i've seen events in almost 20 countries and cities over the last 4-5 years, from denver to new york, and never seen programming like devcon mumbai at jio world centre. best-run event i've been to. ambani made us all proud. this is india today. now the question is on us: how do we give back and build things like this that make all of us proud?

most RWA debates are about legal title (SPVs, custodians, bankruptcy remoteness). those are all fair concerns, but look at where money actually goes missing. There have been 257 incidents since 2022, resulting in a loss of $9.69 billion. About half of these stemmed from stolen keys, phishing and supply chain attacks, and compromised private keys alone accounted for 24%. In Q3, $906.8 M of the $1.18 B lost was due to compromised vendors and development tools, fixes that nobody installed, and parts that nobody put in scope. now apply that to a tokenized fund. the asset sits with a custodian, but the price, the mint and the blacklist sit with a few keys at the issuer. Paxos mistakenly minted 300 trillion PYUSD from a hot wallet. The Liquid Network, home to $1.5 billion of RWAs, minted 4,000 unbacked L‑BTC in September and withdrew 4,000 real BTC from its federation, most of it came back. The bug ignored any legal wrapper. A court can protect your title, but it can't unmint a token. That's the version of 'do you REALLY own it' I want answered tomorrow.

100 beta users in. still plenty to build. but seeing quillshield turn a dismissed bug into a reproducible exploit is a pretty good reason to keep going.

I have a request for the founders, VCs and everyone attending who is in a position to help. Please make time for the developers. 8 Devcons in 12 years, and this is the first one in India. Many are travelling from other Indian cities and from abroad, for their first Devcon. Walking up to a stranger to talk about what you’re building takes courage. Give them enough time to be heard. Ask about their work. Listen to where they’re stuck. Offer feedback, an intro, or help with their next step. Please don’t let immediate ROI decide who gets your time. With the market mood right now, I’ve decided to spend more of my Devcon with young developers, without any ROI. I’m asking others to do the same. If you’re a first-time developer there, come say hello. I’d love to hear what you’re building. I’ll be in Mumbai, November 1–6. Let’s help them leave Mumbai with more confidence than they came with.

half of crypto twitter is going to read this as ethereum. it's worse, an AI says one of the core assumptions behind hard math is wrong

the craziest part of the Brotli bug isn't the bug. the fix was sitting in Brotli's code since February. nobody realised it was a security hole, so no new version shipped. for 8 months, every app built on the last official release still had it. Node.js, Bun, proxies like Envoy. it took, AI-assisted security testing to connect the dots.

$2.7M printed out of thin air in one go. That's what a hacker did on Initia tonight, then moved it out before the team could react. Initia switched off its entire network tonight after a bug let an attacker create ~$2.7M in tokens out of thin air and move it out before anyone could stop it. Imagine a bank bug that lets you type in your own balance, then withdraw it. That's an "infinite mint." The co-founder reportedly says it was an unknown flaw in the chain's core software. Full details aren't confirmed yet.

Railway hack: attackers broke in to steal AI keys. TLDR: • Hackers were inside Railway's systems for ~38 hours • They weren't after user accounts. They wanted stored OpenAI, Anthropic and other AI keys • Goal, per Railway: use victims paid AI accounts to copy top models cheaply • They attacked using uncensored AI models and heavy compute • Up to ~100,000 workspaces had secrets potentially exposed • GitHub, OpenAI, Anthropic, Stripe and others revoked keys Your AI key is now a credit card with no limit. Set a spend cap and rotate it today.

3 criticals. 17 highs. 30 days. That was September for our audit team at @QuillAudits_AI. One of the criticals would have let one side of an ETH to TRON swap keep their coins and take the other side's, given 30 minutes of patience. Here's what it was, and how we caught it 👇 https://t.co/dxUwFCwlSi

One commit can undo months of security work. We’ve been building for that moment. QuillShield. First glimpse. 👀 DM for beta access.