Hashlock (@Hashlock_) header
Hashlock (@Hashlock_) profile picture

Blockchain & Smart Contract Security Specialists - Contact us to request a Web3 Security Audit.

Joined June 2022
Photo by Hashlock (@Hashlock_)Photo by Hashlock (@Hashlock_)Photo by Hashlock (@Hashlock_)Photo by Hashlock (@Hashlock_)Photo by Hashlock (@Hashlock_)Photo by Hashlock (@Hashlock_)Photo by Hashlock (@Hashlock_)Photo by Hashlock (@Hashlock_)Photo by Hashlock (@Hashlock_)Photo by Hashlock (@Hashlock_)
1/ Tampered #Ledgers with a hidden cellular implant are being sold through third-party resellers in Southeast Asia. The implant reads your 24 words during setup and sends them over LTE. Genuine Check doesn't catch it. Full read: hashlock.com/blog/is-your-le… Six checks:
9
9
1,926
Good read from @xccy_finance and Schema Research on what fixed rates on lending do for treasuries, vaults and borrowers What caught our eye: pricing the hedge into a vault’s share price. That is where vault security gets tested!
Borrow $500K on Aave for six months, and the interest bill could be $7,500 or $25,000, depending on where rates go Fix the rate at 6% and the bill is $15,250, fees included We worked through cases like this in a new piece 👇
1
144
Applications for Apollo Cohort 2 by @0G_labs close today We are a security partner of the program: Cohort 2 teams get 30% off Hashlock security audits. AI founders building real products, this is your last call
Apollo Cohort 2 mentors now include leaders from Anthropic, AWS, Google DeepMind, Google for Startups and Coinbase Ventures. Partners include Google Cloud and OpenAI. Up to 10 AI startups, up to $2M each, run with @xBuildersVC. Applications close Nov 11.
7
276
Building on @X1_EcoChain? As security partner for the X1 EcoChain ecosystem, we review what teams launch on it: token contracts, DeFi and staking, bridges, dApps and games. Get your code reviewed before you ship: hashlock.com/request-an-audi…
1
725
Proud to keep building with @X1_EcoChain after auditing their Layer 1. We know the base layer inside out: the Go node and the system contracts. That gives every team launching on X1 EcoChain a head start on security
X1 EcoChain 🤝 Hashlock: Elevating Ecosystem Security and Unlocking Exclusive Perks for Builders! We are thrilled to highlight our successful partnership with @Hashlock_ — a premier Australian smart contract and decentralized systems auditor with an impeccable global reputation for blockchain security. Having already completed the comprehensive audit of our Layer 1 blockchain, Hashlock's security experts possess an intimate, hands-on understanding of our underlying architecture and codebase. This gives projects building within the X1 EcoChain ecosystem a massive advantage. Thanks to this established technical baseline, upcoming ecosystem projects can undergo security audits with Hashlock much faster, more smoothly, and on exclusive, highly favorable terms. Empowering the next generation of secure, scalable Web3 projects — together with the industry's best!
3
338
Introducing Space and Time Enterprise: a new data privacy platform for AI and finance. Deploy Proof of SQL in your enterprise environment, keep your underlying business data private, and share verifiable results with your AI agents, auditors, and stakeholders.
48
77
14
284
18,836
Audit complete: @X1_EcoChain Hashlock reviewed both halves of the chain: the Go node client that runs the network and the Solidity contracts that run on it Full report: hashlock.com/audits/x1-ecoch…
3
1
1
23
2,942
Today in Rome, Hashlock team joins the SiGMA World panel "Trust but Verify: Audits, Transaction Monitoring and the Practical Work of Keeping Crypto Safe"
1
12
435
AIBC World 2026 opens today at Fiera Roma, and Hashlock is exhibiting. Hashlock team is at the Hashlock booth until 5 Nov Come and ask us what we would fix first in your code @AIBC_World
2
4
421
Proud to be a trusted security partner of the Apollo AI Accelerator by @0G_labs, run with @xBuildersVC We are here to help the Cohort 2 teams build and ship securely Applications close 11 Nov: apollo.0g.ai/apply
2
1
18
1,304
Hashlock now has a project page on @SolanaCompass, the Solana ecosystem directory. Worked with us? A short review there helps other builders find a security partner they can trust. solanacompass.com/projects/h…
1
5
361
Binance lost about $6.3B on 29 Oct, by its own estimate. Early reports said $5.6B before the full count. TRM Labs calls it the largest crypto theft on record. Binance's first findings point to one hacked staff laptop. In plain words:
4
3
13
753
The lesson for every team, not only exchanges: perfect code is not enough if one laptop can reach the system that moves your money. Security covers people, devices and access too
38
4. Most of the money left in about 20 minutes, across 10 blockchains (TRM Labs). About $3B is already frozen, and Binance says it will cover all losses. TRM links the attack to North Korea's TraderTraitor group.
25
1. An attacker got into the laptop of a Binance engineer. 2. From it, they reached the internal system that sends withdrawals. 3. That system signed the attacker's withdrawals as if they were real. Binance says it found no sign of a private key leak.
2
118
Proud to see our Founder & CEO @jockhaslam among the 19 new supporters backing @ethlabs_org, the non-profit R&D lab for Ethereum and ETH. Security is on their short list of what makes Ethereum special. It is on ours too
3
1
8
482
8/ Bookmark the first post in the thread for reference ↓ xitter.twitterapi.xyz/OpenGradient/status/20…
Introducing OpenGradient Chat, a privacy-first generative AI platform. Every frontier model in one app. We can't read what you type, and neither can anyone else. Finally, an AI you can tell anything. (1/n)
2
3
16
3,031
zkLink Nova's bridge on Ethereum lost about $786K, flagged by Blockaid on 29 Oct. The root cause was simple: one message hash that could be used twice. zkLink has not published a post-mortem yet. Here is what the analyses show.
6
7
681
For any bridge or messaging layer: - Mark a message hash as used in the same call that consumes it - Require a fresh authenticated callback for every claim - Treat functions a public relayer can reach as untrusted input hashlock.com/request-an-audi…
58
With that root accepted, withdrawals with forged proofs went through, draining the ETH escrow and the ERC20 bridge. One attacker address SlowMist lists is tagged "X100 Exploiter 2" on Etherscan, the same label as the X100 governance attack on 24 Oct.
27
Per SlowMist: Arbitrator.claimMessage never cleared a stored message hash after use. Through a public relayer, the attacker stored one valid hash, then reused it to call ZkLink.syncBatchRoot as the real gateway and install their own batch root.
1
1
83