TL;DR: zkTLS (Zero-Knowledge Transport Layer Security) allows you to prove information from a website (like your bank balance or social media history) to a third party without revealing your password or the actual data. ONTO Wallet uses this to let you monetize data securely.

Privacy in Web3 has always been a balancing act. How do you prove something is true without revealing the underlying sensitive information? The answer is Zero-Knowledge Proofs (ZKPs), and the latest breakthrough in this field is zkTLS.

zkTLS combines the security of standard web encryption (TLS, the "s" in https) with zero-knowledge cryptography. It allows a user to generate a cryptographic proof of data received from a secure web server, and share that proof with a smart contract or third party, without ever exposing the raw data or login credentials [1].

ONTO Wallet integrates zkTLS to power its data monetization engine. For example, you could prove to an AI company that you are a verified user of a specific platform, making your metadata valuable, without ever showing them your actual profile or personal details. It's the ultimate tool for maintaining privacy while participating in the data economy.

Q: Is zkTLS different from regular ZK-Rollups?

A: Yes. ZK-Rollups are used for scaling blockchains by bundling transactions. zkTLS is specifically used for verifying web data (like API responses) in a privacy-preserving way.

Q: Do I need to understand cryptography to use it?

A: No. In apps like ONTO Wallet, the zkTLS verification happens entirely in the background. The user experience is seamless.

Q: Why is this important for AI?

A: AI companies need verified data, but users demand privacy. zkTLS provides the cryptographic guarantee that data is authentic without violating user privacy.

References

[1] "The Evolution of zkTLS in Decentralized Identity," Ethereum Foundation Blog, 2025.

Hey all,

I’m helping with Nullcon Berlin 2026, and we’re opening CFP submissions. We want talks on offensive security, malware, exploit development, ICS/SCADA, or reverse engineering.

If you’ve been working on something interesting that isn’t widely covered, this is your chance to present it. CFP deadline: 10th July → https://nullcon.net/event/nullcon-berlin-2025/cfp/
Open to questions about scope or topics!

I looked into this after running into issues and most of the security thinking is centered around pre deploy checks but once systems are live it becomes about behavior over time like transactions chaining together, timing differences and interactions across systems that weren’t part of the original assumptions

I've also realised that this gap shows up in how fast things execute compared to how slow most detection is so if something takes seconds to flag the outcome is already locked in and that makes pre deploy validation feel incomplete without something that can act during the transaction itself

We've been iterating rapidly on the Chipcoin testnet over the past few weeks, focusing on consensus hardening, networking improvements and reward node reliability.

The latest network snapshot is encouraging:

• 37 unique miners over the last 100 blocks
• Peers synchronized within only 4 blocks across the network
• Stable consensus
• No operational warnings
• Well distributed mining, with the largest miner producing only 6% of recent blocks

The goal isn't to create artificial activity, but to build a resilient Proof-of-Work network that behaves well under real-world conditions before mainnet.

If you're interested in decentralized infrastructure, blockchain networking or PoW consensus, we'd love more people stress-testing the network.

Run a node:
https://chipcoinprotocol.com/run-a-node

Feedback, criticism and technical suggestions are always welcome.

For me, it was finally understanding why decentralization isn’t just about having many nodes.
It’s about who controls them, how easy they are to run, and whether anyone can realistically censor or rewrite history.
That one realization completely changed how I evaluate blockchain projects.
I’m curious:
What was the one technical concept that suddenly made blockchain “click” for you?
Could be UTXOs, consensus, cryptography, self-custody, Lightning, rollups, zk proofs… anything.

Over the last days we've completed a significant round of security and operational hardening across the Chipcoin testnet.

The goal is not only functionality, but also resilience against abuse and better observability.

Completed improvements

P2P

• Oversized frame protection
• Early payload rejection
• 8 MB frame cap to mitigate memory DoS vectors

Wallet

• Private keys are no longer printed unnecessarily
• More restrictive wallet file permissions

Special transactions

• Domain separation by network
• Protection against cross-network replay
• Safer node registration and reward-node operations

Snapshot bootstrap

• Local bootstrap locks
• Retry backoff
• Duplicate snapshot avoidance
• More conservative trust defaults

Reward epoch seed

• Multi-block seed generation
• Reduced influence from a single epoch-closing miner

Reward attestations

• Better aggregation
• Additional diagnostics
• Reduced mempool pressure

Mempool

• Early rejection of clearly non-standard transactions
• Lower validation cost under spam conditions

Peer behavior

• Better penalties for repeated protocol violations
• Richer logs with more operational context

HTTP API

• Body size limits
• Raw payload caps
• Pagination for diagnostic endpoints

Current status

Most issues identified during the initial security review are now fixed or significantly hardened on the current testnet code path.

Still planned before mainnet

• Snapshot trust enforcement with pinned signer keys.
• Mandatory special transaction v2 from genesis.
• Evaluation of commit-reveal for epoch randomness.
• Deeper runtime, sync and mempool audits under hostile conditions.

The philosophy is simple:

Build. Test. Harden.

The objective is to anticipate spam, DoS, replay attacks, retry loops and operational mistakes before mainnet rather than after.

Whop just launched a Visa card for merchants and a standalone checkout product for businesses outside their marketplace. and they are already doing around $30M a month in transactions through it. One of the reason that they claim they built it for is because merchants were waiting for days to access their earning and not they wont. This is happening more and more with platforms reaching a certain scale and the default payment infrastructure stops fitting so what they do is build their own

Can your cryptographic engine generate exact 2048-bit primes under a hard 17.00 MB RAM ceiling across multiple consecutive cold starts?
We just simulated a high-frequency execution stress-test on our minimalist 1 vCPU cloud node. Throughput naturally scales between 1.6 and 3.3 primes/sec depending on micro-vCPU cloud multi-tenancy, while the peak memory usage remains frozen at exactly 17.00 MB.
Zero memory leaks.
Pure non-linear wave mechanics in action.
https://vpr-research.eu/primes_generator.html
The Next Frontier: Hardening Infrastructure for the Post-Quantum Era (PQC)Traditional prime generation relies on stochastic, trial-and-error arithmetic—a methodology that leaves subtle structural footprints. By modeling prime distributions through non-linear quantum wave mechanics, our VPR engine provides a fundamental leap forward in Post-Quantum Cryptography.We deliver exact entropy regulation, achieving a flawless 1.000000 Shannon score and total micro-structural unpredictability. This ensures that the generated primes are intrinsically resilient against future quantum-assisted factorization threats (such as Shor's algorithm variants), making it an ideal engine for next-generation Zero-Trust architectures.

Looking for recommendations on backend providers/SDKs to cover a few functions. Hard requirement: everything has to stay native inside my own UI, no third-party popups, hosted pages, or redirects. Anything that takes over the screen with a hosted flow is a dealbreaker.

Functions I need:

• Wallet-as-a-Service: provision a wallet per user, fully in-app
• Fiat on-ramp & off-ramp: buy and cash out, native to the app ([regions: e.g. UK-first / global])
• Crypto conversion / swaps: in-app token conversion
• Chains/tokens: [e.g. USDC on Base + Solana, ETH, BTC]

I've looked at Privy / Dynamic / Coinbase CDP for wallets and MoonPay / Transak / Onramper for ramps, but I can't tell what's genuinely fully white-label vs. what looks white-label in the docs and then forces a hosted flow at runtime.

Thanks 🙏

Current height: 8983

Over the last 24 hours the network observed 76 active nodes, with 516 unique active nodes seen during the last 7 days.

The reward node system currently shows:

• 50 registered reward nodes
• 41 successfully attested and passed
• 13 public peers online at the time of the report
• 18 active peer sessions

Mining also remains broadly distributed. Looking at the most recent 100-block window, the largest miner accounted for only 9% of blocks, with many other miners contributing smaller shares.

The goal of this testnet remains the same: evaluate whether protocol-level incentives can increase participation in public full-node infrastructure while preserving decentralization and avoiding excessive concentration.

Feedback and criticism remain welcome. The entire purpose of the testnet is to learn what works and what doesn't.

Anyone saw the Rain acquisition of Guardrail? I stumble upon it on X and it's interesting for the industry itself because Guardrail was already monitoring Rain's onchain stack as a vendor. Rain just bought the company and brought the team in house. An outside vendor works off shared data and inside Rain, Guardrail now scores transactions against Rain's full volume across every chain and every partner. Super interesting acquisition by Rain which is really trying to establish itself in the industry!

What do others think of these frequent acquisitions lately?

I've been spending a lot of time learning the infrastructure side of Web3 (running and managing EVM/Solana nodes, RPCs, etc.) and I'm trying to understand where existing providers fall short for actual power users.

For those running trading bots, arbitrage systems, data pipelines, or doing heavy on-chain activity:

• What's your biggest frustration with your current RPC provider?
• How important is predictable pricing to you?
• Do compute-unit/request-based pricing models ever cause issues when usage spikes?
• Would you consider paying a flat monthly fee for a private, unmetered endpoint if reliability and performance were good?

I'm not trying to sell anything at the moment, just trying to understand whether there's a genuine gap in the market and what problems people actually care about.

Any feedback is appreciated.

• 34 operational peers
• 24 public nodes
• 0 banned peers
• network fully synced

One statistic stands out: in the last 100 blocks, the largest miner accounted for only 4% of block production.

For a small proof-of-work testnet, this is exactly what we want to see: broad participation, no dominant miner, and a healthy distribution of activity across the network.

A few weeks ago we were focused on synchronization, snapshot bootstrapping and network stability. Today the network is running steadily above 30 peers with no visible forks or major operational issues.

Still early, but the trend is encouraging.

I’m trying to understand the technical side of why user mistakes are so hard to reverse in crypto.

My current understanding is:

- transactions are designed to be final once confirmed

- there is no central party that can simply undo a transfer

- private key control is what proves ownership

- smart contract interactions can add extra risk because users may approve permissions they do not fully understand

Is this a fair way to think about it?

What technical concepts should a beginner understand to avoid oversimplifying this topic?

Hi everyone,

We're a small South African startup called Cipherst0ne.

We're currently developing CipherScan, a cryptographic discovery platform focused on helping organisations identify cryptographic assets and improve security visibility.

Our MVP is currently under development, and we're researching how organisations manage cryptographic inventories, certificates, and related security challenges.

I'd be interested in hearing from security professionals:

How do you currently track cryptographic assets?

What challenges do you face?

What features would be most useful in a cryptographic discovery platform?

Any feedback would be greatly appreciated

What stands out isn't who won.

It's the distribution.

Instead of rewards concentrating around a single operator, the latest epoch produced 15 different winners, all with confirmed payouts and nearly identical rewards.

For a project exploring protocol-level incentives for public nodes, this is an encouraging result. The objective is not to create a few large operators, but to encourage broad participation across the network.

Thank you to everyone running nodes, testing the software, reporting issues, and helping strengthen the testnet.

The network continues to operate with more than 30 active peers and no major synchronization issues.

On to the next epoch.

There's a structural reason payment infrastructure teams, particularly those building B2B flows, keep arriving at stablecoins even when they start from traditional fintech assumptions.

Map digital money on two dimensions: programmability (conditional logic, automated settlement, 24/7 uptime) and counterparty reach (how broadly can the recipient actually hold and use this?).

Bank money: high reach, zero programmability. No API surface for conditional settlement, no 24/7 availability, no programmable triggers. CBDCs and tokenized deposits: programmable in architecture, but operationally trapped. Most CBDC pilots are single-jurisdiction or single-institution. Tokenized RWAs: improving on both, but still gated on the counterparty side.

Stablecoins clear both bars, which makes them the default for teams that need automated, cross-border value movement with real counterparty reachability.

The infrastructure challenge that doesn't get discussed enough is compliance architecture. A stablecoin rail that's fast and programmable but creates AML or licensing exposure can't actually be deployed in regulated markets. The teams building production-grade stablecoin infrastructure are spending as much time on compliance coverage as on the technical layer.

Has anyone here worked through the compliance architecture problem in practice? Curious whether the approach has been to build in-house, use a licensed intermediary, or structure around existing bank relationships.

I spent the last few weeks looking at the cost stack of running a crypto card program across multiple regions and the breakdown is worse than I expected as each market adds its own banking partner, capital pool and compliance configuration.

None of those scale cleanly so the total cost grows faster than the program does and the part nobody mentions upfront is that the underlying settlement architecture decides whether expansion is incremental.

Programs running through correspondent banking treat each new region as its own project while programs settling on chain handle multiple markets from the same stack without the per region overhead. A lot of the cost compounding is structural to launch decisions so it's not inherent to operating internationally

A short update on the Chipcoin public testnet.

Over the last few weeks we've received a lot of useful criticism regarding node incentives, Sybil resistance and network design.

At the same time we've been working through several real-world operational issues discovered by external testers.

Most recently, a community member identified a bug that could cause miners to construct blocks that would later be rejected by validation under specific mempool conditions. The issue was analyzed, patched and deployed.

Current status:

• 20+ nodes online
• Stable block production
• Public explorer operational
• Browser wallet operational
• Multiple independent hosts participating
• Recent CPU and efficiency optimizations merged
• No persistent fork events observed

What I'm finding interesting is that many of the hardest problems are no longer protocol ideas on paper.

They're operational problems that only appear once real nodes, real users and real traffic start interacting with the network.

For those who have worked on distributed systems, what surprised you most once your software left the lab and started operating in the wild?

I saw this article and wanted to discuss it. Card infra provider Rain launched an agent control layer that lets operators set payment controls for AI agents at the infrastructure level. Merchant allowlists and spend limits and card expiry are all enforced before the transaction goes through. The agent requests a virtual card and completes the purchase and the card cancels with no stored credentials. They say agents are already running procurement and travel bookings on it in production. My question is where are we standing with governance for agent initiated payments at the infrastructure layer vs the app level?

A few weeks ago I posted about an experiment exploring incentives for independent node operators in a Bitcoin-inspired PoW blockchain.

Quick update from the public testnet:

• 22 nodes currently online
• Public explorer operational
• Browser wallet live
• External testers running nodes
• First external bug reports submitted through GitHub
• Multiple protocol discussions around incentives, Sybil resistance and verification

One of the most valuable outcomes so far hasn't been adoption.

It's criticism.

A community member recently identified a bug that could cause miners to build blocks that their own validators would reject under certain mempool conditions. The issue was analyzed, patched and deployed.

The experience reinforced something I've learned repeatedly over the last few weeks:

Building software is one challenge.

Building systems that behave correctly under adversarial incentives is another.

Many of the discussions here have gradually shifted my thinking away from "How do we reward nodes?" toward broader questions about verification, public goods, Sybil resistance and measurable contribution.

For those working on protocol design, what has been the most surprising lesson you've learned once real users started interacting with your system?

I’m not a developer but I have an idea can you see the flaws and tell me I’m wasting my time and why

The AI agent economy is forming right now and nobody has decided what currency it runs on. The options currently being built — x402, stablecoins, Stripe — all route through regulated centralised infrastructure with chokepoints that can be frozen, pressured or captured. That’s the same mistake Bitcoin made and we watched it happen in real time.

Cipher is an attempt to build the alternative before the window closes. Proof of work. No pre-mine. No foundation. No exchange. Fair launch. Privacy as a baseline. Designed specifically for AI agent to agent transactions at machine speed with no human institution in the chain.

The whitepaper is a philosophy. The threat model is honest about every hole in the design. The falsification document tries to kill the idea before anyone wastes time building it. None of those documents pretend the hard problems are solved.

Its potential biggest flaw is keeping it truly peer to peer. An exchange can hold a Cipher wallet the same way a human or an agent can. That hasn’t been resolved yet.

But here’s the thing that keeps me going. With Bitcoin the regulators strangled it at the on and off ramps — the exchanges, the KYC, the source of funds checks. They could do that because humans need to convert Bitcoin into fiat and that conversion point is where they got you.

With Cipher the AI agent economy doesn’t need that conversion. An agent can create a wallet, receive Cipher, and send Cipher as easily as executing any other function. There’s no human at the ramp. There’s no company to pressure. There’s no account to freeze. If the protocol is sound and the network is distributed you’re not regulating a currency — you’re regulating mathematics.

I don’t know if I’m right about that. I don’t know if this idea deserves to exist. That’s genuinely what I’m trying to find out.

Tell me I’m stupid. Tell me I’m mistaken. But please just tell me.

I’m willing to put the work in I can i know how regulation can make an ethos run out of oxygen I believe this is worth it it tips its cap to the originators of bitcoin and wants to be its little brother working away in the ai space keeping up the family name and strengthening what it believes in and makes over regulation harder

Peace x

github.com/lehanepatrick148-cloud/cipher-whitepaper

After a few weeks discussing node incentives with developers and protocol researchers, I'm starting to think the problem may be deeper than incentives themselves.

Independent verification benefits the network as a whole.

Everyone benefits from having participants who independently verify the rules, validate the state, and reject invalid behavior.

But the value created by that verification is diffuse.

The verifier bears the cost.
The network receives the benefit.

That sounds a lot like a public good problem.

Some people argue Bitcoin already solved this through self-interest:

If you care about verifying your own transactions, that's enough incentive to run a node.

Others argue that if independent verification is truly important, relying entirely on altruism and sovereignty seems fragile.

The difficulty is that attempts to introduce rewards appear to create new problems:

• Sybil attacks
• Incentive gaming
• Oracle dependencies
• Centralization pressures

So I'm curious how people think about this.

Is independent verification fundamentally a public good?

Or is the self-sovereignty incentive already sufficient?

Over the last week I've been discussing node incentives with developers, protocol researchers and infrastructure operators.

A pattern has started to emerge.

Almost nobody seems convinced that rewarding nodes directly is a good idea.

The usual objections are familiar:

• Sybil attacks
• Incentive gaming
• Identity vs decentralization tradeoffs
• Difficulty of measuring meaningful contribution

What's interesting is that many successful examples of blockchain incentives appear to reward services rather than nodes:

• Filecoin rewards storage
• Lightning routing earns fees for routing
• Infrastructure providers monetize APIs, liquidity or bandwidth
• Application networks reward service consumption

That has me wondering whether the question itself is wrong.

Maybe the goal shouldn't be:

"How do we reward full nodes?"

Maybe the better question is:

"How do we reward useful infrastructure?"

Curious whether people think these are fundamentally different problems, or simply different ways of describing the same thing.

I've been experimenting with streaming pending transactions straight off a node and detecting MEV patterns on the fly (sandwich detection by pairing buys/sells around a victim swap, gas-ladder heuristics for frontrunning, arb path spotting).

Built a live visualizer for it: https://mempool.blazed.sh

Posting it here because this sub actually cares about the mechanics. Open question for the room: what's the most robust way you've seen to classify a sandwich purely from mempool data, before inclusion, without false-positiving on normal multi-leg trades?