Indepth Research

Provide in-depth research reports and independent analysis, leveraging data, technology, and economic insights to deliver a comprehensive examination of the blockchain ecosystem, project potential, and market trends.

The Code Was Fine, But It Was Still Hacked: What Is the 'DVN Configuration Vulnerability' Behind the Biggest Hack of 2026?

Title: Code Was Secure, Yet $293M Stolen: The 2026 DVN Configuration Breach Explained On April 18, 2026, Kelp DAO’s restaking protocol was exploited, losing 116,500 rsETH (worth $293M at the time) due to a configuration flaw—not a smart contract vulnerability. The attacker used a forged cross-chain message to drain funds via LayerZero’s bridge, then dispersed the stolen rsETH across Aave V3, Compound V3, and Euler to borrow real assets, ultimately escaping with $236M in WETH. The root cause was a critical misconfiguration in Kelp’s LayerZero V2 setup: the protocol used a 1-of-1 Decentralized Verifier Network (DVN) threshold, meaning only one node approval was needed to validate cross-chain messages. The attacker compromised that single node, allowing unauthorized minting of rsETH on Ethereum. This configuration choice—permitted by LayerZero but highly risky—left zero fault tolerance. In contrast, protocols like ApeChain using multi-node validation (e.g., 2-of-3 or 5-of-9) remained secure. This incident highlights a blind spot in DeFi security audits: tools like Slither and Mythril scan code for logic flaws but ignore configuration parameters. The 2022 Nomad hack ($190M loss) also stemmed from a config error, bringing total losses from such issues to ~$482M—rivaling private key breaches. The Kelp exploit underscores the need for standardized config audits and higher baseline security in cross-chain designs.

marsbit2 ч. назад

The Code Was Fine, But It Was Still Hacked: What Is the 'DVN Configuration Vulnerability' Behind the Biggest Hack of 2026?

marsbit2 ч. назад

a16z on Hiring: How to Choose Between Crypto-Native and Traditional Talent?

Hiring in Crypto: Balancing Crypto-Native and Traditional Talent As the crypto industry grows, founders face the dilemma of whether to prioritize hiring professionals with blockchain experience or those with traditional tech backgrounds who can learn. The key is recognizing that crypto companies are still tech companies at their core and should apply proven hiring best practices. Crypto-native talent offers immediate productivity and is essential for roles involving high-stakes, specialized work like smart contract development, where errors can be catastrophic. However, traditional professionals from large-scale software companies bring valuable experience in scaling products, operational flexibility, and expertise in areas like fintech, UX, and security, which are crucial as crypto products target mainstream adoption. Recruiting requires tailored approaches. Some candidates may be hesitant due to crypto's volatility or complexity, while others are excited by its innovative potential. Assess candidates' motivations, curiosity, and alignment with the company's vision early. Emphasize the opportunity to shape technology's future and address financial incentives, such as token-based compensation, which can offer liquidity compared to traditional equity. Onboarding is critical. Identify knowledge gaps during hiring and design education programs, mentorship, knowledge-sharing sessions, and resources like blogs or courses to accelerate learning. Pairing new hires with experienced crypto professionals helps bridge gaps and fosters collaboration. Ultimately, successful teams blend both crypto-native and traditional talent, leveraging their strengths to drive innovation and growth.

marsbitВчера 01:17

a16z on Hiring: How to Choose Between Crypto-Native and Traditional Talent?

marsbitВчера 01:17

a16z: The Next Frontier of AI, The Triple Flywheel of Robotics, Autonomous Science, and Brain-Computer Interfaces

a16z presents a comprehensive investment thesis for the next frontier of AI: Physical AI, centered on a synergistic flywheel of robotics, autonomous science, and novel human-computer interfaces (HCIs) like brain-computers. While the current AI paradigm scales on language and code, the most disruptive future capabilities will emerge from three adjacent fields leveraging five core technical primitives: 1) learned representations of physical dynamics (via models like VLA, WAM, and native embodied models), 2) embodied action architectures (e.g., dual-system designs, diffusion-based motion generation, and RL fine-tuning like RECAP), 3) simulation and synthetic data as scaling infrastructure, 4) expanded sensory channels (touch, neural signals, silent speech, olfaction), and 5) closed-loop agent systems for long-horizon tasks. These primitives converge to power three key domains: * **Robotics:** The literal embodiment of AI, requiring all primitives for real-world physical interaction and manipulation. * **Autonomous Science:** Self-driving labs that conduct hypothesis-experiment-analysis loops, generating structured, causally-grounded data to improve physical AI models. * **Novel HCIs:** Devices (AR glasses, EMG wearables, BCIs) that expand human-AI bandwidth and act as massive data-collection networks for real-world human experience. These domains form a mutually reinforcing flywheel: Robotics enable autonomous labs, which in turn generate valuable data for robotics and materials science. New interfaces provide rich human-physical interaction data to train better robots and scientists. Together, they represent a new scaling axis for AI, moving beyond the digital realm to interact with and learn from physical reality, promising significant emergent capabilities and value.

marsbitВчера 07:05

a16z: The Next Frontier of AI, The Triple Flywheel of Robotics, Autonomous Science, and Brain-Computer Interfaces

marsbitВчера 07:05

The Real Battlefield of AI Lies in the 'Dark Forest'

The article "AI's Real Battlefield is in the 'Dark Forest'" discusses the shifting dynamics in the global AI landscape, contrasting the strategic directions of Chinese and U.S. AI developers. Chinese companies like Alibaba (with its "HappyHorse" video model), ByteDance (Seedance 2.0), and Kuaishou (Kling 3.0) have taken the lead in text-to-video generation, surpassing OpenAI’s now-discontinued Sora. These models are deeply integrated into their parent companies’ content ecosystems (e.g., Douyin, Kuaishou), serving to reduce content creation costs and enhance user engagement rather than operating as standalone profit centers. In contrast, U.S. firms are pivoting toward high-stakes enterprise and security applications. Anthropic’s Claude Mythos model demonstrates advanced capabilities in autonomously discovering and exploiting software vulnerabilities, prompting concern at the highest levels of U.S. financial and governmental institutions. OpenAI responded with its own GPT-5.4-Cyber, signaling a strategic shift from consumer-facing products to enterprise-grade tools focused on cybersecurity and programming. The divergence is attributed to fundamental differences in resources and market structures. U.S. companies, backed by vast computational resources (e.g., Amazon and Google supply Anthropic with substantial funding and TPU access), can pursue deep, specialized R&D in high-value B2B sectors. Chinese firms, facing significant compute power constraints and a less mature enterprise SaaS market, have found success by leveraging their massive consumer platforms and optimizing for cost-efficiency. The article warns that the AI race is entering a "dark forest" phase—a reference to competitive dynamics where cybersecurity capabilities could determine digital sovereignty. While Chinese models like Zhipu AI’s GLM-5.1 show promise in narrowing the gap in coding proficiency, the author stresses that achieving parity in security-critical AI will require asymmetric strategies, including greater investment in coding models, adaptation to domestic hardware, and exploring international markets in the Global South.

marsbit2 дня назад 01:53

The Real Battlefield of AI Lies in the 'Dark Forest'

marsbit2 дня назад 01:53

活动图片