DeFi faces evolving risks in both security and trading domains, including fake tokens, rug-pulls, hidden taxes, bundling, sniper bots, address poisoning, and illicit fund flows. This talk introduces state-of-the-art detection techniques built on scalable machine learning and blockchain/financial analytics.

More AI code often means more prompts, but prompts carry all the problems of natural language. Instead, we should center the work on executable specs and correctness properties as the source of truth to design safer, clearer, auditable systems.

In this talk, I will explore how artificial intelligence is pushing the boundaries in decentralized finance security. DeFi has grown fast, but it faces big risks like smart contract bugs, flash loan attacks, and governance hacks. AI can help by simulating vulnerabilities before they happen, letting developers test protocols in safe ways.

Smart contracts lose billions annually due to hidden bugs. This talk shows how dependency-aware AI and auditor-labeled datasets reduce false positives and uncover complex vulnerabilities, enabling scalable Web3 security.

Large Language Models are quickly becoming part of the security researcher’s toolkit, but their value in bug bounty reporting is often misunderstood. While LLMs can speed up writing, clarify technical explanations, and even help spot inconsistencies, they can just as easily generate noise, false positives, or overconfident nonsense that wastes everyone’s time. This talk explores where AI can genuinely improve the quality and clarity of bug reports and where it actively hurts both researchers and triage teams.

DeFAI, where DeFi meets AI, offers powerful innovation but expands the attack surface. This talk presents a 3-layer framework to secure data, models, and usage, preventing exploits and building trust in the future of web3 finance.

As the Web3 security landscape diversifies, auditors are exposed to more infrastructure codebases such as blockchain nodes or cross-chain messaging software. This talk offers a comparative analysis of common and emergent bug classes between auditing smart contracts and infrastructure projects.

When kicking off a review, fuzzing, or formal verification campaign on a new DeFi project, the hardest part is often deciding what invariants to check. Deep, protocol-specific properties usually require a full understanding of the code, but you don't need to wait for that. This talk introduces a set of simple, universal “day-1 invariants” that apply to nearly every protocol.

Most protocol docs and audit reports contain smart contract diagrams. They describe flows (control, assets, data), actor and threat models, and they all do it a bit differently. The talk will present what could be a shared standard for diagrams.

Exploits of Web3 projects are increasingly targeting the human threat vector. In this humorous but educational talk we explore the operational security risks project face from the attacker's viewpoint.

Finding obscure bugs by dissecting state transitions: how each sequential function call reads and writes to the state. This is a visual method that supports developing and validating bug hypotheses, and I'll show how I found unique issues with it.

Audits are checkpoints, not finish lines. Learn a simple, always-on security model: embed security in dev, use AI, audits, fuzzing, formal methods, contests and bounties—what each catches, when to use them, and how to measure progress.

Funds lost due to social engineering and phishing attacks on crypto teams are quickly rising. This talk will go over the latest developments in phishing attacks and a practical guide on how your team can stay safe.

TBA

In this talk I am going to be presenting an open-source framework for organizations to use in red-teaming their crypto wallet operations. This talk will present a testing and evaluation framework for how any organization can comprehensively assess the security posture of their crypto wallet operations, and identify areas for improvement.

Transaction Simulation Spoofing (TSP) introduction, a systemic attack class that affects wallets, users, and dApps. The talk will cover how TSP works, its impact, live demos, and potential solutions. Presenting the work done ESP Grant for the ETHRangers program.