Blockchain & Smart Contract Security Specialists - Contact us to request a Web3 Security Audit.
Joined June 2022
- Tweets1.9K
- Following5.5K
- Followers12.2K
- Likes6.9K
Pinned Tweet
1/ Tampered #Ledgers with a hidden cellular implant are being sold through third-party resellers in Southeast Asia.
The implant reads your 24 words during setup and sends them over LTE. Genuine Check doesn't catch it.
Full read: hashlock.com/blog/is-your-le…
Six checks:
1/ Patch your PHP today.
Two critical bugs in PHP itself (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) let an attacker run code on your server with one web request. No login needed.
Exploit attempts are already being seen.
Full guide: hashlock.com/blog/patch-your…
3/ Why Web3 teams should care: your audit covers your contracts, not the server behind your website, presale page or admin panel.
From there an attacker can inject a wallet drainer on your real domain, swap deposit addresses or read the keys in your .env.
2/ The fix: update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart every PHP worker.
Check the version your web server runs, not just the command line. On managed hosting, ask your host today.
Hashlock is shortlisted for Best Cybersecurity Platform at the AIBC World Awards 2026
Voting is open until 26 Oct. If our audits or research have helped your team, we would be grateful for your vote:
aibc.world/aibc-world-awards…
Winners are announced on 3 Nov in Rome
thank to our friends @AIBC_World
Audit, fix, re-test, fix review, then deposits. @edgechainai is doing it in the right order
Audit Update, and hopefully our final one 🔒
We're on what we hope is the final round of audits on our vault contracts. V5 has been submitted to @hashlock for their fix review. The serious issues from the earlier rounds are already fixed. V5 resolves the remaining low findings from the last report.
What V5 adds:
- Withdraw any time. Most of your share comes back instantly. The part that is in live bets is paid out once those bets settle, so no one can dodge a loss at the expense of other depositors.
- Tighter controls on how capital moves to and from the betting side.
Before it went back to Hashlock, V5 passed nearly 100 automated tests and tens of thousands of randomised transactions.
Nothing goes live until Hashlock has reviewed the fixes. Once they sign off, we'll share the full report publicly, alongside the penetration test we also completed with them, and open deposits. Before taking in funds, we want every line of code checked by the best in the industry, for our own peace of mind and for everyone depositing.
Hashlock retweeted
Pegged swap pricing must hold under every input. @Hashlock_ audited the PeggedSwap instruction's pricing and invariant math.
One of 8 independent Aqua and SwapVM audits.
To you, a dollar of USDC and a dollar of DAI are the same dollar. Inside a contract, making that true is real engineering. 💧
@1inch Aqua is a shared liquidity layer from 1inch. Your assets stay in your wallet and back multiple positions at the same time, each one running as a small program on SwapVM. PeggedSwap is the instruction built for assets designed to hold a 1:1 price, and the invariant normalization behind it is what keeps that price honest inside the math.
Back in March we audited Aqua and found a spot where that math broke. 1inch fixed it, and the contracts came out Hashlocked, our highest rating.
Most teams this big would call one audit enough. 1inch is already back for round two. #️⃣🔒🦄
📘 Full audit: hashlock.com/audits/1inch
🌐 1inch.com
7/ The full read, with teardown photos of tampered devices we've seen: hashlock.com/blog/is-your-le…
Thanks to @MagicalTux for the hands-on teardown work that has helped a lot of people check their devices
6/ Found something? Stop using it. If it holds funds, move them now and treat that recovery phrase as known to the attacker. Report it to Ledger and the seller.
Never share your recovery phrase with anyone, researchers included.
5/ Open it and compare the board with Ledger's reference photos for your model.
Red flags: loose or hand-soldered wires, an antenna or coax cable, a second board, a SIM or cellular module, chip markings sanded or blacked out.
4/ The recovery sheet must be blank, with no preset PIN. Your 24 words come from the device during setup, never from the box.
5. Run the Genuine Check in Ledger Wallet. A pass proves the secure chip is real, not that nothing was added around it.
3/ Checks 1 to 3, no tools needed:
1. Not bought from ledger.com? Flag it and open it (check 6). Factory shrink wrap proves nothing.
2. Arrived without an order? Ledger never sends surprise replacements.
3. Box opened or resealed? Stop there.
An AI agent trained on your work should belong to you, and only you. @cortis_ai built it that way. 🤖
Cortis gives you one personal operator with a small team of 3 to 5 specialists. They learn from your private context and remember it, and each one is soulbound to its owner, so it can't be sold or handed to someone else.
When a specialist finishes something, it goes into a signed log, and once a day that log is anchored on BNB Chain. Your documents and conversations stay private. What goes on chain is proof that the work exists and when it happened.
That proof is only worth something if the contracts keeping it are right. We went through all four of them, from the passports to the attestation logic. The rating came back Secure, and every finding was fixed.
📘 Full audit: hashlock.com/audits/cortis
🌐 cortisai.com
To you, a dollar of USDC and a dollar of DAI are the same dollar. Inside a contract, making that true is real engineering. 💧
@1inch Aqua is a shared liquidity layer from 1inch. Your assets stay in your wallet and back multiple positions at the same time, each one running as a small program on SwapVM. PeggedSwap is the instruction built for assets designed to hold a 1:1 price, and the invariant normalization behind it is what keeps that price honest inside the math.
Back in March we audited Aqua and found a spot where that math broke. 1inch fixed it, and the contracts came out Hashlocked, our highest rating.
Most teams this big would call one audit enough. 1inch is already back for round two. #️⃣🔒🦄
📘 Full audit: hashlock.com/audits/1inch
🌐 1inch.com
You set the perfect Uniswap V3 range. Then the price moved. 🎯
@QuantumPoolsIO moves your range for you. Their keeper snuggles it back next to the price at the same width and never swaps your tokens to do it. It even pays the gas.
The vault holds your position, but only your wallet can withdraw, and pausing the protocol doesn't stop that.
We went through all five contracts, then checked that the vaults live on Robinhood Chain and Base run the exact code we signed off on. The rating came back Secure. 🔐
📘 Full audit: hashlock.com/audits/quantum-…
🌐 app.quantumpools.io
Thank you @Whitechain_io. Security deserves the main stage, and today it got one
Thanks to @CoinFerenceX for hosting, and to everyone who came to Panel 05
HackenProof at @CoinFerenceX Singapore 2026
Today, our CTO @d0rsky joined the panel:
“Securing Institutional Capital: Custody, Exploits and the New Threat Landscape”
Alongside:
▪︎ Jason Jiang from @CertiK
▪︎ @jockhaslam from @Hashlock_
▪︎ @raopreetam_ from @QuillAudits_AI
Moderated by Adam Wasserman from @IOGroup.
It was a thoughtful exchange on the security challenges shaping institutional adoption. 🙌
#CoinFerenceX #HackenProof
Thank you @CoinFerenceX for having @jockhaslam on today's panel on custody, exploits and the new threat landscape
Good to share the stage with fellow security teams
Institutions coming on chain should have this conversation before they launch, not after
📅 DAY 1 · PANEL 05:
Securing Institutional Capital: Custody, Exploits and the New Threat Landscape
As institutional capital flows into Web3, bulletproof security and custody are non-negotiable. We are bringing together top security experts and auditors to discuss mitigating exploits and navigating the evolving threat landscape.
Meet the Speakers:
🎙 Jason Jiang | Chief Business Officer, @CertiK
🎙️ @d0rsky | CTO, @HackenProof
🎙️ @jockhaslam | Founder & CEO, @Hashlock_.
🎙️ @raopreetam_ | CEO, @QuillAudits_AI
Moderated by:
🎤 Adam Wasserman | VP of Investments, @IOGroup
Session Details:
🗓 Date: Day 1 | Mon 5 Oct 2026
⏰ Time: 2:10 PM – 2:50 PM
📍 Venue: Gardens by the Bay, Singapore
📅 RSVP on Luma: luma.com/cfx-tbe-summit
#CoinFerenceX #TheBestEvent
See you at @CoinFerenceX Singapore, 5 to 6 Oct at Gardens by the Bay. @jockhaslam is on stage, and Hashlock team is in town for #TOKEN2049 week
Meet @jockhaslam, Founder & CEO of @Hashlock_, onstage at CoinFerenceX The Best Event Singapore.
A leader in blockchain cybersecurity and smart contract auditing, Jock and Hashlock use manual, research-driven security analysis to protect billions in digital assets, from Web3 startups to global blockchain enterprises.
Building safer infrastructure for the next era of Web3, Jock is at the forefront of blockchain security.
📍 5–6 Oct 2026
📍 Gardens by the Bay, Singapore
Stay tuned, more big names dropping soon.
📅 RSVP on Luma: luma.com/cfx-tbe-summit
🤝 Sponsor or partner: coinferencex.com/singapore/a…
#CoinFerenceX #TheBestEvent #Hashlock #BlockchainSecurity #Web3 #Cybersecurity #SmartContracts #Singapore
