GTM @ Blockaid | Proud father of 3, proud husband of 1, proud supporter of LFC
Leeds, United Kingdom
Joined July 2010
- Tweets1.7K
- Following758
- Followers456
- Likes899
Aaron Holt retweeted
Blockaid is excited to support OUSD on @tempo as an onchain security partner in the ecosystem.
Real-time transaction scanning is live on Tempo, protecting the fintechs and financial institutions moving stablecoins from malicious transactions.
Open USD (OUSD) is live on Tempo, with $400M+ in liquidity at launch.
Issued natively on Tempo, OUSD by @openstandard gives businesses a new stablecoin for payments, settlement, and treasury, with liquidity deployed across decentralized exchanges, stablecoin swaps, and bridges.
Aaron Holt retweeted
An attacker compromised a backend system inside @bitget's wallet infrastructure, spoofing transaction data and draining roughly $350M from hot and warm wallets across 8 chains.
Blockaid's Cosigner and Onchain Monitoring give exchanges an independent check on every withdrawal signature and real-time detection the moment funds move onchain.
Read more: blockaid.io/blog/350m-bitget…
Aaron Holt retweeted
Real-time security that keeps pace with the onchain economy.
Institutions are increasingly moving onchain, and security risk continues to grow. AI-accelerated threats have outpaced rules-based legacy monitoring.
Today we're reintroducing Onchain Monitoring. Over the past year, we've significantly expanded what teams operating onchain can do:
- Auto-Discovery builds a live and continually updated inventory of your assets, keeping coverage current
- Dependency Mapping surfaces and tracks the infrastructure you rely on but don't control
- Ecosystem Incidents Feed alerts on live incidents right in the product, so you can act immediately
- Automated response workflows and a 24/7 war room with our threat intel team turn incident detection into action within minutes
Learn more: blockaid.io/blog/onchain-mon…
Aaron Holt retweeted
Institutions and high frequency traders operating on Hyperliquid still carry their own AML and sanctions obligations.
Blockaid's Risk Exposure runs real-time screening across markets, and Cosigner blocks trades that breach exposure limits.
Read more: blockaid.io/blog/real-time-r…
Aaron Holt retweeted
In H1 2026 alone, onchain incidents hit an all-time high, 3.4x of all of 2025.
Our team has worked alongside our customers and the industry to navigate these hacks.
We have also continued to strengthen our exploit detection platform, our product offerings, and deeply integrated AI into our workflows.
Today we're publishing the Blockaid H1 2026 Onchain Security Report, what we detected across the half, and how our product has matured to meet it.
Aaron Holt retweeted
$1.1B lost across 212 onchain exploits in H1 2026, more than all of 2025 combined.
↓ What Blockaid's data reveals about where the losses came from, and what onchain teams should watch in H2:
In H1 2026 alone, onchain incidents hit an all-time high, 3.4x of all of 2025.
Our team has worked alongside our customers and the industry to navigate these hacks.
We have also continued to strengthen our exploit detection platform, our product offerings, and deeply integrated AI into our workflows.
Today we're publishing the Blockaid H1 2026 Onchain Security Report, what we detected across the half, and how our product has matured to meet it.
Aaron Holt retweeted
🚨 ALERT: Blockaid detected a ~24.15M $USDC exploit on AFX, a third-party bridge protocol on Arbitrum.
Offchain Labs co-founder Steven Goldfeder says the native Arbitrum bridge itself was not hacked or exploited and they are investigating.
Aaron Holt retweeted
Building on Robinhood Chain? @blockaid_ just made their security platform and APIs available to eligible developers, free for up to 90 days.
Learn more by visiting Blockaid.
Blockaid has been a Robinhood Chain partner since Day 1.
Our team has continued to bolster detection across the ecosystem and help protect users from malicious threats. Blockaid already supports Robinhood Wallet by @RobinhoodCrypto, @uniswap, @fomo, and some of the biggest builders in the Robinhood Chain ecosystem.
We're now opening up that same security tooling to Robinhood Chain builders, with access to the Blockaid platform and APIs. Eligible developers can get free access to Blockaid’s platform for up to 90 days.
Get started here: blockaid.io/robinhood
Aaron Holt retweeted
Introducing Blockaid's Risk Exposure:
A real-time onchain compliance solution that lets organizations monitor addresses, transactions, and act the moment they're exposed to illicit funds.
Powered by Blockaid’s first-party signals to make policies programmatically enforceable.
Aaron Holt retweeted
We’ve been working with @blockaid_ on investigating the legacy @humafinance v1 protocol exploit, and for transparency I’m sharing their excellent root cause analysis (link in the first reply).
Here is a TL;DR and the key architectural learnings from the incident. 👇
TL;DR
The Exploit: An attacker found a smart contract bug and drained ~$101K in leftover protocol and pool owner fees from three legacy v1 pools on Polygon.
User Funds: Zero user funds were impacted.
Isolation: This is strictly a v1 issue. It is completely unrelated to PayFi Strategy Tokens (PST), the permissioned v2 pools, or the permissionless programs (PST & Prime).
Solana Programs: The Solana programs feature a fully redesigned architecture and do not contain the exploited functions or logic.
Status: All v1 pools have been paused.
Key Architectural Learnings On the surface, this was a smart contract bug in v1, launched in early 2023, but it highlights several critical protocol design and operational considerations where different paths should have been pursued:
1. Decouple state transitions from complex logic. Functions like _updateDueInfo() and _getDueInfo() carried high complexity to calculate dues and fees. Embedding state transitions within these complex functions is an anti-pattern. This complexity was recognized as unsatisfactory and was completely abandoned during the architecture of Huma v2 smart contracts.
2. Ruthlessly eliminate unused functions. requestCredit() was built to support future expansion but never actively utilized in operations. Non-critical functions inherently receive less testing and security scrutiny, creating an unnecessary attack vector. We even discussed removing it before launch, but kept it under the assumption that it doesn’t add much complexity. If a function isn't required for current operations, it shouldn't be in the contract.
3. Proactively migrate and close legacy pools. Leaving older contracts out on the blockchain creates unnecessary liabilities. With developers and attackers both leveraging AI extensively today, legacy contracts that haven't undergone AI-assisted audits are naturally more vulnerable. Older pools should be actively migrated and fully closed, rather than left running. We were in the process of sunsetting the v1 pools, but didn't have a chance to complete it.
This is a hard lesson. But a hard lesson should never be wasted. Sharing these reflections to help the entire ecosystem in the joint defense against attackers. DeFi United, DeFi Strong! 🛡️
Earlier today a vulnerability in Huma’s legacy v1 contracts on Polygon was exploited for 101,400 USDC.
No user funds at risk and PST is not impacted. Huma’s v2 system on Solana is a complete rewrite and this issue does not apply to v2 systems.
The teams were already in the process of sunsetting all the legacy v1 pools, and have paused v1 completely now.
Aaron Holt retweeted
🚨 Community Alert Blockaid's exploit detection system has detected an exploit on @PolytopeLabs Hyperbridge cross-chain infrastructure and DOT tokens via forged ISMP state proofs on Ethereum, Arbitrum, Base and BSC.
More details:
Aaron Holt retweeted
Sat down for chat with @DenelleDixon on the future of Stellar, privacy and agent payments. And also a bit of @StellarOrg nostalgia. Check it out ⬇️
New block by block → @tomerweller & @DenelleDixon on how Stellar is shipping privacy for institutional finance -- confidential tokens, zero-knowledge proofs, and configurability -- in 2026.
Aaron Holt retweeted
In the last 24 hours, @ResolvLabs USR was exploited with ~80M tokens minted because of a compromised private key.
↓ @blockaid_ detected the exploit in real time and has been monitoring it since.
Aaron Holt retweeted
2 years ago, it was a handful of us building. Today, Blockaid is the trusted security layer for the largest companies operating onchain.
→ SKO 2026 in Miami
→ GTM team 3X'd this past year
→ We're hiring: blockaid.io/careers
One team with a shared vision, having fun doing it.
Aaron Holt retweeted
Funds have been recovered 🔒 with a 10% bounty agreed and covered by the IPOR DAO. This concludes the good-faith white hat incident.
Current Status
• The IPOR Fusion app continues to operate as usual.
• No other Fusion vaults share the conditions required for this attack vector.
• The incident was isolated to one legacy IPOR USDC Fusion vault on Arbitrum, which remains paused.
• Root cause involved external factors (Pectra / ERC-7702) combined with a legacy validation gap - not part of core Fusion infrastructure.
Sincere thanks to @hexagate_, @blockaid_, @blocksecteam, and @_SEAL_Org for their notification, assistance, and coordination.
All affected depositors will be made whole.
Further updates and coordination with impacted users will be shared in IPOR's Discord.
🚨 Security Update: IPOR USDC Fusion Optimizer on Arbitrum Vault Exploit
The IPOR team was alerted on January 6th by @hexagate_ and @blockaid_ regarding a malicious transaction. Following a swift investigation, we have identified an exploit resulting in a loss of $336K USDC.
The Details:
• Root Cause: The exploit targeted a specific legacy Fusion vault.
• Scope: Due to its unique configuration, this was the only vault vulnerable to this specific attack vector.
• Impact: The loss represents less than 1% of total funds secured by Fusion.
Next Steps & Recovery:
• Recovery: We are collaborating with @_SEAL_Org and relevant security entities to track and recover the funds.
• Depositor Security: The IPOR DAO will patch the shortfall from the treasury. All affected depositors will be made whole.
• Safety: No other Fusion vaults are affected
Find the full technical post-mortem here
blog.ipor.io/post-mortem-ipo…
