区块链第一安全团队?前员工爆料:慢雾的「慢」是「傲慢」​

marsbitPubblicato 2025-09-09Pubblicato ultima volta 2025-09-10

人在江湖,少装逼,更不要强行装逼。只要你做过的事,区块链就会留下痕迹。

我深知一家公司和员工的关系是相辅相成的,离开了谁都无法造成当时的成就,本不愿意去外面讲一些难听的话,但是这次再次被激怒了,那我就好好的把当时加入慢雾和离开慢雾的故事始末讲清楚,让大家好了解这是一家什么样子的安全公司。

故事一:我是如何认识余弦

我和余弦认识是在 2014 年的北京,当时我是去参加道哥(吴翰清https://developer.aliyun.com/article/741176 可以通过链接了解真正的安全大佬是什么格局)出席的一个活动偶遇相识。后续通过微信有认识知道创宇安全团队的其他人,此时他作为知道创宇的安全副总监。而此时区块链并未如此的火遍大江南北,此时我在北京的一家上市公司旗下子公司配合总公司首席硬件科学家的一个大项目,在工作之余作为清华系的首席硬件科学家在研究 BTC 挖矿,而我就在此时接触到了 BTC 挖矿和当时 QQ 群里炒不知名的小币的人们(现在的大佬们)

故事二:我为什么会加入慢雾

在后来我离开了北京回到了深圳,由于有一些安全圈子的交流,一来二去就去厦门参加了当时余弦组织的端午安全技术分享小沙龙,在后来熟悉后偶尔也有私下交流联系和余弦。那时候的我对于传统安全略有一些研究,但是由于本身是研发出身,对于安全其实就是开发人员的逆向思维出于好奇,我想了解一下真正的黑客大牛(或者安全公司)是怎样的,对于当时的我就像站在安全行业的的大门前,对于里面黑乎乎的一片很好奇,想推门而入一探究竟。

我记得当时应该是 2018 年左右吧,余弦离开了他从实习到离开呆了十年的公司知道创宇,在厦门成立了一个小的安全工作室,这也是当时去厦门参加安全沙龙时候才知道的事。在后来突然有一天群里说我们做个区块链安全公司吧,本想告别互联网 Web2 到区块链领域大干一场的我就兴冲冲的从钱多事少离家近的深圳,之身去到了厦门。当时慢雾刚刚成立,办公室还是上家留下的场地还没来得及装修,我记得上家公司还是做土地质量检测的,因为办公室遗留的桌椅和办公室门牌都还在。

故事三:我在慢雾的经历

(1)可以说我是慢雾的第一名正式员工(如果余弦他老婆非要说她跑前跑后注册公司她算第一个员工的话,那我算是第二个吧)就这样我加入了慢雾科技,成为了办公室第一名正式员工,一周后启富才从网宿科技离职出来加入慢雾科技,当时办公室和另外一家公司越零一(上文说的余弦在厦门最早注册的安全工作室)在一个办公室内办公,加起来办公室就四五个人第一年的时候。

(2)我承认当时作为一个高级 Java 研发工程师我对智能合约的了解几乎为 0 ,当然此时所有人都是 0 基础,因为以太坊的智能合约才刚推出不久。在慢雾的时候也学到了很多区块链知识和经历过很多交易所被黑的场景,但是这些一切都是基于我个人的努力和业务的驱使使我快速学习和吸收(基本上每天睡4个小时研究不同的漏洞和攻击和响应,同时还要 24 小时在线为安全顾问的客户排疑解难,和发送最新漏洞预警)我们一边看着 https://github.com/OpenZeppelin/openzeppelin-contracts 的智能合约安全实践最佳指南,一边为客户审计他们的 ERC20 Token,我记得当时我们的第一个客户是厦门的本地企业,第一份智能合约的审计报告也是我熬了三天后给客户出的报告(也算是国内的第一份智能合约审计报告了,至今报告模版还在被沿用和做一些细微修改),后来第一个客户也在很多年后因为做了一个很火的 Defi 被抓了,当然这个客户被抓也不是慢雾的原因造成的,因为他们做过太多的项目和交易所割韭菜。

(3)我的第一次公开露面是当时慢雾发现了以太坊情人节的盗币漏洞(https://x.com/SlowMist_Team/status/1012525355922419712)在当时也是很多人在网上说自己节点内的币,莫名其妙的被转走了,也有人找过来询问原因,出于 PR 出身的余弦安排团队专门做了一个专访页面,为此次事件开始了慢雾的第一次公开营销。效果毫无疑问很好,毕竟作为传统安全的老人,还是有一些人脉和影响力的。就这样慢雾出现了在大家眼前。

慢雾科技(4)雷军老板说过:“在风口上的猪都能飞起来。” 慢雾的突然业务爆发是在蔡老板的美链 BEC 突然被溢出增发的时候交易所突然意识到了智能合约的安全隐患,此时但是的交易所火币、币安、OK等都找过来要审计上过的所有的 Token 合约代码,此时形成了业界规定,项目方上币必须经过安全公司审计,并且出具合格的审计报告。赶上了风口,从此智能合约的审计业务爆发了……

(5)在慢雾的第一年,年中的总结汇报是我做的。所有的安全顾问客户和合约审计客户列表我统计完觉得,不枉费这一年的辛苦,这个成绩值得肯定。当时第一年我们四五个人服务了 25 还是 27 家客户,年营收大约 1700 W ,当然这并不是我一个人的功劳,我只是作为安全负责人和合伙人做了该做的技术服务,让客户免于被攻击和被盗币,职责所在无可厚非。

(6)讲讲属于我和 yudan 的高光时刻,当时 EOS 上线后,很多交易所第一时间就为了流量接入了,但是当时 EOS 有一个致命的假充值漏洞,作为 EOS 启动时候的最佳配合安全公司慢雾在当时 EOS 圈子内还是很有声望的。但是实际的技术研究人员并不包括余弦,因为他在公司基本上不懂具体的区块链安全技术,他只负责在各个群里收集情报和营销,这也导致了很多时候群里有大佬问技术问题,他都要转发到群里我们给他解答后,他在作为发言人进行营销。但是 EOS 上的核心技术人员就是 yudan 和另外一个同事吧,在 yudan 我们发现了 EOS 假充值的时候,我们配合进行假充值的测试,在当晚的凌晨 2:00 多,我们发现了某知名交易所有这个假充值的漏洞,在此时作为一个有职业操守的安全从业人员,我和 yudan 经住了考验,在我们紧急联系了对方交易所老板和技术后,我们配合测试充值进去金额已经十几亿美金,充值多少到账多少,如果这一晚我们的人品和道德经不起考验,那么我们也早已财富自由(或被抓在大牢里了)。至于慢雾老板余弦为什么在我离职后对外说我坏话,跟我的投资人来滴滴时候说我只是一个小孩子,不懂什么技术,还跟我的 CTO 说我人品有问题,被我 CTO 截图给我看,我是不理解的,我甚至不相信他的人品和道德底线就那么的低。

(7)这一次 Venus 大户被钓鱼攻击的事件在余弦自己公开营销失败后,作为前员工 yudan 仅仅是讲了几句实话,说他威胁别人,他们整个慢雾公司就又激动了,在 Twitter 和朋友圈公开炮轰别人一个技术实力派,如果一家公司仅仅靠营销活着,那么距离倒闭就不远了。

Press enter or click to view image in full size

慢雾科技难道意思是只要你黑慢雾,后果就是我已经不考虑通过法律来维护我和公司的权益了,不管你以后人在哪里,做什么生意,你曾经做的事,我们永远会记仇,并且会盯着你。

我想如果慢雾通过这种方式威胁社区,让别人不敢批评你们,说你们坏话,这不可能。作为曾经的受害者,我不允许也不能让霸凌发生在我和我曾经一起战斗过的兄弟身上。

故事四:我为什么离开慢雾

很多人问过我,为什么在慢雾巅峰时候离开慢雾,我要么轻描淡写,要么很熟的朋友,我会吐槽几句。

Get Alita Btckevin’s stories in your inbox

Join Medium for free to get updates from this writer.

Subscribe

(1)慢雾的股权结构为四个股东每人 25% 持股,死局。

(2)余弦的老婆在公司负责财务和人事。

(3)CEO 黄比干的一些不配作为 CEO 的事情

(作为技术负责人,每次出差都是我和黄比搭档,但是由于他不懂技术,总是我在跟客户沟通,让他显得有点多余插不上话,导致了后来黄比在公司开会的时候情绪崩溃,哭着把桌子上的饰品摔的散落一地,指责我抢了他的风头和有客户需要接待必须我陪客户喝酒,而我在第一年年会上应为同事灌酒导致晕倒在厕所,被120 送去了ICU呆了一晚上,而留在医院看护我的仅仅是我私人关系较好的一个兄弟。以至于后来出院半个月内电脑密码都不记得,导致的后背脊椎损伤和记忆损伤,这样的公司无异于 996 压榨员工的无情机器,没有什么感情跟员工讲。

(4)当然也有心凉了和给的少了

(我去慢雾一开始说大家都是兄弟一起创业的薪资就降低一点吧,让我一个从深圳过去厦门的人降低薪资要求,只能给到月薪 1.5 W-2W 当时,算是钱少事多离家远,当然这些我都自愿接受了,无可厚非。周瑜打黄盖,一个愿打一个愿挨,但是当时我一年负责 25 个项目,一年营收 1700 W,年终奖就给了两个月薪资 4 W,后来想想,我觉得这种公司只能共苦,不能同甘,算了吧,老板格局小了)

故事五:最终的离开是【道不同不相为谋】

在经历了种种不公平和让人心凉的事情后,让我最不能接受的是公司和工司的人的虚伪。在 EOS 上线的不久,EOS 上面发了一个项目叫 EOS 狼人杀,而这个狼人杀项目就是慢雾的股东和内部的人找人做的,但是最终让做这个项目的人背了黑锅,在这里也要为他们正名,他也是无辜的,因为赚的最多的反而是慢雾的人(有兴趣自己去看https://zhuanlan.zhihu.com/p/40861640

这是慢雾科技的 CEO aby 的 EOS 账户,有兴趣的可以自行研究,看看当时参与的行为。

Press enter or click to view image in full size

慢雾科技Press enter or click to view image in full size

慢雾科技Press enter or click to view image in full size

慢雾科技当然在第二天 aby 给了我一个钱包,里面有 500 EOS,我收了,如果需要证明可以提供出来。

慢雾科技也是EOS狼人杀该项目的审计公司,人品和道德高下立见。

当婊子就不要立牌坊,这一次需要让行业知道更多的真相。

我和 yudan 这几年被他们说了多少坏话,我相信任何一个离开慢雾的人,都会被慢雾发律师函和发公告,不信等你们离开的时候,我们的经历便是各位的终局。

离开时我曾好言相劝:公瑾好生用兵

可惜,执迷不悟一条路走到黑,有今日之事也不意外。

只是可惜了曾经一起战斗过的兄弟们工作和感情,在此向你们道歉,非我本意,只是他们要赶尽杀绝,我和 yudan 必须揭露他们丑恶的嘴脸

再见了,曾经的慢雾,这是终局。

我亲手毁掉了我曾经创造的一家公司。

借用三体的一句话结束本文:弱小和无知不是生存障碍,傲慢才是!!!

Letture associate

China's AI Fronts: From Yan'an to Midway

This article analyzes the competitive landscape of China's AI industry through a dual-front war analogy: the "Eastern Front" of business model competition and the "Western Front" of global strategic positioning. **The Eastern Front: The Scramble for Supply Lines and Monetization** The "Eastern Front" examines the contrasting strategies of three Chinese tech giants—Tencent, Alibaba, and ByteDance—in the face of AI's high marginal costs. Tencent integrates AI as a catalyst within its existing ecosystems (advertising, gaming, cloud) for monetization, prioritizing high-value scenarios over user growth. Alibaba bets on a full-stack, self-developed approach from chips to applications, aiming to control costs and ecosystem, though this requires immense patience and resources. ByteDance, with Doubao as its flagship, pursues a traditional traffic-driven, "super app" strategy but faces severe monetization challenges as its massive user base incurs unsustainable operational costs. The central challenge for all is building a reliable "supply line" (sustainable funding/profit) and achieving efficient monetization, moving beyond being mere "token factories." **The Western Front: "Preserving Land" vs. "Preserving People"** The "Western Front" frames a global strategic divergence. The U.S. model ("preserving land") focuses on closed-source, high-premium models (e.g., Anthropic) targeting lucrative enterprise markets. China's strategy ("preserving people") leverages open-source models (e.g., Alibaba's Qwen, DeepSeek) and extremely low pricing to attract global developers and capture long-tail markets, akin to a "surround the cities from the countryside" approach. The goal is to make Chinese models the default infrastructure, locking in future ecosystem value. However, the critical test is whether this open-source ecosystem can achieve a commercial闭环, converting developer adoption into tangible revenue (e.g., via cloud services), and bridging the monetization gap with Western models that charge for value, not just tokens. **Conclusion: The Long March from Factory to Brand** The article concludes that China's AI industry possesses technology, users, and scenarios but must integrate them to create and capture value. Its ultimate success depends on navigating both fronts: companies must establish sustainable monetization on the Eastern Front, while the industry's Western strategy must evolve from simply "preserving people" (developer adoption) to truly "preserving both people and land" — transforming open-source ecosystem dominance into commercial success and premium brand value. This journey from being a "token factory" to a "value highland" will require strategic patience and the ability to outlast competitors in a prolonged contest.

marsbit22 min fa

China's AI Fronts: From Yan'an to Midway

marsbit22 min fa

A History of Technological Evolution Powered by Electricity: Aluminum, Bitcoin, and AI

The journey from the Rockdale aluminum smelter in Texas to space-based data centers illustrates a core economic principle: whoever controls the cheapest electricity dictates the use of computing power. The evolution is clear. Old industrial sites with pre-existing, high-capacity power grids are being repurposed. In Rockdale, a former Alcoa plant now houses vast Bitcoin mining rigs, which are increasingly being replaced by AMD chips for AI training. The logic is purely financial: while smelting aluminum yields $0.17–0.27 per kWh and Bitcoin mining $0.05–0.11, AI inference on H100 GPUs generates $1.27–3.67 per kWh. Recent deals confirm the rush for power infrastructure. Riot Platforms leases space to AMD; TeraWulf bought an old Kentucky aluminum plant for its grid; NYDIG secured a New York site for its cheap hydropower to mine Bitcoin. As AI giants like Anthropic, Microsoft, Google, and Amazon aggressively expand, they now directly compete with crypto miners for the same industrial power resources, often outbidding them. This has led to a decline in Bitcoin's global hash rate and a wave of miner conversions to AI data centers. This "digital resource curse" extends globally. Gulf nations, long offering subsidized power to attract heavy industry like aluminum, are now pivoting to become AI and cloud computing hubs—exporting computational power instead of physical commodities. Similarly, Bhutan halted its sovereign Bitcoin mining to sell hydropower directly to India for a steadier return. The frontier is space. Projects like Starcloud plan orbital solar-powered data centers, leveraging constant sunlight and natural cooling, with Bitcoin mining as a secondary use for surplus power. Even consumer brands are transforming; Allbirds shifted from footwear to AI infrastructure, causing its stock to surge. Meanwhile, crypto projects like Bittensor, Render, and Akash propose a decentralized alternative, creating markets to aggregate distributed, idle computing resources from individual hardware. The underlying infrastructure—the power grid—remains constant. As profit margins shift, the facilities built upon it will continue to evolve, from aluminum to Bitcoin to AI and beyond, always chasing the highest yield per kilowatt-hour, whether in Texas, Abu Dhabi, or low Earth orbit.

marsbit32 min fa

A History of Technological Evolution Powered by Electricity: Aluminum, Bitcoin, and AI

marsbit32 min fa

Conquering is easy, governing is hard: Polymarket must bow to regulations to plant its flag globally

Polymarket, a decentralized prediction market platform, faces significant regulatory hurdles in its global expansion. Its "permissionless" model, which bypasses traditional identity and financial controls, has led to widespread crackdowns. India recently blocked the site, categorizing it as illegal online gambling under new 2025 laws. Brazil also banned it and similar platforms, though it simultaneously authorized a regulated, investor-only version on its national exchange. Across Europe, countries like France, Portugal, and the Netherlands are enforcing bans based on existing gambling and financial regulations. To enter key markets, Polymarket is adopting a pragmatic, compliant approach. In the U.S., it paid a $1.12 million fine, acquired a CFTC-licensed exchange, and now operates a regulated, KYC-mandatory platform for American users. It also secured a major investment from Intercontinental Exchange (ICE), which will distribute its prediction data to institutional investors. In Japan, where gambling laws are strict, Polymarket has begun a long-term lobbying effort, aiming for legalization by 2030 through building institutional partnerships and community presence. Despite these challenges, the prediction market industry is booming, with global volume projected to surge from $51 billion to potentially $1 trillion by 2030. Polymarket's core dilemma remains: adapting its decentralized, anonymous model to fit within sovereign regulatory frameworks focused on licensing, consumer protection, and anti-money laundering rules. Its survival in each market depends on navigating this complex political and legal landscape.

marsbit34 min fa

Conquering is easy, governing is hard: Polymarket must bow to regulations to plant its flag globally

marsbit34 min fa

It's Easier to Conquer than to Govern: Polymarket Must Bend to Every Rule to Plant Its Flag Globally

Polymarket, a decentralized prediction market platform, is facing significant regulatory hurdles as it expands globally, illustrating the tension between permissionless, crypto-native platforms and national legal frameworks. The platform, which allows users to bet on event outcomes, was recently blocked in India under new online gambling laws and faces similar outright bans in Brazil and Ukraine, the latter citing moral objections to wagering on active war events. In Europe, countries like France, the Netherlands, and the UK are restricting access by enforcing existing gambling and financial derivatives regulations, forcing Polymarket to geo-block users or operate in view-only modes. To navigate this complex landscape, Polymarket is adopting a market-by-market, compliant strategy. In the U.S., it paid a $1.4 million CFTC fine, acquired a licensed exchange (QCEX) for $112 million, and now operates a regulated U.S. entity with strict KYC, abandoning anonymity. It also secured a major investment from Intercontinental Exchange (ICE), which will distribute its prediction data to institutional investors. In Japan, a high-potential market, it has begun a long-term lobbying effort aiming for legalization by 2030, acknowledging the country's strict anti-gambling laws and slow regulatory processes. The article concludes that while the global prediction market is growing rapidly—projected to reach $2.4 trillion by 2030—Polymarket's core challenge is transforming its decentralized model to fit sovereign regulatory systems built on licensing, consumer protection, and anti-money laundering rules. Its survival depends on proving its legitimacy in each jurisdiction.

链捕手39 min fa

It's Easier to Conquer than to Govern: Polymarket Must Bend to Every Rule to Plant Its Flag Globally

链捕手39 min fa

Trading

Spot
Futures
活动图片