How to Infiltrate a Web3 Project: The Hitchhikers Guide for Aspiring Black Hats!
DeFi Security Summit at Devconnect Argentina 2025 · November 2025 · 4:19
Jan Philipp Fritsche, managing director of Oak Security, gives a humorous but educational guide to infiltrating a Web3 project from an attacker's viewpoint. As exploits increasingly target people rather than code, the talk walks through the operational security risks that projects face, so teams can see their own exposure the way an attacker would.
Speakers
Topics
From DeFi Security Summit at Devconnect Argentina 2025, hosted by DeFi Security Summit.
Transcript
I'm Yan from Oak Security. Um, thanks for coming. Um, so this is a hitchhiker's guide for web three blackheads. Basically, um, we need to go through target selection. Then we go need to go through timing and choose a exploit vector. Um, I think like one of one of one of the easiest way to identify a target is just looking for a project that really um advertises with audits, right? because like in in web 3 we equate um cyber security with audits and I I really realize all the time um when I'm asked like what do I do I'm a cyber security company I I'm asked like ah do you do audits and I really think that security is shouldn't be a feature
in the end um we should have a holistic process right another important thing when it comes to target selection is at at to look at the GitHub and if and if you recognize that it um it moves like driven by AI like likely it's going to be a good target. Um then we have to look into timing. Um if you want to exploit a a project um you have to bet on VCs basically. So you uh look at when did they raise and when you recognize that runway is is is is going to be short they get a lot of pressure and they have to deploy fast.
So um that means yeah um they have to deploy fast and then likely they're going to make mistakes. And my final and like uh most important comment would be to not exploit um the uh code but really exploit the culture. So recently I was invited to a cyber security conference and I was invited to speak and I got a message and in the message um I I don't want to go into specifics here. So they reach out to me via unknown channel and it's not verifiable to me and uh they lead with urgency.
So, um, especially they say I should I should really get this one mail that looks a bit suspicious to me out of my spam folder and promise me to uh get on a dinner with other speakers in return for that. And I would say okay this this can happen but like the the interesting part here is that we accept this as as a culture in the industry and we have to um break that culture. We have to move slower and we as secure as security researchers have to lead with good example and um yeah uh use maybe safer messengers but also um don't accept
these these um structural problems that we have. So what to do? First of all, I think we just need to take our time. Second, we need to take ownership and we need to empower our clients to take ownership because like the code quality before the audit matters so much more than the audit itself. Obviously the audit is a important step in the security life cycle but we have to empower projects to write secure code in the first place.
Um yeah there's a whole lot of things that can be done. um especially in the design phase but also in um throughout the whole um throughout the whole life cycle you should do OBSC training and you should empower your employees to um yeah basically use every every tool securely we've seen great talks before on operational security and um yeah I want to say that I think like this redundancy part is really overlooked in web 3 and we should um go to a world where we uh audit basically processes instead of snapshots.
If that resonates with you, um I would encourage you to check out solidified.io and um yeah, figure out how we plan to raise the bar for the industry. Uh many thanks.