AuditHub

lgw mode nff

privacy = face covered so he shouldnt have taken the mask off �👀👀👀👀�

207 security incidents in six months, a record and more than double the same period last year. The main thing that changed is the price of finding a bug.

An hour per bug. That was the cost of tracing why a ZK circuit failed its proof, by hand. @ShankaraPailoo2: an AI pass named the cause in seconds. Developers confirmed every one.

15% of crypto security incidents in H1 2026 accounted for 76% of the money stolen. Those were compromised keys and signing infrastructure. Smart contract exploits made up most of the incidents and only a small share of the losses.

Your audit is a photograph. Your codebase is a video. That gap was survivable while exploits were expensive to write. AI closed it from the attacker side first. @KFerles on the shift from point-in-time review to continuous security

A zkVM exists to prove a program ran correctly. A critical bug in its circuits undermines exactly that. An AI agent, running unattended, found seven across Ceno and Pico. Two production zkVMs. @ShankaraPailoo2 on the part that matters: this used to take an engineer days.

Up to an hour. That was the cost of reading one Picus counterexample by hand. @ShankaraPailoo2 on what happens instead now: the counterexample and the circuit go to AI triage, which returns the root cause class. Proving was never the bottleneck. Triage was.

Your last audit has a date on it But do you know how many commits have shipped since then ?

"AI has been a ‘net negative’ for crypto" AI is making attackers faster. Your audit cadence hasn't changed. Quarterly reviews can't outpace automated exploit generation.

@KFerles: A defender has to find every vulnerability. An attacker needs one. AI just made finding that one cheaper. Point-in-time audits cannot keep pace with that. Exploits climbed in the first half of this year. Continuous validation is the only way defenders catch up.

1/ External calls are the bread and butter of on-chain code. Their presence is not a red flag. 2 things are. A state update landing after the call, and control handed to code nobody vetted.

AI agents executing payments on your behalf raise one problem manual review can't close: you need to reason about every possible execution path, not the handful you thought to test. that's a formal methods problem

2 things make an external call worth worrying about. A state update landing after it, and control handed to code nobody vetted. One reward calculation had the second, on purpose. $27M.

Exploits got cheaper to generate. Patching after launch did not. @KFerles on where security has to move. Check invariants with humans and AI at the design phase. Then run static analysis and AI scanners on every commit. Earliest catch is always the cheapest fix.

Mina's chain upgrades can force every zkApp to rotate its verification key, and a regular multisig would brick trying to keep up. @VeridiseInc reviewed how Mina Multisig solves that with FROST, tracked on AuditHub, before @nori_zk shipped it on @MinaProtocol. Now open source for any Mina team building wallet or self-custody tooling.