Gonçalo Magalhães, Immunefi | Why Privacy Without Security is Theater | Common S3nse 2026

Transcript

Hello. Hello. Um, okay. as I bring your attention to this security topic. Um, yeah, I hope you do not see me just as uh I guess killjoy, but you know, attention to this matter is, as you know, is of utmost importance. So, here we go. On May 29 of this year, Taylor Hornby, a security researcher, during an engagement, he disclosed the critical vulnerability to the Zcash Dev Lab with the help of OPUS 4.8, tiny little detail that they decided to add in the

disclosure. And the vulnerability allowed a malicious actor to create counterfeit ZC inside the shielded pool with no onchain signature. And then a coordinated ecosystemwide fix um was completed on June 2nd as you might have heard. And the bug has been live since the Orcard's activation in May 2022.

So four years before it was found. So we won't go in depth into this vulnerability because um honestly I'm not the best person for it. But let's go through some context around this whole disclosure. So first, as the shielded team, the shielded labs team pointed out, this bug has a particular annoying little detail that due to its nature, quote, there is no way to cryptographically prove whether the vulnerability was exploited before it was remediated. So props to the Shielded Labs team for their transparency. later

on they they will do something that I guess it will prove in some way that there was or or not an exploit. Um the community seemed to have mixed feelings um about all of this understandably. [snorts] Um, you have Udy saying that the Zcash in that Zcash enables a unique class of bugs where if they're exploited, no one would know. This unique class still exists. The fact that they fixed this specific bug is immaterial.

Mythos could find eight others and then Mythos too. Craig Selm from Grayscale on the other hand believed it to be unlikely that quote this vulnerability was actually exploited before being patched. Um, you'd have to believe someone was looking at the Zcash codebase more thoroughly than any of the ECC, Zodel, Shielded Labs, Zcash Foundation, and other core Zcash dev and security contributors combined and resisted the urge to completely run out the Orc pool turn style to sell all its counterfeit ZC.

And again on this flip side, you have Arthur Hayes dumping ZC and claiming that the privacy from AI government big tech narrative demands perfection, not improbability. All right. So let's go go through some of these claims from the perspective um I guess from the perspective of the security community. Let's say I don't necessarily speak uh in the name of the security community. And with that in mind, let me introduce myself. I'm Gonzalo.

Uh I lead security bug bounty triaging and AI work at Immunifi. Immunifi is a security platform for the onchain economy. 93% of total cryptocritical vulnerabilities that are disclosed go through Immunifi. and we've helped prevent more than $25 billion dollars in hacks across more than 650 protocols. So, as my job happens to demand, I've seen most critical vulnerabilities that happen to be found on live protocols happen to be found on live [snorts] blockchains. And to give you a perspective in absolute numbers

um you know because 93% might might not give you everything just a week ago we posted that in the last 30 days security researchers had disclosed 44 valid critical vulnerabilities through Immunifi and to be clear this is not your you know your random protocol with $100 in TVL those protocols typically don't have a bug bounty potentially Um, these are crits in some of your favorite protocols, some of your favorite blockchains. This is not necessarily bad, just to be clear. But let's go back to the Zcash disclosure and let's discuss the aforementioned claims. So, Craig Sam said it was

unlikely this was exploited. I I will not discuss whether it did happen or not. So I I think as I told you Zcash did the ironwood upgrade. So I think through time it's it's proving that an exploit indeed did not happen. But irrespective of that the statement that it's unlikely that someone was paying more attention is definitely not the right point for two reasons. So one well the security researcher found the bug by looking at the code. So it's a matter of whether anyone wanted or or anyone did pay sufficient attention maybe in a in a

different perspective let's say and the incentive of course is huge to find such a bug. Number two this statement almost implies that Zcash devs are the most equipped people to find bugs in their own code. But are they though? and security contributors are being named here in in in this tweet, but you know what's what are the incentives for the security community to to even care or to pay enough attention? [snorts] So, nothing against the devs. Um, but if they are the best people for finding the bugs, why did they not find this one or why why do they not find, you know, the

the 44 criticals that happen to be disclosed on Immunifi? UI seems to, you know, have been completely mind-b blown by the thought that a protocol has a critical bug. And while it's true that other bugs might exist, it's obviously good that a bug was disclosed responsibly and that there were no hacks potentially. And this is also some evidence that you know it was a tough bug um if we can put it that way. Um and since he touches on AI and also the disclosure mentioned the use of Opus 4.8 eight, I want to burst a little bit the bubble of AI as a

magical vulnerability finder. So, at least this would be my opinion. Um, you know, there there's a lot there are a lot of agents finding bugs at Immunifi. What I would say is that Mythos is not what will find a bug. It's like it's a phenomenally skilled bug hunter leveraging these models that will find bugs at scale. And the nuance is very important because you know the Zcash devs also had access to Opus 4.8. And lastly, Arthur Hayes said the privacy from AI government big tech narrative demands perfection not in probability. So he might have been wrong

in selling ZC um at least that's what current price moves say. But he was right on this one. And this could be translated to something like privacy demands security. So for something to be private, something must stay private. That's that's a big challenge. It means that to a certain degree, the protocol or the cryptographic primitive must be robust enough or evolve in a robust enough way to resist the future. So privacy is common sense and privacy is not guaranteed without security. So in a

sense security is common sense. So let's move on from privacy protocols and the Zcash example and venture into the more general ZK world. In February of this year, ZK security. Love those guys. They wrote an article titled the first ZK exploits happened and they weren't what we expected. In this article, they explained that there were two ZKbased protocols that were exploited. One of them well I guess was exploited in a good way let's say uh exploited by white hats and another one was just drained for 5 just I mean it's

a relatively small quantity of money and the root causes were related to growth 16 verifiers with an incorrect setup and this was not what they expected rather they expected um zika hacks to stem from unconstrained under constrained circuits which indeed is it's typically those are typically the bugs that get disclosed on Immunifi. Anyway, I found one specific point that they raised to be of particular interest. They wrote actually I don't have the full quote here. I'll read a portion and then this portion, but they they said we have always had the impression that ZK related code is hard and that's the reason why we haven't

observed any exploits by malicious actors. And then they continue with with what's said here. We just want to believe that the people working in the ZKP space are very security focused and researchers in this field prefer to wear white hats. Also, maybe a famous group simply hasn't started reading about ZKPs yet, referring to the Lazarus group, of course. Now, it's interesting that um there haven't been that many ZK hacks or at least huge ones at least. Let's travel back in time to September 2023.

One of our elite white hats reported a critical vulnerability vunifi that would that would have allowed an attacker to basically drain the entire Aztec connect protocol. I loved Aztec Connect, loved ZK money. If I'm not mistaken, the project I think here when this was reported, by the way, it says October on top, but this is when it was um publicly disclosed, but the the security researchers disclosed it on September. Um, and when it was disclosed, I think the protocol was already um in a sunset stage, I think. So, it had only $5 million only $5 million in

funds at risk. And so, the white hat was rewarded a bounty of half a million dollars. I think the the bug was something to do with like again an under constrained circuit, something to do with the witness. I I don't remember to be honest. But fast forward again to crack sel, how likely is it that a bug is not found by anyone? That's a, you know, a subject matter expert of the protocol, a subject matter expert on the code, on the cryptography, and then a security researcher comes in and finds a live vulnerability.

Are Zcash devs and researchers or Aztec devs and researchers simply incompetent? Well, of course not. At least that's I'm not 100% sure, but I would say not. So, here's why this happens. I've talked about this in the past. I'll give shorter TLDDR here. The hacker mind, the hacker mindset. I'm specifically speaking about the people who usually hunt on live protocols um is a mysterious thing. I will say that as you can see from some of these examples that are just to illustrate a little bit pawning that was an elite

researcher that um they earned $8 million on and was asked about his methods and he said a few years ago I guess maybe he's now using AI I don't know but he used no tools no frameworks and then in other messages he was just saying like seems just seems like having a random part-time style Well, and then he spends days sitting on a bug working on it, taking his time. Infosac is number 16 on the Immunifi leaderboard, has never written a Solidity smart contract, yet he has found dozens of critical bugs in smart contracts.

Another white hat who earned over a million dollars on Imunifi, he has some of some of the craziest ways to break a protocol. his his bug reports are always a nightmare to to review and actually most of our feasibility rules that we have are due to their due to his bug reports. Um we kind of had to invent rules because of him and he was asked about the trolley problem and this is his answer. I'd let the cart move its first set of wheels on the track to the two people and then switch the lever to keep the second pair of wheels on the main track the railing the train etc.

Anyway, it's not it's not a proof of security skills. Um, also it's cheating because this is not a a valid solution. But still, you kind of see some of the details in these examples. this out of the box thinking a little bit or very um non not the typical way of of of doing stuff that that are part of these special traits of of the hacker brain. So in a nutshell, I don't know how much time I have left, sorry. Um, who are the hackers? So they are, thank you. They are independent thinkers. They have no

bias towards certain solutions or certain ways of looking at the code. So you can you can immediately see the the huge difference to devs of G protocol. they can actually see something from a whole new perspective and that's why they see what the devs don't see. They have what I call fierce creativity. They will constantly ask what if. While the dev is, you know, um nothing against the devs to be clear, but while the dev is often focused, as his job requires on making the application work, work as intended, the

hacker couldn't care less about how the app is supposed to work. They are basically focused on the what if scenarios and this is actually crucial for finding bugs and actually crucial for finding bugs in under constrained circuits as well because it's typically what is not there. what's there is is sound but something is missing or maybe like the parameters if they they are not put as they are expected to be put.

They have attention to detail. They deeply understand what is at play and they are able to break complexity down into much smaller um simple parts. If you if we go back to the protocols that we saw, you know, Aztec, Zcash, they they are complex. I wouldn't say they are simple protocols. Um, and so it kind of feels overwhelming to go and review them. Yet, um, if we then look at I didn't show, but if we look at the specific bugs, they're often just like a single line. And if they explain to you what what is missing

there, it's it's pretty it feels pretty simple. Um so the challenge is always finding those simple things without getting crushed by this perceived complexity. And so they are very good at doing this. And finally they have what I what I also call a stubborn perseverance. We often have to argue with the security researchers and the projects and mediate between them and security researchers are very stubborn but a lot of times they are right. Um and basically they leave no stone left unturned and if they feel that something they they end up having this instinct.

So they if they feel that something is is weird or weak they will explore a multitude of paths for exploitation until a successful solution. And that's another difference with devs for example where um they often seem to not be constrained in time these hackers that hunt in live protocols. So you will see some of these elites, they they find amazing bugs, but then they might be months just deep into a given protocol. So anyway, wrapping up, if you care about privacy or a protocol cares about privacy, their users, their users money, they need to care about security. and the

very last line of defense. That means uh leveraging the security community and they need it because we've seen we've seen we we've established before security is common sense. Thank you very much. >> Thank you very much. That was very very insightful. Um.