God First ✞ | Web3 & Web2 Security Researcher (Hacker) | Gonzaga U & Centralia HS Grad | Wiffleball @ctownwiffle | Dodgeballer |

Seattle/Centralia, WA
Joined February 2013
I taught a killer training of glibc malloc heap exploitation for several years. After some effort, the content is now open source and mostly ready to consume! Half of the videos are posted for the course. 🔥 github.com/SecurityInnovatio…
6
100
2
327
23,522
Maxwell ꓘ Dulin (Strikeout) retweeted
The sickening stories keeping coming in…😢😢😢 SHAME ON YOU, @StubHub. Imagine being a kid, a HUGE @Brewers fan, and finding out you’re going to see your team play in the WORLD SERIES! ⚾️💙💛 The excitement. The anticipation. The memories you’re already imagining making. Now imagine having that excitement ripped away because a company sold your 3 tickets that you bought, that they apparently can’t deliver. That’s exactly what we’re dealing with right now. We purchased THREE tickets to the Milwaukee Brewers World Series for Game 1 last Tuesday(13th) through StubHub. We selected our section, our row, paid for our tickets, and received our order confirmation. Everything was supposed to be set. Then suddenly, StubHub tells us they’re “searching for replacement options” because they can’t provide the tickets we purchased. ARE YOU KIDDING ME?! How does a company accept someone’s hard earned money, confirm a purchase, and then turn around and say they can’t fulfill it?! And their solution? We can request a refund while they continue looking for tickets. THIS ISN’T ABOUT THE MONEY. It’s about the experience. It’s about the memories. It’s about the excitement of a kid, his dad, and grandpa, who thought they were going to watch their favorite baseball team play on the biggest stage in baseball. Look at the first picture. That’s the disappointment you’re creating, StubHub. A refund doesn’t replace that moment. And here’s what really bothers me… StubHub advertises a “FanProtect Guarantee” and tells customers their orders are “100% guaranteed.” Guaranteed WHAT, exactly?! Because from where we’re sitting, that guarantee doesn’t feel worth much when you can’t deliver the tickets you sold us. We did everything right. We purchased through a major ticket marketplace. We trusted the confirmation. We trusted the guarantee. Now it’s time for StubHub to make it right. We aren’t asking for anything extra. We want the three tickets we paid for, or comparable or better seats together, at no additional cost. Stubhub…DO BETTER. Please SHARE this. Not just for us, but for every fan who has trusted a ticket company with an experience that means so much more than the price of admission. ℹ️Brandon Barker
2,884
6,758
761
41,520
5,964,586
Maxwell ꓘ Dulin (Strikeout) retweeted
What’s most interesting to me is we have hit half a dozen bugs **not** found by LLMs statically reasoning over code. There is alpha yet
looking for a DST guru to join the Tempo team - lmk if anyone's on the market and keen to write high assurance software that can move billions of dollars in milliseconds securely
10
6
57
6,805
Maxwell ꓘ Dulin (Strikeout) retweeted
Soon I'll hit 5 years in Web3 security. This is for everyone just starting out in the space: - people are making $100k+ from reporting a single bug. the opportunities are insane, but it's NOT easy money - become a nerd. literally. read code, break things, put in the hours - learn to negotiate. being great at finding bugs doesn't automatically mean you'll be great at getting paid - be disciplined. it takes years to become genuinely good at this - stay curious. never stop asking WHY and HOW things work - start by finding smaller bugs. learn to walk before chasing Criticals - be patient. skills, reputation and money don't come overnight - adapt fast. this industry looks nothing like it did 4 years ago - embrace new technologies, especially AI. learn to use them instead of dismissing them - surround yourself with smart, like-minded people. you'll learn things no course can teach you - stay up to date with exploits, research and everything happening in the space - learn to sell yourself. your skills mean less if nobody knows about them - build your personal brand. a good reputation opens doors you didn't even know existed - understand what creates REAL value - celebrate your wins, but don't get too comfortable. take a day off, then get back to work - respect other whitehats and builders. there's always something you can learn from them - help people without expecting anything in return. you'll be surprised where it leads - long-term relationships > short-term benefit - be careful what you click. even security researchers get hacked - never think you've learned enough. the moment you stop improving, you're falling behind - enjoy the process. this space is so crazy that it's almost impossible to get bored
10
17
1
237
7,607
Maxwell ꓘ Dulin (Strikeout) retweeted
pride is the enemy of growth
1
1
109
Maxwell ꓘ Dulin (Strikeout) retweeted
Web3 bug bounties paid to researchers (estimates): - 2024: ~$24M - 2025: ~$14M - H1 2026: $13.45M One $3M payout was 38% of Q1 2026. 2025 hack losses: ~$3.4B. Bounties ~ 0.4% of that.
7
13
4
172
7,062
Maxwell ꓘ Dulin (Strikeout) retweeted
🚨BREAKING: A Polymarket user put $20 on UNDER 7.5 runs in Yankees–Rays at 0.1% odds after a home run made it 4-4... Officials then overturned the HR for fan interference & no more runs scored, turning $20 into $20,000.
194
314
73
10,137
1,438,445
Maxwell ꓘ Dulin (Strikeout) retweeted
bugbounty.meta.com/payout-gu… Muse bugs pay up to $300k, attack us instead!
$300 for a bug that gives free access to OpenAI’s paid models with no API key or account. Zero reason to report anything else I find to them.
39
78
14
1,868
98,436
Maxwell ꓘ Dulin (Strikeout) retweeted
bro zachxbt is actually insane this man went undercover as a money laundering client spent $350K of his OWN money to gain the trust of a chinese launderer who was moving bybit hack funds for north korea the guy started sharing everything. screenshots. wallet addresses. bridge transactions. in real time zach was matching every single transaction on-chain as the guy was sending them traced $12M+ across bitcoin, ethereum, solana, and tron got tether to freeze $442K from the evidence alone and the funniest part? in between discussing how to launder funds for north korea this guy was casually talking about playing mahjong and his weight loss plan 😭 bro thought he was talking to a client. he was talking to the most dangerous investigator in crypto and zach funded this entire operation himself. $350K out of pocket. no guarantee he'd ever see it back this is not the FBI. this is one guy with a laptop and a blockchain explorer different breed
1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group. Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain.
248
869
71
12,425
888,833
Maxwell ꓘ Dulin (Strikeout) retweeted
btw, this is quite huge. there is no sandbox from any provider today that i would treat as unescapable by a sufficiently capable adversarial agent. containers fell. kvm fell. sandboxing is hard!!!
Full VM escape zeroday (guest>host root in industry standard hypervisors)! More soon
29
34
1
476
26,850
Maxwell ꓘ Dulin (Strikeout) retweeted
let’s go!!!! 1. remember when i said a $200 claude/codex account can have 1000x ROI? this why. 2. game recognizes game, meta security invited harsh to meet at defcon and appreciated how cool the bug was, instead of being angry, surprising 3. image parsers, parsers in general, will keep giving.
Dont be sleeping on Heif Heist! Meta paid 100k for my RCE on FB/Instagram! heif-heist.com/
25
29
2
859
58,331
Awesome podcast episode about the creation, and challenge creation process on CryptoHack. If you run communities or create learning material for others, it's worth a listen! podcasts.apple.com/nl/podcas…
1
136
Maxwell ꓘ Dulin (Strikeout) retweeted
I’ll be speaking at Scale or Die in London this November. Been a wild year for safety and security, can’t wait to share what we’ve learned!
4
16
863
Maxwell ꓘ Dulin (Strikeout) retweeted
Replying to @hrkrshnn
Am I an expert now?
2
1
6
422
Maxwell ꓘ Dulin (Strikeout) retweeted
Bro literally chose to identify as profitable. This is incredible.
JUST IN: Anthropic says they’re highly profitable if you take out some of their biggest expenses.
108
1,394
26
31,273
1,123,471
Jeff does wayyy cooler things than me but still always shares my stuff anyway. Thanks for the support 🫶
From @Dooflin5, a coworker of mine. A browser port of hash_extender for hash length extension attacks: mdulin2.github.io/HashExtend…
1
4
492
Maxwell ꓘ Dulin (Strikeout) retweeted
From @Dooflin5, a coworker of mine. A browser port of hash_extender for hash length extension attacks: mdulin2.github.io/HashExtend…
1
1
1
819
Maxwell ꓘ Dulin (Strikeout) retweeted
All the security researchers right now
7
8
129
7,776
You can now run hash extension attacks from the browser! S/O to Ron Bowes for creating the C-based tool the port was built on: mdulin2.github.io/HashExtend…
3
238
Maxwell ꓘ Dulin (Strikeout) retweeted
🚨 TRENDING: The Patriots reportedly used a clever trick at Gillette Stadium to potentially throw off opposing kickers. On opponent FGs, the video board showed a reverse camera angle that created an offset second set of yellow uprights behind the real goalposts, potentially making kicks more disorienting. After reviewing dozens of examples and 52 Patriots FG attempts, the illusion reportedly appeared on New England’s own kicks ZERO times. (Via @RyanPaganetti)
232
357
94
6,860
920,942