A TRUST EXERCISE IN FOUR ACTS
Security is not a promise.
It is proof.
Step inside the failures that changed digital custody. Follow the evidence. Decide what should have been trusted.
DEMO WALLET ONLY · NO SIGNATURES · NO TRANSACTIONS
FIG. 00 / TRUST SURFACE
0x00 — 0xFF
HACKPROOFSECURITY RESEARCH TERMINAL
THE TRUST EXERCISE [ 00 — 04 ]
A guided investigation into the human, operational and technical failures behind crypto's most consequential security incidents.
01 / START HERE
The interface is a learning environment.
Every case has a source trail.
INTERACTIVE BRIEFING / 01
Pick a layer. See how a trusted step can become the weakest link.
CASE / BYBIT · SIGNING INTERFACE
Investigators reported that a compromised signing interface misrepresented a transaction to signers. A valid signature did not mean the operation shown was the operation executed.
CASE STUDY / 2025
CASE 17 / BYBIT
A compromised signing interface reportedly showed authorized signers a misleading view of a transaction. The keys worked as designed; the trust boundary around them did not.
CASE FILES / 2011—2026
Each record separates what happened, what failed, and what the evidence can—and cannot—support.
LOSS ESTIMATES ARE APPROXIMATE. AFFECTED VALUE, STOLEN FUNDS AND PERMANENT LOSSES ARE NOT INTERCHANGEABLE.
SIMULATOR / TRUST BOUNDARY
A fictional signing-room exercise. Nothing is deployed, broadcast, or connected to a chain.
THE ROOM
Three signers are asked to approve a routine treasury transfer. Two verify the recipient on a shared web screen. The third sees a different contract address on an independent device. The amount is within the normal daily limit.
Connect the demo wallet to enter the exercise.
AUDITOR / SOURCE-TEXT MARKER
A tiny browser-side marker demo—not Slither, not a smart-contract audit, and not a safety verdict.
MATCHES ARE REVIEW PROMPTS, NOT CONFIRMED VULNERABILITIES. NO MATCHES DO NOT MEAN A CONTRACT IS SAFE. THIS DEMO HAS NO SOLIDITY PARSER, COMPILER, OR SLITHER INTEGRATION.
Connect the demo wallet to enter the local lab.
PROOFS / SHA-256
Calculate a SHA-256 digest locally to compare artifacts. A hash proves equality of bytes—not authorship, safety, or audit quality.
—DO NOT PASTE KEYS, SEED PHRASES, OR CONFIDENTIAL SOURCE. CONTENT IS NOT UPLOADED OR SAVED BY THIS PAGE.
Connect the demo wallet to enter the proof tool.
FIELD NOTES / HOW TO READ THIS TERMINAL
This project is an educational prototype. These notes mark the line between what works here and what would require a real service.
Incident summaries are editorial and figures are approximate. Reported loss, exposed value, frozen assets and eventual recovery are distinct. Follow each linked source and its caveats.
No browser wallet provider is queried. The demo creates a clearly labelled temporary session in this tab; it does not read balances, ask for signatures, or send transactions.
The local lab searches source text for a few literal patterns. It has no Solidity parser, Slither, compiler, RPC, backend, sandbox, or complete vulnerability coverage.
The source marker and digest tools run in the current browser tab. This static prototype has no analytics or network scanner. A browser page cannot promise complete privacy from the host environment.
HPRF access and Robinhood Chain are not configured. The demo session is not a real token balance check or proof of ownership. No token address, partnership, or live monitoring is claimed.
A clean scan, a valid hash, a returned asset or a signed transaction cannot establish that a system is secure. Independent verification and context still matter.
SOURCE TRAIL / SELECTED REFERENCES
2026 INCIDENT REFERENCES IN THE USER-PROVIDED RESEARCH BRIEF HAVE NOT BEEN INDEPENDENTLY VERIFIED IN THIS PROTOTYPE.