0.12 darkmode-2026 2026-02-16 2026-02-18 3 00:05 https://darkmode.securityalliance.org https://darkmode.securityalliance.org/media/darkmode-2025/img/logo_OUhNnx6_3LLp8Fb.webp US/Mountain Auditorium Short Talk 2026-02-16T09:45:00-07:00 09:45 00:05 samczsun welcomes you to SEAL's first annual security conference, darkMode darkmode-2026-89203-welcome-to-darkmode Other samczsun en false https://darkmode.securityalliance.org/darkmode-2026/talk/WLMELT/ https://darkmode.securityalliance.org/darkmode-2026/talk/WLMELT/feedback/ Auditorium Short Talk 2026-02-16T09:50:00-07:00 09:50 00:20 Your smart contracts are audited, but is your contractor’s laptop? Most Web3 "hacks" aren't complex cryptographic exploits—they're basic Web2 security failures. From weak Discord credentials to unmanaged endpoints, many web3 companies have forgotten the web2 security fundamentals. Join Andrew, a Mandiant/Google Cloud security expert with a decade of experience securing global financial giants, as he deconstructs the traditional attacks currently gutting the Web3 ecosystem. Learn why your "decentralized" future is failing at the basics, and how you can balance security and user privacy. darkmode-2026-89303-old-hacks-targeting-new-industries-how-to-balance-user-privacy-and-security Lessons Learned Andrew Chang-Gu en In this talk, we will discuss common cyber threats facing web3 firms and the security controls that can stop them. Topics include: Identity and access management: conditional access, device posture checking Ways to deploy security controls on end-user machines while respecting user privacy Conducting due-diligence checks on a multinational, contractor-led workforce, insider threat protections and social engineering awareness Managing IT infrastructure such as servers, laptops and phones, including logging and monitoring false https://darkmode.securityalliance.org/darkmode-2026/talk/CFCU37/ https://darkmode.securityalliance.org/darkmode-2026/talk/CFCU37/feedback/ Auditorium Closed Room Session 2026-02-16T10:10:00-07:00 10:10 00:20 Wireless networks, a ubiquitous and often overlooked element of Web3 projects, pose a significant operational security (OPSEC) risk due to a phenomenon called "beaconing." As mobile devices move, they publicly disseminate personally identifiable information (PII) that malicious actors can combine with open-source intelligence (OSINT) to infer a user's travel plans, physical addresses, past conference attendance, associated crypto projects, and even the location of hardware wallets. This vulnerability contributes to the increasing threat of physical attacks (such as kidnapping and ransom, or "wrench attacks") and social engineering, as well as the risk of disclosing material nonpublic information. This workshop will walk attendees through using readily available tools to collect and analyze everyday wireless signals. Hardware crypto wallets will be made available for analysis. Other secure tooling will be observed. Will there be enough information in the room to identify devices, individuals, crypto wealth? We will see. darkmode-2026-88227-safeguarding-your-digital-footprint-a-privacy-first-approach-to-web3-opsec Privacy Benjamin Speckien en As you move through the world, your devices connect to wireless networks and collect unique identifiers. Your mobile devices may be broadcasting these sensitive artifacts, possibly personally identifiable information (PII), through probes and beacons. These wireless signals can be combined with open-source intelligence (OSINT) to compromise your privacy, revealing your travel history, physical location, and even the existence and location of your hardware wallets. This data is an asset to malicious actors: enabling pretexting for social engineers, exposing daily routines to physical attackers, or providing partnering information to data-hungry degens. This workshop demonstrates a privacy-focused security paradigm for the Web3 space. It moves beyond on-chain contracts to detail the off-chain vulnerabilities in Wi-Fi and Bluetooth signals. Learn how to collect and analyze potentially sensitive wireless signals. Examine your digital footprint in a way an attacker would. We will also discuss practical mitigation strategies and best practices necessary to secure your wireless devices, protect your personal safety, and ensure the operational integrity of your Web3 projects in a world where physical and digital security are inextricably linked. To participate in this workshop, please bring a Macbook, Linux Laptop with a wireless card that supports monitor mode, or an Android device. false https://darkmode.securityalliance.org/darkmode-2026/talk/UDCWH3/ https://darkmode.securityalliance.org/darkmode-2026/talk/UDCWH3/feedback/ Auditorium Short Talk 2026-02-16T10:30:00-07:00 10:30 00:20 I will present a summary of how 2FA works, the different methods (SMS, TOTP apps, Yubikeys, Passkeys, etc), the weaknesses each one of them have, how they are being exploited, and what we have to do in order to start using 2FA in a safe way. darkmode-2026-89930-totp-apps-are-dead-and-why-you-are-doing-2fa-wrong Hot takes Pablo Sabbatella en I will present a summary of how 2FA works, the different methods (SMS, TOTP apps, Yubikeys, Passkeys, etc), the weaknesses each one of them have, how they are being exploited, and what we have to do in order to start using 2FA in a safe way. false https://darkmode.securityalliance.org/darkmode-2026/talk/CYHTKN/ https://darkmode.securityalliance.org/darkmode-2026/talk/CYHTKN/feedback/ Auditorium Short Talk 2026-02-16T10:50:00-07:00 10:50 00:20 Web2 is the Soft Underbelly of Web3 Web3 Security has a Web2 Security problem. As on-chain code gets better and better, attackers are going to go after the low-hanging fruit--and that means all the boring "legacy cybersecurity stuff" your grandpa used to tell you about. (See: the ByBit hack in Feb 2025, classic web2 compromise with web3 impact). "Back in mah day, we cared about phishing and end point device security. Oh, and young whippersnapper, and did you know 'the cloud' just means 'someone's else's computer'? Sure seems like a terrible idea to run all yer validators in (checks notes) AWS, doncha think? Using CIA's preferred cloud vendor--that'll stick it to the man fer sure LOL!" "and betcha never heard of this here dang thing called a SIEM before either, have yeah?" I once met a security engineer at a conference who described themselves as a "web3 native security engineer". Couldn't explain TCP/IP, how Linux works, how a browser works, couldn't tell me the OSI model, but boy did they know a lot about Solidity security! Yeah. Don't be that guy. Cuz you're going to get rekt if you do. Come to grandpa's[*] curmudgeonly fireside chat to hear about all the old stuff that still matters today. [*] not an actual grandpa. yet. darkmode-2026-88221-get-off-my-lawn-you-re-forgettin-your-web2-security-risk-young-whippersnapper Hot takes J.M. Porup en false https://darkmode.securityalliance.org/darkmode-2026/talk/7ZHSK9/ https://darkmode.securityalliance.org/darkmode-2026/talk/7ZHSK9/feedback/ Auditorium Short Talk 2026-02-16T11:10:00-07:00 11:10 00:20 In 2025 alone, Immunefi paid out close to $11,000,000 in bug bounties for critical crypto vulnerabilities. preventing exploits that could have resulted in hundreds of millions of dollars in losses. This talk breaks down a few of the highest-impact bounty payouts of 2025, focusing on what actually drove seven-figure and high six-figure rewards. We’ll examine specific vulnerabilities, system designs, and attacker mindsets behind the most severe findings, and explain why these specific bugs justified such large payouts. This session is grounded in specific cases in 2025 across DeFi, bridges, L2s, and core infrastructure. Attendees will gain a practical understanding of where the highest paying security risks surfaced in 2025, and what both researchers and protocol teams should prioritize going forward. darkmode-2026-88171-inside-immunefi-s-highest-paying-bug-bounties-of-2025 Lessons Learned Alejandro Munoz-McDonald en This talk is structured around a small number of high-impact 2025 case studies, including: - The technical root cause of some of the largest bounty payouts of the year - How these vulnerabilities could have been exploited in the wild - What made these reports stand out and qualify for top-tier rewards Each case is anonymized or based on information approved for public disclosure, and is used to extract concrete lessons for: - Whitehats looking to focus on high-impact targets - Protocol teams aiming to prevent catastrophic bugs - The goal is to give attendees a realistic picture of what “critical” actually looks like in 2025 crypto systems. false https://darkmode.securityalliance.org/darkmode-2026/talk/P8GGKC/ https://darkmode.securityalliance.org/darkmode-2026/talk/P8GGKC/feedback/ Auditorium Short Talk 2026-02-16T11:30:00-07:00 11:30 00:20 AppleJeus, also known as Citrine Sleet, Gleaming Pisces, and Smooth Operator, is the North Korean hacker behind the Radiant Capital heist among others. This is the story of finding a previously undiscovered AppleJeus campaign targeting fintech. This talk will also give some background on North Korean hacking groups, show simple pivoting for analysts, and give recommendations to help protect your organization from North Korean threat actors. darkmode-2026-86974-when-the-applejeus-github-is-worth-the-squeeze Lessons Learned Daniel Gordon en This talk will have a little bit of everything! Collaboration between different North Korean hacking groups! Involvement in hacking by North Korean IT workers! Activity across platforms including GitHub, NPM, PyPI, Twitter, and Discord! false https://darkmode.securityalliance.org/darkmode-2026/talk/ESCYXL/ https://darkmode.securityalliance.org/darkmode-2026/talk/ESCYXL/feedback/ Auditorium Short Talk 2026-02-16T13:00:00-07:00 13:00 00:20 Security Alliance (SEAL) is developing an open, collaborative certification program to help the crypto ecosystem define and demonstrate operational security maturity. Built on lessons learned from years of emergency incident response and threat intelligence sharing, SEAL Certifications distill collective knowledge into actionable standards developed openly with the community. For protocols, this means clear guidance to strengthen security posture and a credible way to signal trustworthiness to users, investors, and insurers. Currently in pilot with full rollout planned for 2026, this talk introduces the certification framework and how protocols and security firms can get involved. Presented by Isaac Patka, initiative lead. darkmode-2026-89204-seal-certifications-a-collaborative-framework-for-maturity-in-crypto-security New Announcements Isaac Patka en false https://darkmode.securityalliance.org/darkmode-2026/talk/JNGY3E/ https://darkmode.securityalliance.org/darkmode-2026/talk/JNGY3E/feedback/ Auditorium Short Talk 2026-02-16T13:20:00-07:00 13:20 00:20 We often analyze the "social engineering" behind cryptocurrency fraud, but we rarely discuss the coercion that powers it. Trust is manufactured at gunpoint in scam compounds around the world. This talk exposes the reality of the industrialized criminality, where human trafficking fuels the global theft of digital assets. We will trace the operation from the ground up: from the fake job ads that entrap the workforce to physical compounds like those in Myanmar where victims are forced to execute the fraud. Drawing on active field intelligence and exclusive documentary footage, we will map the full cycle of the crime. This is a look at how criminal syndicates have weaponized human captivity to exploit the cryptocurrency ecosystem. darkmode-2026-89205-trafficked-trust-the-human-cost-of-crypto-scams Lessons Learned dobs en false https://darkmode.securityalliance.org/darkmode-2026/talk/UVLUSC/ https://darkmode.securityalliance.org/darkmode-2026/talk/UVLUSC/feedback/ Auditorium Short Talk 2026-02-16T13:40:00-07:00 13:40 00:20 I want to introduce the fund to gather awareness! There was some left over funding in TheDAO (Over 70k ETH) and we want to use it to fund ETH Security projects! darkmode-2026-86679-thedao-security-fund New Announcements Griff Green en false https://darkmode.securityalliance.org/darkmode-2026/talk/DTHPTP/ https://darkmode.securityalliance.org/darkmode-2026/talk/DTHPTP/feedback/ Auditorium Short Talk 2026-02-16T14:10:00-07:00 14:10 00:20 A deep dive into the CPIMP vulnerability—how a stealthy proxy-in-the-middle attack infected dozens of DeFi protocols across chains, embedded persistent backdoors, and how Dedaub and SEAL 911 raced to neutralize it before widespread exploitation. darkmode-2026-88140-the-cpimp-backdoor-anatomy-of-a-multi-chain-proxy-attack Vulnerability Disclosure Neville Grech en This talk unpacks the CPIMP (Clandestine Proxy In the Middle of Proxy) attack, a stealthy, highly sophisticated DeFi vulnerability that threatened millions of dollars across dozens of protocols and multiple EVM chains. CPIMPs masqueraded as legitimate proxy contracts while embedding persistent backdoors, often lying dormant for months until optimal conditions arose. The attacker employed advanced evasion techniques, including spoofed events, dummy storage writes, and aggressive anti-recovery logic, successfully deceiving common analysis workflows and even public explorers. We’ll walk through how Dedaub reverse-engineered the attack, identified affected deployments, and led a coordinated, multi-chain mitigation effort through SEAL 911. The session distills practical lessons on detecting deeply hidden threats, responding under time pressure, and maintaining continuous monitoring across chains. false https://darkmode.securityalliance.org/darkmode-2026/talk/AZ77PD/ https://darkmode.securityalliance.org/darkmode-2026/talk/AZ77PD/feedback/ Auditorium Panel 2026-02-16T14:30:00-07:00 14:30 00:45 Home invasions and physical attacks to get crypto transfers are all too common, and have led to grim situations. With all the factors, passphrase and biometrics in the world, people remain susceptible to the rubber hose. This panel will discuss theories and practices for defending against a rubber hose attack, through deterrence, defenses and mitigations. We will start with the assumption that the goal is to preserve life and limb, and preventing or reversing token transfer is secondary, but how to get there, and be reasonably confident that it will not backfire, is hard. darkmode-2026-88332-stopping-the-rubber-hose-attack-hot-takes Hot takes smagdaliKurt OpsahlElliot en The panel will provide their hot takes and deep wisdom on these questions: How do we increase the attackers costs and risks, and reduce the odds of profit? What methods can prevent/slow/reduce fund transfer can be done safely, without undue risk? Would you rather a remote multisig that would never sign if your under duress, or would sign to pay the ransom? What methods to bring help (police/private security) can help with safety, with undue risk How can we establish norms and widely held understandings to create a disincentive for the attacker to try? How can one hide their holdings from the public in a transparent blockchain world? What can we learn from the history with fiat, where home invasion and the rubber hose is not as frequent Not common in CashApp/Venmo/Wires etc. Kidnapping for fiat ransom is an analogy, usually target very wealthy Shorter term kidnapping for a ride to ATMs Can you tech your way out of the problem by being super clever? Dummy accounts, honey pots, tainted transfers false https://darkmode.securityalliance.org/darkmode-2026/talk/PBPFE3/ https://darkmode.securityalliance.org/darkmode-2026/talk/PBPFE3/feedback/ Auditorium Short Talk 2026-02-16T15:15:00-07:00 15:15 00:20 Wallet Drainers and other forms of phishing try to hide from security systems designed to catch them. From Query param keys, to fake blog posts, and time limited attacks, there are many ways that scammers hide their sites from detection and blocklisting. In this talk we will go over the latest cloaking techniques these sites use, approaches to bypassing cloaking, and some unsolved problems that will spark ideas. darkmode-2026-88242-bypassing-cloaking-when-hunting-phishing-sites Lessons Learned Nikita Varabei en false https://darkmode.securityalliance.org/darkmode-2026/talk/9YPLDE/ https://darkmode.securityalliance.org/darkmode-2026/talk/9YPLDE/feedback/ Auditorium Short Talk 2026-02-16T15:35:00-07:00 15:35 00:20 In the security industry, we often take well-established development practices, such as the DevOps infinity loop, add a layer of security, and label it "DevSecOps." However, this approach frequently overlooks a critical issue: layering complex security processes onto efficient development processes can create inefficiency. In this talk, I argue that true innovation in security comes not from tooling or automation alone, but from mastering the underlying process first. By drawing an analogy to simple machines — where incremental improvements led to the evolution of tools like levers, wheels, and pulleys — I will illustrate how optimizing foundational processes leads to scalable, effective security practices. Attendees will leave with practical insights on reducing inefficiencies and fostering consistent improvement in their security workflows. darkmode-2026-85939-mastering-security-through-simple-machines-how-consistency-not-complexity-drives-innovation Hot takes Ken Toler en **1. Introduction: The Problem with Complexity in Security** - The security industry often adopts development frameworks, such as DevOps, and layers security onto them, creating frameworks like DevSecOps. - The issue: security processes are frequently complex and inefficient compared to streamlined development processes. - Key point: You can't automate something that is inefficient. Applying generative AI or advanced tooling to broken processes won’t fix them. - Outcome: This leads to frustration, bottlenecks, and unmet security goals. **2. The Analogy: Security Processes as Simple Machines** - Introduction to simple machines: lever, wheel, pulley, etc. - Simple machines represent fundamental tools that evolve through mastery and incremental improvement. - Just as a lever becomes more efficient when transformed into a wheel or pulley, security processes must evolve through optimization. - Example: A long, inefficient SAST (Static Application Security Testing) scan taking two days doesn’t fit into a two-week sprint. Simply automating it doesn’t solve the problem; instead, the process itself must be optimized. **3. Evolution of Security Processes through Consistency and Optimization** - Consistency is key: innovation stems from mastery and consistent refinement, not from one-time application of advanced tools. - Case study: Improving SAST scans - Initial state: A full SAST scan that takes two days to complete. - Optimization: Breaking the scan into targeted components, running incremental scans, or using real-time feedback tools. - Result: A faster, more efficient process that integrates seamlessly into the development lifecycle. - Key takeaway: The goal is not to add complexity but to create efficiency through iteration. **4. The Futility of Applying AI to Broken Processes** - Generative AI and other advanced technologies can enhance efficient processes but cannot fix broken ones. - Example: Applying AI to prioritize vulnerabilities from an inefficient scanning process will still result in a flood of low-value alerts. - Solution: Fix the underlying process first, then enhance it with automation and AI. **5. Practical Steps to Achieve Process Mastery** - Identify inefficiencies: Audit current security processes to find bottlenecks and pain points. - Apply incremental improvements: Start with small changes and measure their impact. - Leverage automation only after optimization: Use tools to enhance an already efficient process. - Foster a culture of continuous improvement: Encourage teams to regularly review and refine processes. **6. The Path Forward: Consistency as a Driver of Innovation** - Innovation doesn’t come from adding complexity; it comes from consistently improving simple, well-understood processes. - Just as simple machines evolved over time into more complex but efficient systems, security processes must evolve through incremental mastery. - Final analogy: A poorly applied lever remains inefficient regardless of how much force is applied; a well-crafted pulley system, however, can lift tremendous weight with minimal effort. **7. Key Takeaways for the Audience** - Stop trying to automate inefficiency: Focus on optimizing the underlying process first. - Consistency drives innovation: Regular, incremental improvements lead to breakthroughs. - Simplicity is powerful: Don’t overcomplicate security; instead, seek mastery of foundational processes. **8. Closing Thoughts and Call to Action** - Challenge to attendees: Audit one core security process in your organization and identify an inefficiency. Implement one small, consistent change and measure the impact. - Final words: True security innovation comes not from flashy tools but from mastering the basics and improving them consistently over time. false https://darkmode.securityalliance.org/darkmode-2026/talk/JQBPDF/ https://darkmode.securityalliance.org/darkmode-2026/talk/JQBPDF/feedback/ Auditorium Short Talk 2026-02-16T15:55:00-07:00 15:55 00:20 Security exploits in decentralised systems are rarely caused by technical failures alone. Instead, they emerge at the edges between code, incentives, and institutions - where authority is informal, coordination is improvised, and legitimacy is contested. Drawing on multi-year ethnographic research embedded in decentralised security communities and real world experience in security practices, this talk reframes security as a socio-technical phenomenon: one sustained not only by protocols and tools, but by moral codes, information practices, incentive structures, and cross-institutional coordination. While the ecosystem is still (rightly) investing heavily in technical interventions (such as improved wallets and developer tooling), many high-impact dynamics remain under-acknowledged, including white-hat incentives, incident information formats, coordination with traditional authorities, and the physical and organisational realities of security work. The presentation outlines key findings from a forthcoming book on blockchain security, followed by a practitioner response and Q&A with Matta from The Red Guild, who works daily on frontline interventions including phishing education, operational security guidance, and adversarial response. Together, the session bridges analytical diagnosis with operational reality, offering security professionals a clearer map of the system they already inhabit—and a basis for thinking differently about where leverage actually lies, and what needs to be done to improve the state of blockchain security. darkmode-2026-87763-security-between-the-code-why-technical-excellence-can-fail Lessons Learned Kelsie Nabbenmatta en Purpose and Value This presentation is designed to respect the time and expertise of security professionals. It does not seek to explain technology to technologists, nor to moralise security practice. Instead, it aims to: Reframe familiar problems with analytical clarity Surface high-impact dynamics that are widely experienced but rarely formalised Offer a shared language for discussing coordination, incentives, and legitimacy in decentralised security The primary objective is practical: to provide conceptual tools that help practitioners better understand why certain security interventions succeed, stall, or repeatedly re-emerge in new forms. Audience: Security engineers and incident responders Security researchers and threat-intelligence professionals Protocol teams and infrastructure operators Policy and governance specialists engaging decentralised systems Other presenter: Matta, The Red Guild false https://darkmode.securityalliance.org/darkmode-2026/talk/NYFCXC/ https://darkmode.securityalliance.org/darkmode-2026/talk/NYFCXC/feedback/ Auditorium Long Talk 2026-02-16T16:15:00-07:00 16:15 00:45 Multisig wallets give holders a false sense of security. The real attack surface isn't key compromise, it's all of the human and non-deterministic elements. Spoofed simulations, poisoned addresses, compromised frontends, and coerced signers all exploit the same gap. Users don't know what they're signing, and by the time they find out something is wrong, it's already too late. This talk introduces a threat model for high-value custody and presents Kleidi, a wallet system built around reversibility, configurable policies, and guardian-based recovery. darkmode-2026-87916-why-your-multisig-won-t-save-you-attacks-against-high-value-holders New Announcements Elliot en Large crypto holders face well-resourced adversaries using attack vectors that multisig alone cannot address. This talk walks through six categories of threat: simulation spoofing, address poisoning, frontend compromises, supply chain attacks, insider threats, and kidnapping or duress scenarios. Each attack exploits a common weakness: the finality of signed transactions and the opacity of what's actually being approved. We'll examine real incidents, break down why existing solutions fail, and introduce a defense framework centered on post-signature review windows and cancellation authority. The session concludes with a demonstration of Kleidi, a wallet implementation that operationalizes this framework through timelocks, policy engines, and guardian services. Attendees will leave with a threat model they can apply to custody architecture reviews and a concrete reference for how reversibility changes the security calculus. false https://darkmode.securityalliance.org/darkmode-2026/talk/DQ3T8W/ https://darkmode.securityalliance.org/darkmode-2026/talk/DQ3T8W/feedback/ Auditorium Panel 2026-02-17T09:30:00-07:00 09:30 00:45 Autonomous agents are moving from experiment to infrastructure. They're sharing tools, communicating with each other, and increasingly operating with real money. But the security conversation hasn't caught up. What happens when an agent gets compromised through shared tooling? How do you lock down something designed to act independently? And when agents need wallets to function, what does crypto security teach us about protecting them? darkmode-2026-90733-when-agents-get-tools-security-for-autonomous-systems Hot takes Consensys DiligenceAndrew MacPherson (AndrewMohawk) '<#<h1>Alex Stokes en Agents are everywhere now. They're in our workflows, they're talking to each other, and some of them have wallets. Most conversations about this are either hype or hand-wraving. This one won't be. We've assembled panelists who genuinely disagree on where the risks are and how to handle them. Some think crypto's hard-won security lessons translate directly. Others aren't convinced. Some see agent-to-agent communication as the real threat vector. Others worry more about what happens when an agent can spend money without asking. We'll get into the uncomfortable questions. Can an agent be socially engineered? If one agent infects another through shared tooling, whose problem is that? When autonomy is the feature, how do you even define containment? And can we flip the script entirely, using adversarial agents as security tools rather than threats? No consensus guaranteed. Come ready to think. false https://darkmode.securityalliance.org/darkmode-2026/talk/7FKKPQ/ https://darkmode.securityalliance.org/darkmode-2026/talk/7FKKPQ/feedback/ Auditorium Short Talk 2026-02-17T10:15:00-07:00 10:15 00:20 Everyone and their mother is trying to launch an AI auditing tool (usually meaning an LLM-based auditing tool). Do they perform any better than cats at auditing? Do they fill the same market purpose as auditing? This talk will take a praxeological approach to the question (as opposed to an empirical/scientific approach), so buckle up for some half-baked un-substantiated opinions! Mixed in will be some things I do think LLMs are good for in the auditing process, and some ideas of other approaches that may work better (some even being taken by some teams already). darkmode-2026-88231-llm-auditing-better-than-cats Hot takes Everett Hildenbrandt en false https://darkmode.securityalliance.org/darkmode-2026/talk/KL3EBP/ https://darkmode.securityalliance.org/darkmode-2026/talk/KL3EBP/feedback/ Auditorium Short Talk 2026-02-17T10:35:00-07:00 10:35 00:20 Smart-contract security has reached a scale where purely manual review no longer keeps pace. However, fully automated AI auditors may miss context, intent, and threat models that experienced reviewers take for granted. This talk showcases how one can integrate agent-style AI tools directly into their audit workflows to accelerate personal reasoning and amplify each auditor's individual expertise. darkmode-2026-88288-co-auditing-with-ai-practical-techniques Lessons Learned George Kobakhidze en This talk shares how we use AI agents as co-auditors to amplify individual reviewers, not replace them. We focus on a practical framework built inside our audit workflow: - **Tool-aware agents** that can invoke hard technical tools - static analyzers, code mappers, and protocol helpers - rather than rely on raw text prompting. - **Primer-driven behavior**, where auditors define how the agent should think, interpret code, and execute repeatable methodology across domains like lending, staking, and accounting. - **Artifact generation** that persists throughout the engagement - from initial scoping and code mapping to end-stage issue drafting - allowing humans and the agent to build on shared context as the audit progresses. The core idea is that these systems let auditors bring their own expertise into the workflow. Teams can create private primers, encode their specialties, and optionally share them with the broader community to lift everyone’s capability. The goal is a future where every auditor can use AI to multiply the value of their own judgment - without ceding control to automation. false https://darkmode.securityalliance.org/darkmode-2026/talk/JZASGB/ https://darkmode.securityalliance.org/darkmode-2026/talk/JZASGB/feedback/ Auditorium Long Talk 2026-02-17T10:55:00-07:00 10:55 00:45 I am not a vuln researcher and that's kind of the point, LLMs have come a long way in the cyberz. I tried to find a real RCE with Codex, I failed so badly that I accidentally learned how to find bugs in common projects with LLMs. This talk is about using AI to turn bad vibes into real bugs. Drawing on multiple CVEs across React, Node, Ollama, Wordpress, etc and other projects, I'll show how anyone with a little debugging and security knowledge can go from vibes to vulnerabilities darkmode-2026-89735-from-vibes-to-vulnerabilities Vulnerability Disclosure Andrew MacPherson (AndrewMohawk) '<#<h1> en This talk starts from a failure. As a long time blue team practitioner with no vulnerability research background, I tried to use OpenAI Codex to find a real-world RCE that had just dropped—and got absolutely nowhere. What followed was confusion, false positives, and confidently wrong model output. But once I stopped treating Codex like a one-shot bug oracle and started using it as a deeply opinionated debugging assistant, things began to click. The session walks through how I used “vibes” to find vulnerabilities: from being the annoying kid in the back seat asking “why?” a hundred times, to forcing the model to reason more deeply about code paths, assumptions, and edge cases until something real fell out. I'll walk through the pain and the pleasure of using LLMs for vulnerability discovery, including how this approach led to real findings across projects like React, Node, Ollama, Tethers Password manager, wordpress, supabase, etc. We'll talk candidly about where models get stuck, how to work around refusals, why the dumbest ideas sometimes work best, and just how creative—and unhinged—you can get when you stop trusting the model and start interrogating it. I'll also show how this fundamentally changes offensive capability and why it feels like red teams are about to get a serious advantage. The talk closes with a sober look at the current limitations, the risks, and the broader impact on the security community. The goal isn't to teach exploit development, but to show that with basic debugging skills and the right guardrails, AI can meaningfully assist in finding real vulnerabilities—and dramatically lower the barrier to entry for vulnerability research. false https://darkmode.securityalliance.org/darkmode-2026/talk/G7B9P8/ https://darkmode.securityalliance.org/darkmode-2026/talk/G7B9P8/feedback/ Auditorium Short Talk 2026-02-17T12:40:00-07:00 12:40 00:20 In the Bybit incident response, a lot went right. The ecosystem showed up, teams moved fast, and we used the tools at our disposal to trace flows and push actionable intelligence. But there was also a lot that went wrong. Some parts of the ecosystem were not responsive to investigators. Despite their best efforts, law enforcement around the world, they simply did not have enough workforce to dedicate to supporting the freezes and litigation. No matter how fast investigators could post new addresses to freeze the stolen money, it would take hours or even days to be published and actionable. On the other hand, North Korea and collaborators were moving at the rapid speed of blockchain settlement, measured in seconds. Investigators were moving at human coordination and off-chain corporate and government speeds, measured in hours and days. We were always chasing. So how do we work together to do better the next time? We need to fix both the people & company coordination and the high speed intelligence infrastructure to support that coordination. In this presentation we will highlight the Coalition for Freezing & Recovering (SEAL & zeroShadow project) and showcase the launch of zeroShadow’s new Threat Intelligence Platform (free critical infrastructure to all Web3 projects). zeroShadow Threat Intelligence Platform (zS TIP): a high-speed intel network built so real-time coordination doesn’t depend on one-off channels. Trusted security teams can share vetted signals in real time, and VASPs receive those signals as they happen to make informed risk decisions quickly. From OFAC sanctioned addresses to the latest hacks and exploits, members will have access to this critical intelligence to stay safe, stay compliant, and be part of the solution to disrupt laundering and help return stolen assets to victims. darkmode-2026-90865-how-we-stop-north-korea-getting-away-with-the-next-billion-next-generation-of-security-professional-coordination-and-new-high-speed-threat-intel-network New Announcements Casey GCol G en false https://darkmode.securityalliance.org/darkmode-2026/talk/ETHYXP/ https://darkmode.securityalliance.org/darkmode-2026/talk/ETHYXP/feedback/ Auditorium Long Talk 2026-02-17T13:00:00-07:00 13:00 00:45 Most Web3 incidents aren’t “one bug, one drain” anymore. Attackers increasingly chain weaknesses across layers such as legacy contracts, subtle numerical edge cases, protocol/bridge exit paths, and off-chain vendor exposure, into an exploit path that ends in irreversible loss. In this talk we'll take a look at some high-signal incidents from 2025 and discuss how to break attack chains before they reach funds. Lessons learned will include practical strategies that projects may adopt to build defense-in-depth that breaks attack chains. darkmode-2026-88182-attack-chains-in-web3-lessons-from-multi-stage-web3-exploits Lessons Learned Sebastian Banescu en false https://darkmode.securityalliance.org/darkmode-2026/talk/MLLQAQ/ https://darkmode.securityalliance.org/darkmode-2026/talk/MLLQAQ/feedback/ Auditorium Short Talk 2026-02-17T13:45:00-07:00 13:45 00:20 TraderTraitor, also known as Jade Sleet, Slow Pisces, UNC4899, Dark River is the North Korean threat actor behind major cryptocurrency heists from ByBit, DMM, WazirX, CoinsPaid, Alphapo, Atomic Wallet, Horizon Bridge, Ronin Bridge, and many others. This presentation is a deep dive into TraderTraitor and will cover how they compromise their victims, how defenders and security teams can track TraderTraitor, and measures that organizations can take to protect themselves from being the next Bybit. This presentation will have non-public details about TraderTraitor activity. darkmode-2026-86785-tradertraitor-a-real-bad-mata Lessons Learned Daniel Gordon en North Korea loves stealing crypto. This presentation is a deep dive into TraderTraitor, North Korea's most effective hacking group. This presentation will explore how TraderTraitor compromises cryptocurrency exchanges, wallet service providers, and cloud companies in order to steal massive amounts of cryptocurrency including the ByBit heist where they walked away with $1.5 Billion worth of Ethereum. While TraderTraitor is incredibly effective at stealing cryptocurrency for North Korea, a few security measures can help protect your organization, and your service providers, from this threat actor. false https://darkmode.securityalliance.org/darkmode-2026/talk/BJJM8V/ https://darkmode.securityalliance.org/darkmode-2026/talk/BJJM8V/feedback/ Auditorium Short Talk 2026-02-17T14:15:00-07:00 14:15 00:20 We keep seeing the same supply chain failures in crypto: compromised dependencies, leaked or abused publishing keys, and malicious or compromised contributors. These incidents are often framed as uniquely web3, leading teams to design bespoke trust models rather than adopt proven, well-understood security practices. From an attacker’s perspective, none of this is new. Open-source communities have spent years responding to these exact classes of supply chain attacks, resulting in concrete standards such as SLSA and ecosystem-level guidance and tooling from the OpenSSF. These approaches map directly to crypto development workflows, yet remain underutilized in practice. Instead, we repeatedly invent new frameworks, often increasing complexity without reducing risk. In this talk, I’ll walk through how we approach release system design at Anza, looking at the full development lifecycle through an adversarial lens. We’ll identify where things commonly go wrong, how existing tools and frameworks already address these failure modes, and why reinventing the wheel in supply chain security frequently makes systems less secure, not more. I’ll also cover emerging tooling like gittuf, which takes a fundamentally different approach to Git security and policy enforcement. darkmode-2026-88136-when-the-supply-chain-isn-t-chaining-stop-reinventing-the-wheel Lessons Learned Nikita Belenkov en false https://darkmode.securityalliance.org/darkmode-2026/talk/QUX7KW/ https://darkmode.securityalliance.org/darkmode-2026/talk/QUX7KW/feedback/ Auditorium Short Talk 2026-02-17T14:35:00-07:00 14:35 00:20 Protocol security is shaped long before the first line of code is written. In this talk, Tomer Ganor, Tech Lead and Security Researcher at Certora, explores how Lido V3 combines security thinking with protocol design to reduce attack surfaces, prevent bugs, and strengthen the Ethereum infrastructure darkmode-2026-87925-lido-v3-security-by-design Other Tomer Ganor en Attendees will learn how protocol design decisions shape security outcomes and how security first architecture prevents entire classes of DeFi bugs false https://darkmode.securityalliance.org/darkmode-2026/talk/URDMBC/ https://darkmode.securityalliance.org/darkmode-2026/talk/URDMBC/feedback/ Auditorium Panel 2026-02-17T14:55:00-07:00 14:55 00:45 Practical incidents + ops learning. Panel may also include “hot takes”. Crypto incidents don’t behave like traditional breaches. They unfold in minutes, span chains, and can cause infinite cascading damage along the way. Most teams are still improvising without training or realistic strategies in place. This panel brings together leading DeFi security teams to share practical incident lessons, working incident pipelines, and response playbooks that actually hold up under live attack conditions. The outcome: practical insights, candid stories, and debate on what the industry must fix next. darkmode-2026-88116-from-chaos-to-containment-making-incident-response-actually-work-in-the-digital-asset-economy Lessons Learned CantinaSharon Ideguchi en Incident Response is where the digital economy defensive layer succeeds or fails, but it is still underdeveloped across the industry. This panel focuses on turning MDR/IR from a reactive approach into reliable operational capability. We’ll dig into: What the first 60 minutes of real incidents actually look like and why they matter How teams are building MDR workflows that merge on-chain + off-chain telemetry How playbooks and containment strategies can change the outcome What the industry consistently gets wrong about response today How collaboration and threat intelligence meaningfully reduce impact Attendees will leave with actionable frameworks, hard-earned lessons, and new thinking on how we can collectively raise the baseline of defense in crypto. Panelists (proposed): representatives from Cantina, Hypernative, and ChainPatrol Moderator: Mike Leffer, President of Cantina/Spearbit false https://darkmode.securityalliance.org/darkmode-2026/talk/TT3GRQ/ https://darkmode.securityalliance.org/darkmode-2026/talk/TT3GRQ/feedback/ Auditorium Short Talk 2026-02-17T15:40:00-07:00 15:40 00:20 Most incident response and chain analysis tooling is built with an implicit assumption: account-based execution risk is the problem. That assumption holds, until it doesn’t. Using Filecoin as a case study, this talk explores why many otherwise capable vendors struggle to support novel chains, and why gaps appear not because of neglect but because the mental model itself breaks down and product margins don't get in the way. Filecoin isn’t a smart contract chain with storage bolted on. It’s a distributed system designed to verify long-lived behavior across independent operators. The primary asset isn’t just balance but it’s behavior over time. The dominant risks may not necessarily exploits, but they're based in incentive failures, coordinated degradation, and economic edge cases. We’ll unpack what this means for incident response teams and why chain analysis and incident response platforms tend to miss the mark when stepping outside familiar ecosystems: - Why transaction-centric alerts miss slow-burn incidents - Why actor behavior matters more than bytecode inspection - Why “the incident” often belongs to the network, not an app - Why generic EVM heuristics actively create false confidence and false positives To be crystal clear this talk is not a critique of vendors, it’s a lessons-learned hot take briefing from the field. Supporting novel chains requires different playbooks, different baselines, and a willingness to abandon security absolutism in favor of contextual risk analysis. The key takeaway: if your incident response model can’t reason about incentives, time, and roles, it will fail quietly on novel chains right up until the ecosystem feels the impact. This session aims to help security teams recognize those limits early, adapt deliberately, and build coverage that actually reflects how decentralized infrastructure fails in practice. darkmode-2026-88699-crazy-chains-why-incident-response-breaks-outside-the-evm Hot takes Ken Toler en false https://darkmode.securityalliance.org/darkmode-2026/talk/THSJYH/ https://darkmode.securityalliance.org/darkmode-2026/talk/THSJYH/feedback/ Auditorium Panel 2026-02-17T16:00:00-07:00 16:00 00:45 As Web3 moves from niche experiments to institutional-grade infrastructure, our security models are hitting a tipping point. This panel explores how the industry is maturing to meet the demands of mainstream adoption without abandoning decentralization. We’ll look at what’s fundamentally shifting—from the evolution of smart contract security and wallets to the critical rise of operational security (OpSec)—and what remains immutable. darkmode-2026-88422-web3-security-s-evolution-for-mainstream-adoption Hot takes Michael LewellenAntoAndrew MacPherson (AndrewMohawk) '<#<h1>Mooly Sagiv en Mainstream adoption isn't just about better UI; it’s about a fundamental shift in how we manage risk. This session brings together security architects from both the "move fast" world of DeFi and the "zero-fail" world of institutions to discuss the practical realities of securing a global ecosystem. The Evolution of the Stack: Scaling Security: How do we transition from one-off smart contract audits to continuous, real-time security monitoring and automated response? The User Experience Paradox: Discussing the shift from the burden of seed phrases to invisible security like MPC, TEEs and Account Abstraction—and whether we’re introducing new risks in the process. Operational Maturity: Why OpSec (key management, governance, and internal controls) is becoming the most critical failure point as organizations move on-chain. What Stays the Same: Identifying the "load-bearing" pillars of Web3—like zero-trust and cryptographic proofs—that must survive the leap to the mainstream. false https://darkmode.securityalliance.org/darkmode-2026/talk/UX3RPF/ https://darkmode.securityalliance.org/darkmode-2026/talk/UX3RPF/feedback/ Auditorium Short Talk 2026-02-17T16:45:00-07:00 16:45 00:20 Web3 security has cycled from custodial single points of failure to the "seed phrase anxiety" of self-custody. This session explores how Secure Enclaves (TEEs) can offer a unique solution to key management by enabling Verifiable Infrastructure for embedded wallets. We’ll dive into Turnkey’s approach to TEE-based key management—using hardware-isolated environments like AWS Nitro to move beyond simple signing into a world where every policy is rooted in verifiable proofs. We'll also discuss Turnkey's new Verifiable Cloud: a new offering that extends these guarantees to general-purpose workloads, allowing developers to run sensitive code—from AI agents to DeFi logic—inside isolated enclaves that produce independently auditable proofs of execution. darkmode-2026-88361-protecting-keys-and-compute-with-secure-enclaves New Announcements Michael Lewellen en false https://darkmode.securityalliance.org/darkmode-2026/talk/VDPMHS/ https://darkmode.securityalliance.org/darkmode-2026/talk/VDPMHS/feedback/ Auditorium Panel 2026-02-18T12:00:00-07:00 12:00 00:25 Kyle Bligen - Decentralization Research Center,Michael Lewellen - Turnkey,Lindsay Fraser - Blockchain Association, Mike Orcutt - Project Glitch darkmode-2026-91481-decoding-the-dc-politics-of-crypto-privacy Privacy en false https://darkmode.securityalliance.org/darkmode-2026/talk/NEHCVJ/ https://darkmode.securityalliance.org/darkmode-2026/talk/NEHCVJ/feedback/ Auditorium Short Talk 2026-02-18T12:25:00-07:00 12:25 00:15 Naomi Brockwell - Ludlow Institute, The modern digital era runs on surveillance, and it gets more invasive every day. In “State of Surveillance,” Naomi Brockwell shows how the machine actually works, how it’s embedded in ordinary daily life, and how it has enabled a monumental power shift in society. She'll also go over actionable steps you can take to fight back, protect yourself, and help make privacy normal again. darkmode-2026-91482-state-of-surveillance Privacy en false https://darkmode.securityalliance.org/darkmode-2026/talk/FUUDPW/ https://darkmode.securityalliance.org/darkmode-2026/talk/FUUDPW/feedback/ Auditorium Short Talk 2026-02-18T12:40:00-07:00 12:40 00:15 TJ Connolly - Fireblocks, A deep dive on the various approaches used by non-custodial & embedded wallets to generate & store private keys for their users, and despite their claims, the truth is most generate key material on software & hardware NOT controlled by the end user, therefore making them de facto custodial. darkmode-2026-91483-non-custodial-not-really-misconceptions-in-key-management Privacy en false https://darkmode.securityalliance.org/darkmode-2026/talk/8LQSUJ/ https://darkmode.securityalliance.org/darkmode-2026/talk/8LQSUJ/feedback/ Auditorium Short Talk 2026-02-18T12:55:00-07:00 12:55 00:15 Keynote by Ameen Soleimani darkmode-2026-91485-keynote-ameen-soleimani Privacy en false https://darkmode.securityalliance.org/darkmode-2026/talk/L7P9WS/ https://darkmode.securityalliance.org/darkmode-2026/talk/L7P9WS/feedback/ Auditorium Short Talk 2026-02-18T13:10:00-07:00 13:10 00:15 Keynote: Alexander Wilke darkmode-2026-91486-keynote-alexander-wilke Privacy en false https://darkmode.securityalliance.org/darkmode-2026/talk/DAHPWV/ https://darkmode.securityalliance.org/darkmode-2026/talk/DAHPWV/feedback/ Auditorium Short Talk 2026-02-18T13:25:00-07:00 13:25 00:15 Ying Tong Lai - (In stealth), Proofless consensus is a family of protocols moving transaction validation out of consensus, to client-side devices. This allows for lightweight private payments without placing additional burden on consensus. This talk compares shielded CSV, Intmax, and PlasmaFold, and explores private applications that can be built on top of these. darkmode-2026-91487-proofless-consensus-and-client-side-validation Privacy en false https://darkmode.securityalliance.org/darkmode-2026/talk/HSMC3Y/ https://darkmode.securityalliance.org/darkmode-2026/talk/HSMC3Y/feedback/ Auditorium Panel 2026-02-18T13:40:00-07:00 13:40 00:20 Zooko Wilcox - Shielded Labs for Zcash, Moderated by Ben Schiller - Miden darkmode-2026-91490-fireside-zcash-s-zooko-wilcox Privacy en false https://darkmode.securityalliance.org/darkmode-2026/talk/8H88ZS/ https://darkmode.securityalliance.org/darkmode-2026/talk/8H88ZS/feedback/ Auditorium Short Talk 2026-02-18T14:00:00-07:00 14:00 00:15 Zak Cole - Ethereum Community Foundation, darkmode-2026-91491-keynote-zak-cole Privacy en false https://darkmode.securityalliance.org/darkmode-2026/talk/ALEX7U/ https://darkmode.securityalliance.org/darkmode-2026/talk/ALEX7U/feedback/ Auditorium Short Talk 2026-02-18T14:15:00-07:00 14:15 00:20 Zac Williamson - Aztec Network, Blockchain began as a rebellion against institutional power, but gradually retreated into safer terrain: speculation settlement, and regulatory-friendly finance. This talk argues that the field’s real failure wasn’t technical, it was canonical – splitting its founding myth into “number go up” finance and an underpowered vision of social coordination that never fully materialized. With privacy-preserving cryptography now real, crypto stands at a reckoning: becoming the institutional technology it promised to be or be remembered as a failed rebellion that optimized complacency and called it progress. darkmode-2026-91492-crypto-lost-the-plot-how-blockchain-forgot-its-own-canon Privacy en false https://darkmode.securityalliance.org/darkmode-2026/talk/FL8VYA/ https://darkmode.securityalliance.org/darkmode-2026/talk/FL8VYA/feedback/ Auditorium Short Talk 2026-02-18T14:35:00-07:00 14:35 00:15 Howard Wu, Capital markets are moving onchain, but public stablecoin rails expose balances, flows, and counterparties. This session examines the ZK infrastructure behind private, compliant, programmable stablecoins like USDCx and what institutions require to deploy real capital safely. darkmode-2026-91493-the-infrastructure-capital-markets-need-to-go-onchain Privacy en false https://darkmode.securityalliance.org/darkmode-2026/talk/ZSTD3M/ https://darkmode.securityalliance.org/darkmode-2026/talk/ZSTD3M/feedback/ Auditorium Long Talk 2026-02-18T14:50:00-07:00 14:50 00:30 Matthew Green, Ian Miers, ⏰ Howard Wu, Ben Lakoff - Bankless Ventures Stablecoins need privacy to be usable for real payments. This session reveals how zero-knowledge stablecoins unlock global payroll, commerce, and remittances without exposing sensitive financial data. Learn from the pioneers making private money finally work at scale. darkmode-2026-91501-stablecoin-endgame-programmable-privacy Privacy en false https://darkmode.securityalliance.org/darkmode-2026/talk/MSKFFY/ https://darkmode.securityalliance.org/darkmode-2026/talk/MSKFFY/feedback/