Blockchain security, MEV, market structure, and the fundamentals, explained at the byte level and without the hype. Beginner to advanced. The same transparency attackers exploit is the transparency we teach you to read.
25 entries · six tracks · newest first
No private key was stolen and cold storage was never touched. The attacker exploited a zero-day in a third-party security product, obtained legitimate internal credentials, and asked the wallet system to send $388 million. Of that, $320,000 was frozen.
A critical bug in Cosmos EVM was fixed on GitHub in May and took 96 days to reach a version chains could install. Four were drained in the five days after it shipped. Nobody leaked anything, and there is still no CVE.
A stablecoin holds its price because somebody will redeem it at par, not because reserves exist somewhere. What backs USDC and USDT per their own filings, who is actually allowed to redeem, and why USDC fell to 88 cents while fully reserved.
Every price a contract acts on was put there by somebody. Why 234 of Chainlink's 290 mainnet feeds tolerate a full day between updates, and what Chainlink's own example contract checks instead.
Rollups inherit Ethereum's security for one specific thing and nothing else. Who runs the sequencer, who holds the upgrade keys, and what the published risk data says about the largest chains.
Who can replace the code behind Aave's lending pool, why the answer is not in its source, and how to read any account's token balance straight out of raw storage. Every command run against live mainnet.
Inline assembly is sold as the fast option. In measured examples here it saves 76 gas on one operation and costs 44 on another, and one annotation decides whether a contract compiles at all.
A twelve line contract compiled and read instruction by instruction. What a stack machine is, what each place data can live actually costs, and where a single plus sign ends up.
The starting point for a four part series, assuming nothing. What a smart contract actually is, why Ethereum cannot read the language you wrote it in, what the compiler hands you instead, and what gas is really counting.
95%+ of Solana stake runs one company's client and none of it is in the protocol. Jito shut its own mempool to stop sandwiching, and the activity moved somewhere with no transparency at all.
$172.4 million in July, the smallest month since launch, and that was an improvement. Where the money went instead, why it is not an altcoin rally, and the structural reason bitcoin cannot compete for it.
91% of Ethereum blocks are assembled by outside firms and passed to validators through relays the protocol does not know exist. EIP-7732 writes that arrangement into the protocol, and leaves the harder problem untouched.
594 BTC swept from 500 wallets in 25 minutes, with no hack, no phishing, and no user error. A 2021 firmware change stopped the device using its hardware randomness, and every seed it made afterward was guessable.
Morgan Stanley listed spot ether and solana trusts at the lowest sponsor fee in both categories, and both stake. Once a product stakes, the sponsor fee stops being the price. The all-in math, and why the distribution channel matters more than the fee.
The bill that would split crypto between SEC securities and CFTC commodities, with a decentralization test deciding which is which. It cleared the House and a Senate committee, but the base case is it misses its August 10 window.
AFX Trade lost $24.15 million with every contract behaving exactly as written: five compromised validator keys, a 200-second challenge window nobody watched, and the bridge paid. The failure was the authority, not the code.
Ostium lost roughly $18 million not to a broken contract but to its own price feed: the year attackers stopped breaking DeFi's code and started poisoning the inputs that code trusts.
The Solana memecoin casino is closing and the speculative capital is rotating into perpetual futures: a structural change in where crypto gambles, not a passing cycle.
The value a block producer or searcher extracts by deciding which transactions go in, and in what order: what MEV is, who pays it, and how to shrink your exposure.
DeFi is bolting keepers, rebalancers, and AI agents on top of audited contracts, and the automation driving the money is now an under-reviewed attack surface. The Summer.fi exploit shows what that failure looks like.
The GENIUS Act put a federal framework under payment stablecoins and declared compliant ones categorically not securities, plus the new SEC/CFTC five-bucket map of who regulates what.
How pump.fun tokens are built to fail (bundles, snipers, soft rugs, fake volume) and the on-chain red flags anyone can check in two minutes.
The full mechanism of MEV's most common value-extraction primitive: the constant-product math, where it happens, and the defenses that hold.
The first CFTC-legal way for US persons to short crypto perpetuals: the DCM/FCM structure, funding rates, and why it's real market structure.
A replicated, append-only ledger that lets distrusting parties agree without an authority: the mechanism, and the precise points where it breaks.
No pieces match that combination yet; more are on the way.