does create tension between risk managers from time to time, we believe it has been valuable in safeguarding Aave. We strongly support maintaining a two-layer approach and will continue supporting this model, alongside an additional technical risk layer managed by Aave Labs.
Over the past weeks, we held discussions with the Chaos team regarding next steps, as Chaos was exploring winding down its risk consultancy services business (and had already begun winding down some agreements with other protocols).
We were generally supportive of a 2× increase in their risk management payment to $5M, but not supportive of $8M without a separate addendum at a later stage if the workload proved higher than anticipated.
What we did not support were other elements of the proposal, including setting Chaos Labs as the sole risk manager and using Chaos Labs price oracles instead of Chainlink on all new deployments, as well as adopting Chaos Labs vaults as the default vaults (which are not yet audited) for all B2B integrations.
While we do not see issues with these Chaos products or their future viability, we strongly believe that, given the scale of the Aave protocol, it should maintain at least a two-layer risk management model and vendor lock-in free vaults. Additionally, given the strong track record with Chainlink, we prefer to continue supporting Chainlink for price oracles, which our users are currently more comfortable with at scale.
Regarding Aave V4, the architecture introduces isolated risk markets through Spokes, new liquidation logic, and governance-controlled parameters that give the DAO more granular control over how it manages risk across different markets and assets. We held multiple risk calls with Chaos Labs employees in attendance well before V4 went live, and the feedback we received during those sessions does not align with the concerns expressed in their post.
For the immediate future, Aave Labs will work closely with LlamaRisk to ensure a smooth transition and uninterrupted risk coverage for the protocol.
LlamaRisk already serves as a risk contributor to the Aave DAO and has deep familiarity with the protocol’s architecture and parameters. We support LlamaRisk increasing their budget to accommodate this additional workload and expanding their team as needed. Aave Labs will also contribute engineering and analytical resources wherever necessary to support this transition.
We also want to thank the entire Chaos Labs team for their contributions over the years, as they have helped bring the protocol we built into its current level of maturity.
Tony retweeted
Chaos Labs leaving Aave citing:
1) Disagreement in V4 architecture
2) Underfunded risk budget
3) More importantly, fundamental disagreement on how risk should be managed at DeFi’s largest lending protocol
Curious to see how this plays out for Aave... ACI really was the domino effect here
Tony retweeted

Simon Chadwick 👨🚀@simonch00Apr 2
🇦🇺
AustraliaConnected via Australia App StoreAccount-level information, not a live location or per-post device.
Next week we finally release beta v1 of the @OrbitMoney_ subscription app and additionally built some cool extra features for tracking of API costs and Claude usage.
Exciting week ahead.
Tony retweeted
Earlier today, a malicious actor gained unauthorized access to Drift Protocol through a novel attack involving durable nonces, resulting in a rapid takeover of Drift’s Security Council administrative powers.
This was a highly sophisticated operation that appears to have involved multi-week preparation and staged execution, including the use of durable nonce accounts to pre-sign transactions that delayed execution.
Tony retweeted
Fact check: false
1. Variational is decentralized because all user collateral is stored in a segregated collateral account per user onchain. OLP puts *its own funds* up for collateral on CEXes. This means if binance is hacked user collateral is not lost.
2. We use a broker model but there is no separate A book vs B book. All trades go into one global portfolio for hedging. For hedging we do use binance as one liquidity source, as well as other exchanges. This is why we are able to aggregate liquidity and provide much better liquidity and lower costs than other DEXes.
3. We have routed flow to hyperliquid before, and are open to doing so in the future too. We see ourselves as complementary to all exchanges in the space, and we have a grow the pie mindset. This will be especially powerful with our RWA launch as we will aggregate across tradfi liquidity sources as well.
You’re unable to view this Post because this account owner limits who can view their Posts. Learn more
Tony retweeted

Officer's Notes@officer_secretApr 1
!
EuropeConnected via Eastern Europe (Non-EU) App StoreLocation may be affected by a proxy or VPN.Account-level information, not a live location or per-post device.
It looks like Drift has been exploited!
HkGz4KmoZ7Zmk7HN6ndJ31UJ1qZ2qgwQxgVqQwovpZES


































