Monad co-founder Keone Hon urges crypto teams to prioritize security, share operational security (OpSec) guidelines as attackers gain more powerful AI capabilities, and promote the foundation’s open-source tool, Ultrafuzz.
- Hon encourages developers to run Ultrafuzz on their own contracts and enhance operational security.
- Monad's OpSec guidelines cover phishing, credential management, employee devices, and third-party account permissions.
- Ultrafuzz was open-sourced in September, prior to Hon's most recent call for the team to use the tool.
- The controls for mitigating losses mentioned in the guide include key exposure, supply chain attacks, and social engineering.
The Monad Foundation’s resources cover both the software deployed by software teams and the accounts, devices, and signing arrangements used to manage that software. Hon directs readers in the post to the Crypto OpSec Bible, guidelines on administrator accounts, and research on using AI to identify vulnerabilities.
He wrote: “In this era of AI-empowered attackers, the only way forward for our industry is to continue strengthening our defenses. Security should be the top priority for every team.”
Monad's OpSec guide addresses common security mistakes
Omar’s “Crypto OpSec Bible” opens by expressing frustration over recurring breaches involving unknown code, phishing, exposed credentials, and poor device management.
This guide cites ChainLight’s Lumos tracker. According to the tracker’s recorded events from January 2023 through the statistical cutoff date referenced in the guide, the exploited value due to control hijacking amounted to $3.31 billion, while the exploited value due to smart contract vulnerabilities totaled $983 million.
Among these, the hijacking category includes social engineering, private key exposure, unauthorized access, supply chain attacks, and other traditional security failures. This comparison presents events recorded by trackers as a historical snapshot.
Omar believes that crypto organizations still do not place enough emphasis on operational security. His recommendations include separating personal activities from work devices, using clean computers or browsers for crypto-related tasks, and reviewing transaction details before signing.
For critical accounts, guidelines recommend using a hardware security key, securely storing backups, using unique passwords, and keeping authentication codes separate from passwords. For organizations, it is recommended to deploy endpoint protection and designate clear points of contact for reporting security incidents.
Hon urges developers to check administrator permissions.
For smart contract developers, Hon emphasizes not relying on externally owned accounts (EOAs) as administrators and advises using a dedicated laptop when signing administrative functions.
His resource list also includes formal verification and research on threat hunting using large language models. In another post, he encouraged developers to run Ultrafuzz on their own contracts and referenced Antonio Viggiano’s experience, inviting external feedback.
Hon wrote: "Smart contract developers, run Ultrafuzz on your contracts! It's open-source and available to anyone."
The open-source announcement for this tool was published on September 10. Hon’s recent post has reignited external attention on this existing announcement and sparked discussions about the foundation’s operational security resources.
Ultrafuzz combines AI investigation with contract testing.
Ultrafuzz is available via a public GitHub repository and coordinates specialized AI agents to review contracts, map user behavior, investigate security properties, run testing strategies, and compile findings for review.
Monad states that over 20 runs of ecosystem projects helped shape this release, and the tool supports Solidity and Vyper.
During the technical presentation, Viggiano described how he developed the tool while assisting a team in preparing for an external security audit. The project lacked fuzz testing, which led to the creation of an AI-assisted workflow for generating these tests.
His explanation shows that these agents identify the conditions the protocol must maintain, then investigate whether specific operations or sequences of operations would violate those conditions. The findings are then compiled, reviewed, and organized into a report.
Monad requires users to run Ultrafuzz on disposable, isolated virtual machines. The agent has unrestricted permissions, and the announcement warns against running this tool on developer workstations or machines containing sensitive credentials.
Recent security incidents have exposed risks related to account and software dependencies.
Previous incidents involved multiple access points covered by this guide.
On October 26, crypto.news reported that wallet manufacturer Foundation experienced a Cloudflare API key leak, enabling fraudulent emails to be sent that appeared to originate from its official domain. The company has revoked the compromised credentials and stated that Passport hardware and stored funds remain secure.
In July, a developer package for Injective was compromised. Security firm Socket stated that the malicious code intercepted the wallet generation function and exfiltrated private keys and seed phrases via forged telemetry. Injective CEO Eric Chen said the affected version has been deprecated and the issue has been resolved.
Another July investigation involved OkoBot’s coin-stealing malware, which spread through GitHub repositories disguised as legitimate software. The campaign used false misinformation and repair instructions to trick victims into executing malicious commands. Its modules included a forged wallet recovery interface, keylogging, and clipboard monitoring.