
God First ✞ | Web3 & Web2 Security Researcher (Hacker) | Gonzaga U & Centralia HS Grad | Wiffleball @ctownwiffle | Dodgeballer |
Seattle/Centralia, WA
Joined February 2013
- Tweets3.1K
- Following983
- Followers1.4K
- Likes2.4K
Pinned Tweet
I taught a killer training of glibc malloc heap exploitation for several years. After some effort, the content is now open source and mostly ready to consume! Half of the videos are posted for the course. 🔥
github.com/SecurityInnovatio…
Maxwell ꓘ Dulin (Strikeout) retweeted
The sickening stories keeping coming in…😢😢😢
SHAME ON YOU, @StubHub.
Imagine being a kid, a HUGE @Brewers fan, and finding out you’re going to see your team play in the WORLD SERIES! ⚾️💙💛
The excitement. The anticipation. The memories you’re already imagining making.
Now imagine having that excitement ripped away because a company sold your 3 tickets that you bought, that they apparently can’t deliver.
That’s exactly what we’re dealing with right now.
We purchased THREE tickets to the Milwaukee Brewers World Series for Game 1 last Tuesday(13th) through StubHub. We selected our section, our row, paid for our tickets, and received our order confirmation.
Everything was supposed to be set.
Then suddenly, StubHub tells us they’re “searching for replacement options” because they can’t provide the tickets we purchased.
ARE YOU KIDDING ME?!
How does a company accept someone’s hard earned money, confirm a purchase, and then turn around and say they can’t fulfill it?!
And their solution? We can request a refund while they continue looking for tickets.
THIS ISN’T ABOUT THE MONEY.
It’s about the experience. It’s about the memories. It’s about the excitement of a kid, his dad, and grandpa, who thought they were going to watch their favorite baseball team play on the biggest stage in baseball.
Look at the first picture. That’s the disappointment you’re creating, StubHub.
A refund doesn’t replace that moment.
And here’s what really bothers me…
StubHub advertises a “FanProtect Guarantee” and tells customers their orders are “100% guaranteed.”
Guaranteed WHAT, exactly?!
Because from where we’re sitting, that guarantee doesn’t feel worth much when you can’t deliver the tickets you sold us.
We did everything right. We purchased through a major ticket marketplace. We trusted the confirmation. We trusted the guarantee.
Now it’s time for StubHub to make it right.
We aren’t asking for anything extra. We want the three tickets we paid for, or comparable or better seats together, at no additional cost.
Stubhub…DO BETTER.
Please SHARE this. Not just for us, but for every fan who has trusted a ticket company with an experience that means so much more than the price of admission.
ℹ️Brandon Barker
Maxwell ꓘ Dulin (Strikeout) retweeted
What’s most interesting to me is we have hit half a dozen bugs **not** found by LLMs statically reasoning over code. There is alpha yet
Maxwell ꓘ Dulin (Strikeout) retweeted
Not many people know this, but our protective services arm at @asymmetric_re offer bug sweeps to address this exact risk.
Please reach out to learn more!
cnbc.com/amp/2026/10/13/open…
Maxwell ꓘ Dulin (Strikeout) retweeted
Soon I'll hit 5 years in Web3 security.
This is for everyone just starting out in the space:
- people are making $100k+ from reporting a single bug. the opportunities are insane, but it's NOT easy money
- become a nerd. literally. read code, break things, put in the hours
- learn to negotiate. being great at finding bugs doesn't automatically mean you'll be great at getting paid
- be disciplined. it takes years to become genuinely good at this
- stay curious. never stop asking WHY and HOW things work
- start by finding smaller bugs. learn to walk before chasing Criticals
- be patient. skills, reputation and money don't come overnight
- adapt fast. this industry looks nothing like it did 4 years ago
- embrace new technologies, especially AI. learn to use them instead of dismissing them
- surround yourself with smart, like-minded people. you'll learn things no course can teach you
- stay up to date with exploits, research and everything happening in the space
- learn to sell yourself. your skills mean less if nobody knows about them
- build your personal brand. a good reputation opens doors you didn't even know existed
- understand what creates REAL value
- celebrate your wins, but don't get too comfortable. take a day off, then get back to work
- respect other whitehats and builders. there's always something you can learn from them
- help people without expecting anything in return. you'll be surprised where it leads
- long-term relationships > short-term benefit
- be careful what you click. even security researchers get hacked
- never think you've learned enough. the moment you stop improving, you're falling behind
- enjoy the process. this space is so crazy that it's almost impossible to get bored
Maxwell ꓘ Dulin (Strikeout) retweeted
Web3 bug bounties paid to researchers (estimates):
- 2024: ~$24M
- 2025: ~$14M
- H1 2026: $13.45M
One $3M payout was 38% of Q1 2026.
2025 hack losses: ~$3.4B.
Bounties ~ 0.4% of that.
Maxwell ꓘ Dulin (Strikeout) retweeted
🚨BREAKING: A Polymarket user put $20 on UNDER 7.5 runs in Yankees–Rays at 0.1% odds after a home run made it 4-4...
Officials then overturned the HR for fan interference & no more runs scored, turning $20 into $20,000.
Maxwell ꓘ Dulin (Strikeout) retweeted
bugbounty.meta.com/payout-gu…
Muse bugs pay up to $300k, attack us instead!
bro zachxbt is actually insane
this man went undercover as a money laundering client
spent $350K of his OWN money to gain the trust of a chinese launderer who was moving bybit hack funds for north korea
the guy started sharing everything. screenshots. wallet addresses. bridge transactions. in real time
zach was matching every single transaction on-chain as the guy was sending them
traced $12M+ across bitcoin, ethereum, solana, and tron
got tether to freeze $442K from the evidence alone
and the funniest part? in between discussing how to launder funds for north korea this guy was casually talking about playing mahjong and his weight loss plan 😭
bro thought he was talking to a client. he was talking to the most dangerous investigator in crypto
and zach funded this entire operation himself. $350K out of pocket. no guarantee he'd ever see it back
this is not the FBI. this is one guy with a laptop and a blockchain explorer
different breed
let’s go!!!!
1. remember when i said a $200 claude/codex account can have 1000x ROI? this why.
2. game recognizes game, meta security invited harsh to meet at defcon and appreciated how cool the bug was, instead of being angry, surprising
3. image parsers, parsers in general, will keep giving.
Dont be sleeping on Heif Heist! Meta paid 100k for my RCE on FB/Instagram!
heif-heist.com/
Awesome podcast episode about the creation, and challenge creation process on CryptoHack. If you run communities or create learning material for others, it's worth a listen!
podcasts.apple.com/nl/podcas…
Maxwell ꓘ Dulin (Strikeout) retweeted
I’ll be speaking at Scale or Die in London this November.
Been a wild year for safety and security, can’t wait to share what we’ve learned!
Jeff does wayyy cooler things than me but still always shares my stuff anyway. Thanks for the support 🫶
From @Dooflin5, a coworker of mine. A browser port of hash_extender for hash length extension attacks:
mdulin2.github.io/HashExtend…
Maxwell ꓘ Dulin (Strikeout) retweeted
From @Dooflin5, a coworker of mine. A browser port of hash_extender for hash length extension attacks:
mdulin2.github.io/HashExtend…
You can now run hash extension attacks from the browser! S/O to Ron Bowes for creating the C-based tool the port was built on: mdulin2.github.io/HashExtend…
Maxwell ꓘ Dulin (Strikeout) retweeted
🚨 TRENDING: The Patriots reportedly used a clever trick at Gillette Stadium to potentially throw off opposing kickers.
On opponent FGs, the video board showed a reverse camera angle that created an offset second set of yellow uprights behind the real goalposts, potentially making kicks more disorienting.
After reviewing dozens of examples and 52 Patriots FG attempts, the illusion reportedly appeared on New England’s own kicks ZERO times.
(Via @RyanPaganetti)
































