The $100k exploit, the attacker who tuned in, and six hours to recovery
Anas Khader, co-founder of Flash Trade, joins Pirates Parley hours after one of the more instructive exploits Solana DeFi has seen -- a forged buffer account in the Magic Blocks ephemeral rollup SDK that exposed $100k in user deposits. Zoheb Shahzan, co-founder and the engineer who handled the response, joins mid-episode to walk through the root cause, the five-minute noop deployment, and how fund isolation kept the pool TVL untouched. Anas has been in crypto for 11 years, started at BitMEX, and moved to Solana via SBF's Serum threads. Flash Trade was the first DeFi exchange to integrate with Magic Blocks' ephemeral rollup, which drops execution latency to ~50ms by removing consensus overhead. The exploit was a direct consequence of that novel architecture -- and so was the recovery. They cover:
What Flash Trade is and why 500x leverage is mostly a stress-test Why Solana was the only chain capable of serving a full order book What scheduler wars and oracle skipping look like from the exchange side (5--10 second pricing delays at peak) How the ephemeral rollup works: finality and trust from Solana, unlimited speed on a dedicated SVM The full exploit RCA: a forged buffer account passed as the canonical PDA on undelegation How fund isolation (no co-mingling, isolated collateral token accounts) limited exposure to user deposits only The noop instruction -- why every upgradeable DeFi programme should have one -- and how it was deployed in five minutes via Triton's RPC and transaction sending service How the attacker attended Flash Trade's own Monday livestream and extracted the exact withdrawal cap Why the team had an alert and a response within a minute of the withdrawal hitting AI as a defensive tool -- the frontier models that built the monitoring bots that caught it Tracking the funds: Monero → ChangeNow → Mayan Finance bridge → Ethereum, address flagged across all CEXes Percolator (Armani Ferrante) and CERN (Asymmetric Research) as recommended reading on risk engine design The $1.3M NFT raise, how all revenue was returned to holders, and the FAF token's 50% rev share flywheel What's next: 24/7 markets and a UX where users don't know they're onchain
00:00 - Anas Khader and Flash Trade00:53 - What is Flash Trade? The 500x leverage question03:04 - From BitMEX to Solana: how Serum and SBF threads changed everything08:29 - Why perpetuals exist (futures were invented for farmers)10:35 - Solana was the only blockchain that could serve a full order book12:35 - The move to Magic Blocks: what the ephemeral rollup actually does16:26 - Scheduler wars and oracle delays: 5--10 seconds of pricing lag at peak21:03 - Triton dedicated channel and building rapport in a trustless world22:07 - The elephant in the room: what happened yesterday?22:37 - Xoheb joins to explain the technical root cause25:43 - The buffer account PDA vulnerability: how the exploit worked32:07 - $100k withdrawn, PagerDuty fires, team on desks in under a minute33:21 - Noop deployed in five minutes via Triton RPC; Triton transaction sending lands it in seconds35:20 - Malicious state reconciled; limited trading reopens36:01 - Trading fully live again within six to seven hours36:50 - The attacker attended Flash Trade's Monday livestream and knew the exact cap38:13 - Comms were spontaneous; AI-built bots caught it in under a minute39:21 - AI levels the field: it's not just for hackers43:05 - Seal Team 911 and tracking the funds: Monero → ChangeNow → Mayan → Ethereum43:56 - Percolator and CERN: the risk engine reading list49:23 - Team size: about 10 people50:32 - Bootstrapped vs funded: why being on your toes drives output53:24 - The $1.3M NFT raise, revenue returned to holders, and the FAF token58:34 - What's next: 24/7 markets and invisible onchain UX1:02:19 - Outro and next week's guest
The $100k exploit, the attacker who tuned in, and six hours to recovery
Coffee on Solana: from a $20 mint to the Miami Heat | Pirates Parley E24
Sharded order books, and a $150K raise that filled in 5 seconds | Pirates Parley E26
More from Pirates Parley
Solana's Events Sensei Ellie: 24 Hacker Houses, a Bomb Threat, and Breakpoint London
Ellie spent 20 years producing events at weddings, Electronic Arts and Netflix before joining Solana in January 2022 with no roadmap and a mandate to build hacker houses. Her first year: 24 hacker houses in 18 countries in 10 months, plus a bomb threat in Miami. We get into how Breakpoint went from four venues scattered across Lisbon to one roof in London. Why there’s deodorant in the bathrooms and no pay-to-speak slots. What she’s building at Olympia: one main stage, a proper pub, and a Solana Borough Market. Plus the full side-event calendar, how not to waste your Breakpoint, and the first public word on where Breakpoint goes next: early September 2027. Also: Steve’s own origin story (it started with calling out scammers in the Breakpoint channel), a Porsche that should’ve been an Aston Martin, and nobody knowing what a Fuggler is. Breakpoint London: Nov 16–17 at Olympia (Day Zero Nov 15). Hacker House runs Nov 1–12. Ticket prices go up Nov 1. 0:00 Welcome — a Friday special with Solana's events sensei1:15 Steve's origin story: scam-busting the Breakpoint channel, quitting after Berlin3:10 20 years in events: weddings, EA, Simlish, and Netflix8:00 From COVID to crypto: the cold intro that landed her at Solana12:10 24 hacker houses, 18 countries, 10 months, planning from a closet14:39 The F1-style world tour: a bomb threat at 7,000-person Solana Miami16:45 Lisbon → Amsterdam → Singapore → Abu Dhabi: why Breakpoint went under one roof24:11 Breakpoint London: one stage, a proper pub, and Solana Borough Market29:09 What gives Breakpoint a soul: deodorant, water, and no pay-to-speak33:42 Business in the front, party in the back: designing for every persona38:40 No hierarchy: walking up to Solflare's CEO, and first-timer advice42:17 The side-event calendar: Hacker House, Demo Day, AI Day and more45:31 Too many side events, liver credit, a Porsche, merch and tickets51:02 Can you 10x every year? Diamond horses and Breakpoint 2027 in September54:58 Audience Qs: artists, Fugglers, the generator story, and goodbye
Who's Selling Your Swaps? Benjamin Boulin on Order Flow, MEV, and Getting Paid Back
Benjamin Boulin was running Minecraft servers at 11 and paying developers in Bitcoin by 2015. Today he's the founder of Circular, built after his arb team hit 30 million transactions a day and no tool on Solana could keep up. We get into how a simple swap leaks value to whoever controls the order flow, why platforms selling your swaps are earning double on you, and how Circular's monetization layer sends 65% of recovered arb profit straight back to the trader's wallet. Ben breaks down where a landing tip actually goes (Jito, Harmonic, SWQoS, direct to the leader), why every launchpad ends up building its own AMM, and why "we don't do MEV" is not the user protection it sounds like. Also: Counter-Strike skins lost to casinos, Valve's total control over your inventory, and what happens the day GTA 6 puts its cars on-chain. Fast transaction landing: landfast.io Circular: circular.fi 0:00 Welcome — one of my best friends in the ecosystem 1:40 Entrepreneur at 11: Minecraft servers, PayPal bans, and a broken financial system 7:07 A dev demanded Bitcoin in 2015 — and Ben didn't get it until Ethereum 12:00 Nifting: Steam meets Twitter for NFT skins 15:08 Who owns your skins? Valve's power and the GTA 6 on-chain test 21:45 Stablecoin arb on four chains — and the no-approval swap that sold him on Solana 27:30 Selling your swaps: why Triton won't, and the extortion nobody talks about 29:45 30M transactions a day: building Circular to track themselves 33:24 How your swap leaks value: AMMs, order flow, and the arb you never see 36:45 The monetization layer: what you're losing and how much comes back 44:28 Why every launchpad builds its own AMM 46:23 Integrating Fast: 1-cent tips, where they go, and 65% cashback 52:16 Colosseum builders: casino cranks, traders, and where to get RPC 56:33 Hidden fees and ignored priority fees: why validators should be angry 1:00:31 Counter-Strike, Trackmania, Risk — and next up: Ellie on Breakpoint
$250K in Hidden Fees: How Imperial Built a 1bp Perp DEX on Solana
Imperial started as a Jupiter Perps wrapper that just told you what you were actually paying. Jordan Prince built it after finding he'd paid a quarter of a million dollars in fees, part of it in swap charges the front end never reported. Now he and Hunter run Armada: a prop-AMM perp venue native to Solana with 1 basis point taker fees and books up to 20x deeper than the competition. We get into Jordan and Bartosz's early Solana Labs days (Metaplex, Candy Machine, the first hacker house in a Lisbon horse stable), Hunter's road from a DC lobbyist family to Teleport, the four perp ideas that flopped first, and why a failed MagicBlock L2 experiment pushed them to hedged, delta-neutral liquidity. Plus why traders stay loyal to more expensive venues: perp DEXs behave more like NFT collections than markets. Also: closing a $1.5M round from Foundation Capital a week before bankruptcy, and the no-paperwork $25K wire from Brian Long that bought them two more weeks. Trade at imperial.space. Armada needs an access code, so start in their Discord. Follow-ups and codes: t.me/piratesparley 0:00 Welcome — Imperial isn't just an aggregator anymore 2:11 Citadel hell to Solana Labs: Jordan, Bartosz and the first DeFi commits 4:00 The first hacker house, built overnight in a billionaire's horse stable 9:41 Hunter: lobbyist's kid, Ritz-Carlton basement, $15M for Teleport 17:13 Four failed perp ideas: BTC volatility perps and memes too dangerous to trade 20:14 $330K in trading profits and "Jupiter lies about fees" 24:54 People don't want choice, they want the perception of choice: routing explained 29:24 The MagicBlock L2 experiment that got their pool farmed 31:02 Armada: 1 basis point fees, and why 10x leverage turns 5 bps into 1% 34:06 Perp DEXs are NFT collections: why traders don't switch to cheaper venues 41:18 20x deeper books, hedged and delta neutral: how the prop AMM works 46:12 $1.5M from Foundation Capital, a week from bankruptcy, and Brian's $25K wire 54:25 "We are a premium RPC company": Helius vs Triton 57:39 How to get an Armada code, pre-IPO Anthropic perps, and gacha perp packs 1:02:01 Closers — Breakpoint, Telegram codes, and the Circular tease