Monad co-founder Keone Hon has urged crypto teams to make security their top priority, sharing operational-security guidance and promoting the foundation’s open-source Ultrafuzz tool as attackers gain access to more capable AI.
Summary
- Hon has encouraged developers to run Ultrafuzz on their contracts and strengthen operational security.
- Monad’s OpSec guide covers phishing, credential management, employee devices, and third-party account permissions.
- Ultrafuzz was open-sourced in September, before Hon’s latest appeal for teams to use it.
- The guide’s cited control-hijacking losses include leaked keys and supply-chain attacks alongside social engineering.
Monad Foundation’s resources cover both the software teams deploy and the accounts, devices, and signing arrangements used to manage it. In his posts, Hon directed readers to the Crypto OpSec Bible, guidance on administrator accounts, and research on finding vulnerabilities with AI.
“In this age of AI-empowered attackers, the only way forward for our industry is to continue hardening,” he wrote. “Security should be every team’s top focus.”
Monad’s OpSec guide targets everyday security failures
Written by Omar, the Crypto OpSec Bible opens with frustration over recurring compromises involving unfamiliar code, phishing, exposed credentials, and poor device management.
The guide cites ChainLight’s Lumos tracker, which recorded $3.31 billion in exploited value from control hijacking, compared with $983 million from smart-contract vulnerabilities, across incidents tracked from January 2023 to the guide’s reporting cutoff.
Its control-hijacking category includes social engineering, private-key leakage, unauthorized access, supply-chain attacks, and other conventional security failures. The comparison covers the tracker’s recorded incidents and is presented as a historical snapshot.
Omar argues that crypto organizations have given insufficient attention to operational security. His recommendations include separating personal activity from work devices, maintaining a clean computer or browser for crypto activity, and checking transaction details before signing.
For critical accounts, the guide recommends hardware security keys with a securely stored backup, unique passwords, and keeping authentication codes separate from passwords. Organizations are advised to maintain endpoint protection and establish a clear contact for reporting security incidents.
Hon urges developers to review administrator access
For smart-contract developers, Hon highlighted guidance against relying on externally owned accounts for administrator roles and called attention to using a dedicated laptop when signing administrative functions.
His resource list includes work on formal verification and threat hunting with large language models. In a separate post, he encouraged developers to run Ultrafuzz on their contracts, crediting Antonio Viggiano’s experience and inviting feedback.
“Smart contract developers, please run Ultrafuzz on your contracts!! It’s open source and available to anyone,” Hon wrote.
The tool’s open-source announcement was published on Sept. 10. Hon’s latest posts renew attention to an existing release, alongside the foundation’s operational-security resources.
Ultrafuzz combines AI investigation with contract testing
Available through a public GitHub repository, Ultrafuzz coordinates specialized AI agents to examine contracts, map user behavior, investigate security properties, run testing strategies, and prepare findings for review.
Monad says more than 20 runs on ecosystem projects helped shape the release, which supports Solidity and Vyper.
In his technical walkthrough, Viggiano described developing the tool while helping a team prepare for an external security review. The project lacked fuzz tests, prompting work on an AI-assisted workflow to create them.
His explanation describes agents identifying conditions a protocol should preserve, then investigating whether particular actions or sequences break them. Findings are combined, checked, and organized into a report.
Monad instructs users to run Ultrafuzz on disposable, isolated virtual machines. Its agents operate with unrestricted permissions, and the announcement warns against running it on developer workstations or machines holding valuable credentials.
Recent breaches expose accounts and software dependencies
Earlier incidents have involved several of the access points covered by the guide.
On Oct. 26, crypto.news reported that wallet maker Foundation had suffered a Cloudflare API key compromise that enabled fraudulent emails appearing to come from its official domains. The company revoked the credentials and said Passport hardware and stored funds remained secure.
A July incident involved a compromised Injective developer package. Security firm Socket said malicious code intercepted wallet-generation functions and transmitted private keys and recovery phrases through fake telemetry. Injective CEO Eric Chen said the affected releases had been deprecated and the issue fixed.
Another July investigation concerned OkoBot’s wallet-stealing malware, distributed through GitHub repositories disguised as legitimate software. The campaign used fake error messages and repair instructions to persuade victims to execute malicious commands. Its modules included fraudulent wallet-recovery screens, keyboard monitoring, and clipboard surveillance.
