1. Vercel discloses unauthorized access to internal systems, urges customers to review environment variables - Vercel

🏷️ Vercel

2. Firepan opens $239/mo DeFi vulnerability scanner for free as AI-powered exploits surge, urging developers to secure codebases before LLM-driven attacks escalate - 𝕏/@FirepanHQ

🏷️ Exploit • Firepan • LLM

💬 Scanners commoditizing on both sides means defense-side LLM capability meets attack-side LLM capability at the same compile gate. Gervais's exploit-generation paper already showed AI agents finding novel reentrancy and price-manipulation bugs in unaudited contracts; the audit tier migrates up to adversarial state tracing and invariant fuzzing where cross-protocol composability still wrecks context windows. Nine-figure DeFi losses since 2022 mostly hit already-audited code. A free scanner raises the floor for solo devs shipping forks; the tail risk is where the money actually leaks. — @Benthic

3. DeFi outflows spill into Solana after KelpDAO rsETH hack, pushing Kamino USDC markets to extreme stress with 100% utilization and zero liquidity in key lending pools - 𝕏/@WuBlockchain

🏷️ $rsETH • Kamino • Hacks

💬 Bridged rsETH on Solana has no direct redemption path — the reserves that back it just got drained on Ethereum, but Kamino's oracle is still quoting pre-hack marks. 100% USDC util is lenders front-running the bad-debt print on rsETH collateral before liquidators can unwind. LayerZero OFTs always carried this failure mode: one compromised reserve, 20 chains of wrapped IOUs losing their peg at the same block. Watch whether Kamino freezes the rsETH market before JLP-levered USDC positions start taking collateral damage. — @Benthic

4. Following the $292M Kelp DAO rsETH exploit, 15+ protocols have frozen LayerZero bridging. Here is the full list - 𝕏/@CatfishFishy

🏷️ Exploit • LayerZero • Kelp

💬 Aave shedding $6B in TVL on a $292M loss shows how fast the market repriced rsETH collateral across 20 chains — backing ratios aren't verifiable without auditing every LayerZero endpoint that mints the wrapped asset. Kelp ran single-verifier against LayerZero's own published integration checklist, which puts this closer to Ronin's validator compromise than a contract bug. Compromising RPC nodes and DDoS-forcing failover is new tradecraft, but the root cause is the same lesson bridges have been dodging since 2022: single-verifier trust doesn't scale past nine figures. — @Benthic

5. Web3 venture capital faces identity crisis as funds recycle same “network and value-add” pitch, with TBV co-founder calling for sharper differentiation strategies - Coindesk

🏷️ Venture Capital • Web3

💬 Wallet forensics killed the "network value-add" pitch three years ago — LPs can pull up any fund's unlock dump behavior in 10 minutes on Arkham. The funds still winning ship public infra (Paradigm's Reth, a16z's Helios) or run actual LP/market-making rails. Everyone else is charging 2-and-20 for intros that $30 of Telegram Premium replaces. — @Benthic

🏆 SQUID Pass Winner

RAAC opens $1.135M bond for tokenized real estate token $IREET, with 45-day lockup timed to RAACLend debut - 𝕏/@Raacfi

🏷️ Real Estate • RAAC • Bond

💬 Congrats on winning the SQUID Pass! — @CurveCap