Coinspect Security

This account is verified because it's an official organization on X. Learn more

@coinspect

You Build. We Defend.
Since 2014 protecting critical decentralized systems: L1 nodes, smart contracts audits, wallets, web3 dApps, exchanges, bridges.

coinspect.com Joined July 2014

806 Following 3.3K Followers 2.4K Posts

Latest posts 5

Pinned post

Coinspect Security @coinspect Oct 2

Coinspect is now a Ledger security audit partner for Ledger wallet apps!
As one of Ledger's approved audit partners, we bring our crypto and embedded security expertise to help developers find and fix vulnerabilities before release.
Building a Ledger app? Let's talk.

Coinspect Security @coinspect 3d

PQ security matters. But Web3 still ignores Bybit's hack fundamental lesson: blind trust in frontends.

Clear signing helps, yet DNS, third-party JS, and deployment pipelines remain critical attack surfaces as AI accelerates exploits.

dApps can improve frontend security now:

Coinspect Security @coinspect 4d

Worth highlighting: @vercel's hardened Firecracker deployment was not vulnerable to the escape we discovered.
Good to see their investment in sandbox security paying off!

Vercel @vercel Aug 18

Agents can now exploit vulnerable sandbox boundaries, so we are testing ours in the open.

$1,000,000 hacker challenge for Vercel Sandbox:

• Escape the Firecracker microVM
• Defeat the host-side network boundary
• Up to $50k/report via @Hacker0x01

vercel.com/blog/one-milli…
View quoted post on X

Coinspect Security @coinspect 5d

We escaped AWS Firecracker. 🔥

We discovered a VM isolation vulnerability affecting versions 0.23.0–1.16.1 when restoring snapshots using the File memory backend with balloon or virtio-mem devices.

Fixed in 1.16.2 and 1.17.0+ (CVE-2026-122192)

Technical write-up:
coinspect.com/blog/firecrack…

www.coinspect.com Escaping Firecracker from Guest Userspace Coinspect demonstrated a Firecracker sandbox escape from guest userspace, gained code execution in its host-side process, and used a second issue to bypass Firecracker's...

Coinspect Security @coinspect 5d

Sandboxes are more important than ever.

Strong isolation doesn't happen by accident. It takes continuous adversarial research.

We push the boundaries of security so builders can push the boundaries of technology.

You build. We defend.

Coinspect Security Verified account @coinspect Nov 2

AI agents are increasing the amount of untrusted code running on shared infrastructure.

Providers rely on sandboxing to isolate it. An escape to the host exposes other tenants’ data and is a first step toward broader compromise.

Few security boundaries carry higher stakes:

View quoted post on X