The Web3 Security Podcast

StarkWare's CISO bootstrapped the Israeli Air Force's penetration testing team before spending years across mobile forensics at Cellebrite, email security at Proofpoint, and enterprise DevSecOps at Red Hat. That depth across offensive and defensive disciplines is rare in Web3, and it shows in how Haim Krasniker thinks about protocol security. In this episode, Haim gets specific about the tradeoffs...

Most Web3 security conversations focus on smart contracts. Mudit Gupta, CTO of Polygon Labs, thinks that's the wrong place to be worried. In this episode, he makes the case that ZK infrastructure carries significantly more bugs than the smart contract layer — the reason large-scale exploits haven't happened yet isn't that the bugs don't exist, it's that the expertise required t...

When Sky's audits return serious issues, they don't just fix bugs and ship—they pull the brake and investigate what failed in their internal review process. Deniz Yilmaz, CTO of Sky Frontier Foundation, walks through the defensive layers behind USDS (third-largest stablecoin globally): six-month engineer onboarding requirements, spellcrafting governance with mandatory execution delays, and...

World Foundation's proof of personhood system defended against an iris spoofing attack where users verified multiple times by pairing their left eye with someone else's right eye—exploiting uniqueness checks that operated on eye pairs rather than individuals. DC Builder, Research Engineer at World Foundation, explains the multimodal defense they deployed: continuous 3D heat mapping, time-of-flight...

When Solana dropped to $8 during FTX, Matt Sorg watched Twitter erupt while his validator network stayed focused on the technical roadmap. The VP of Technology at Solana Foundation had built something that would prove more valuable than hype: a technically aligned community shipping performance improvements on a quarterly cadence. Matt explains why Solana's early instability wasn't architectural i...

Coinbase's security process protecting over $7 billion in TVL rejects the single-audit model common in DeFi. Shashank Agrawal, Senior Engineering Manager, Protocol Security at Coinbase, explains their multi-round validation approach: internal security teams (separated from product engineering) audit first, then external firms audit, and rounds continue until external auditors surface only lows and...

Justin Drake reveals Ethereum's infrastructure path to 1 gigagas per second—equivalent to 10,000 TPS and 10x Solana's current user transaction throughput—while operating validators on consumer hardware. As researcher on Ethereum Foundation's protocol architecture team, he details how ZK-EVM proof systems will eliminate the validator bottleneck within six years, enabling state verification on Raspb...

When the Interchain Foundation acquired Skip Protocol in 2024, Cosmos Labs inherited a 200-chain ecosystem with no commercial strategy and a massive security backlog. Barry Plunkett, co-CEO, explains how they systematically tested three strategic pivots in six months, killed two based on hard metrics, and found enterprise product-market fit by following "accidental traction" signals they'd initial...

Maker's core accounting contract—the vat—has remained immutable for six years while processing tens of billions in TVL. Centrifuge is proving this isn't legacy thinking; it's the only approach that survives institutional custody requirements where protocol upgrades introduce unacceptable counterparty risk. Jeroen Offerijns, CTO of Centrifuge, explains why their $750M TVL RWA protocol runs 6-7 seri...

Safe's smart account infrastructure secures $60B+ in TVL while handling over $1 trillion in cumulative transaction volume. Co-founder, Richard Meissner reveals how Safe is rebuilding its collaboration layer from scratch—replacing centralized transaction services with encrypted on-chain queues while preparing smart accounts for post-quantum cryptography through deterministic deployment standards. T...

Sebastian Bürgel's modified Lighthouse client can map any Ethereum validator's public key to their IP address by collecting attestation signatures and tracking their network origin points. Once mapped, attackers can launch precisely-timed DDoS attacks during that validator's block production slot, forcing them offline and redirecting their MEV opportunities to the next validator in sequence. This...

When you discover someone who found a way to decrypt every WhatsApp message through symmetric key reuse, then later designed Coinbase's ETH staking architecture that has never experienced a slashing event, you're looking at a rare breed of security engineer who bridges the exploit and defense mindsets perfectly. Anto Joseph, Principal Security Engineer at Eigen Labs, walks through his unconvention...

What happens when you're responsible for $70 billion in user funds and every code change requires approval from hundreds of token holders? Ernesto Boado discovered that managing AAVE's security feels identical whether it's $10 million or $70 billion at stake—the key is abstract thinking that prevents paralysis while maintaining rigorous procedures. As co-founder of BGD Labs and former CTO of Aave,...

What happens when a veteran Web2 security executive turns multisig ceremony coordinator at Polygon? The result: a crash course in how Web3 security demands both old-school fundamentals and bleeding-edge vigilance in protecting billions of dollars locked on-chain. Christopher von Hessert , VP of Security at Polygon , reveals how traditional security expertise from companies like IBM and ServiceNow...

Fredrik Svantes evolved from hunting World of Warcraft gold farmers to securing Ethereum's trillion-dollar ecosystem as the foundation's Security Research Lead. Running the world's oldest blockchain bug bounty program while spearheading initiatives to make Ethereum safe for both billion-user adoption and institutional trillion-dollar deployments, he offers rare insights into the security challenge...