DeFi Security Summit 2026
DeFi Security Summit returns for its fifth edition in Mumbai, bringing together security researchers, auditors, protocol builders and the wider DeFi community.
November 1–2, 2026 · 10:00am–6:00pm IST each day Courtyard by Marriott Mumbai International Airport CTS 215, Andheri–Kurla Road, opposite Carnival Cinemas, Andheri East, Mumbai, Maharashtra 400093, India.
Tickets Standard admission: US$50 for the two-day summit. Students: use code DSSSTUDENT at checkout for US$10 admission.
This registration covers the November 1–2 summit at Marriott. DSS continues on November 3 at Devcon as a CLS; participation in that programme is separate from this registration.
Confirmed speakers and programme details will be announced here.
Website: https://defisecuritysummit.org
Programme - all times IST (Asia/Kolkata, UTC+05:30)
Each day: 08:30 gates open and registration; 09:00 coffee; 09:30 welcome and announcements. Talks begin at 10:00.
Short-talk times below are shared 30-minute session windows, not individual start times. Other talk durations are shown by their exact start and end times. Schedule subject to change.
Day 1 - Sunday, 1 November - Amber
10:00-10:30 - Keynote Talk (30 minutes)
Peter Kacherginsky - The State of DeFi Security - 2026
10:30-11:00 - Keynote Talk (30 minutes)
Joaquin Pereyra - Ill Bloom: Finding and Responding to a Wallet-Generation Flaw That Exposed Millions
11:00-11:15 - Break
11:15-11:45 - Keynote Talk (30 minutes)
Jonathan Mevs - AI-FV: Slop or Prop? Explorations in Agentic Formal Verification
11:45-12:15 - Keynote Talk (30 minutes)
Pablo Sabbatella - 2FA won't save you: dead TOTP and stolen sessions
12:15-12:30 - Break
12:30-13:00 - Keynote Talk (30 minutes)
Samyak Jain - Security beyond the audit: how Fluid ships changes safely
13:00-13:30 - Short Talks Session 1 (shared 30-minute session window)
Yuri Tkachenko - Audits Don't End at Publication
Jelle "0xFlint" Goethals - The Danger Hidden in the Fog: Nth-Degree Integrations and DeFi’s Hidden Trust Graph
Eugene Mamin - Evergreen: continuous AI-augmented security by Lido x Nethermind
Griff Green - Securing DeFi Together: Spend Less, Get Safer
13:30-14:30 - Lunch
14:30-15:00 - Short Talks Session 2 (shared 30-minute session window)
Sumanjeet - Security improvements and operational lessons from py-libp2p and Py-IPFS-lite
Anu Adeleke - Damn Vulnerable Daml
Sergey Khomutinin - The Audit That Never Ends: Evergreen Security in the Age of LLMs
0xa5df - Auditing Is Not Bug Hunting: Securing Systems Through Risk Management
15:00-15:15 - Long Talk (15 minutes)
Joe Dobson - Fueling Fraud Factories: Crypto Adoption In Southeast Asian Scam Centers
15:15-15:30 - Long Talk (15 minutes)
Julia Hardy - What the Block Explorer Misses: Using Unique Money Laundering Intel to Contain Active Exploits
15:30-15:45 - Break
15:45-16:00 - Long Talk (15 minutes)
Neville Grech - Symbolic Execution of Math-Heavy Code in the Age of AI
16:00-16:15 - Long Talk (15 minutes)
Christian Vari - Don’t Trust the First Model: A Methodology for Adversarial AI Audits
16:15-16:30 - Long Talk (15 minutes)
Manu Sheel Gupta - What a libp2p Gossipsub Crash Taught Us About AI Security and DeFi Infrastructure
16:30-16:45 - Long Talk (15 minutes)
Natalia Klaus - From Production Rust to Lean 4 Proofs: A Verification Pipeline with AI Provers
16:45-17:00 - Break
17:00-17:15 - Long Talk (15 minutes)
Kevin Lotz - Formal Verification of Stake Pools: From General Design to a Real-World Application
17:15-17:30 - Long Talk (15 minutes)
Lilian Cariou - Proving the Spoke: Formal Verification of Aave V4’s Hub-and-Spoke Architecture
17:30-17:45 - Long Talk (15 minutes)
Petar Calic - Formal Verification in the Age of AI: New Powers, New Traps
17:45-18:00 - Long Talk (15 minutes)
Gustavo Dutra - We Gave AI the Keys to Our CI — Then We Tried to Hack It
Day 1 - Sunday, 1 November - Pearl
10:00-10:15 - Long Talk (15 minutes)
Jeffrey Scholz - The Sumcheck Algorithm from First Principles
10:15-10:30 - Long Talk (15 minutes)
Rudra Pratap Singh - A Safe EIP-7702 Reference Implementation
10:30-10:45 - Long Talk (15 minutes)
Raj Kumar & Sabanaku77 - Web3 Security Monitoring System Internals: From Chain Data to Incident Response
10:45-11:00 - Long Talk (15 minutes)
Lothaire Aubergeon - The Big Smart Contract Security Quiz
11:00-11:15 - Break
11:15-11:30 - Long Talk (15 minutes)
Bernardo Codesido - Building a Crypto Security Team That Lasts: Lessons from Leading Rootstock's Security
11:30-11:45 - Long Talk (15 minutes)
Kirk Baird - Why Blockchain Security Has Failed: Single Points of Failure
11:45-12:00 - Long Talk (15 minutes)
Mohamad Mansouri - Can AI Audit Your Smart Contract? We Tested It on Real Audits.
12:00-12:15 - Long Talk (15 minutes)
George Kobakhidze - Certiflai: orchestrating swarms for certifications
12:15-12:30 - Break
12:30-12:45 - Long Talk (15 minutes)
Shebin John - Guarding the Guard: Engineering a Deny-by-Default Policy Engine for Safe
12:45-13:00 - Long Talk (15 minutes)
Nemveer - Beyond the EVM: What Auditing NEAR Taught Me About Ecosystem-Specific Security
13:00-13:30 - Short Talks Session 1 (shared 30-minute session window)
nisedo - Patch the Planet: Three Lessons for DeFi from AI Bug Hunting
Viraz Malhotra - The 0 to 1 guide to AI powered Auditing Methodology
Suryansh Singh - Benchmarking Security Intelligence: Why Web3 AI Security Eval Is Broken
Nicolas Garcia - Run Early, Disclose Late: When to Unleash Your AI Auditor
Jan Kalivoda - Out of scope, out of luck: the components audits keep ignoring
13:30-14:30 - Lunch
14:30-15:00 - Short Talks Session 2 (shared 30-minute session window)
Rudra Pratap Singh - Nobody Audits the Frontend
Anish Agrawal - What Mutation Testing Taught Me About Real-World Exploits
Dmytro Matviiv - Why Crowdsourced Security Is Dying (Code4rena, Hats Finance, and What Comes Next)
Lokesh Joshi - From Audits to Autonomous Defense: Building AI-Powered Security for DeFi
Josef Gattermayer - Fuzzing with Coding Agents: What Works in Practice
15:00-15:15 - Long Talk (15 minutes)
Abhimanyu Nag - How to Model Cryptoeconomic Attacks and Adversaries in DeFi
15:15-15:30 - Long Talk (15 minutes)
Josef Gattermayer - Benchmarking Frontier Models: Which One Is the Best EVM Auditor?
15:30-15:45 - Break
15:45-16:00 - Long Talk (15 minutes)
Elliot Friedman - Every Safe Is Blind to Its Own Backdoor: Scanning 2M+ Multisigs for Shadows
16:00-16:15 - Long Talk (15 minutes)
Benjamin Flores - Formal Verification in the Age of AI
16:15-16:30 - Long Talk (15 minutes)
Uri Kirstein - The Signer's Blind Spot: What Safe Decoders Don't Show You
16:30-16:45 - Long Talk (15 minutes)
Jeff Fei - SOAC: Zero-Trust Smart-Contract Permission Governance in Practice
16:45-17:00 - Break
17:00-17:15 - Long Talk (15 minutes)
Ivan Djordjevic - One Year Later: Surviving the SOC 2 Type 2 Observation Window in DeFi
17:15-17:30 - Long Talk (15 minutes)
Robert Reith - Why is AI missing these bugs?
17:30-17:45 - Long Talk (15 minutes)
Sofia Bobadilla & Martin Monperrus - Smart Contract Invariants Protect Against Cybercriminals
17:45-18:00 - Long Talk (15 minutes)
Yash Saraswat - Safe Staking: A Runtime Security Framework for LSTs
Day 2 - Monday, 2 November - Amber
10:00-10:30 - Keynote Talk (30 minutes)
Matthias Egli - Top hacks since Devcon 7 - what did we learn?
10:30-11:00 - Keynote Talk (30 minutes)
Nikita Belenkov - A Bug's Life: Why We Ran Our Own Audit Competition
11:00-11:15 - Break
11:15-11:45 - Keynote Talk (30 minutes)
Jochen Hoenicke - The Callback Window: How Formal Verification Prevented a Self-Liquidation Bug in Morpho Midnight
11:45-12:15 - Keynote Talk (30 minutes)
Josselin Feist - Security is a leadership problem
12:15-12:30 - Break
12:30-13:00 - Keynote Talk (30 minutes)
Magnus Woodgate - Valid Signatures, Fragile Accounts: PQC on Ethereum
13:00-13:30 - Short Talks Session 1 (shared 30-minute session window)
Michael Lewellen - Recovery Is the Attack
Jason W - Real-Time Threat Detection for DeFi with Stream Engines
Aarnav Bos - Effectively exploring and testing state space of consensus protocols
Tim Sigl - The Invariants Code Can’t Tell You: A Polymarket V2 Case Study
13:30-14:30 - Lunch
14:30-15:00 - Short Talks Session 2 (shared 30-minute session window)
Yannis Smaragdakis - Bytecode Back to Source: AI Reconstruction of Unverified Contracts
Kalp Shah - The Proof Lied: DeFi's Invisible Circuit Exploits
Paul Clemson - Follow the Collateral: A Mental Model for Auditing Polymarket V2
Magnus Woodgate - Stateful Minefields: Post-Quantum Signatures for Ethereum Accounts
15:00-15:15 - Long Talk (15 minutes)
Dima Kogan & Yaron Salman - Are MPC wallets ready for the post quantum age?
15:15-15:30 - Long Talk (15 minutes)
Kaan Uzdoğan - Clear Signing with ERC7730
15:30-15:45 - Break
15:45-16:00 - Long Talk (15 minutes)
Yannis Smaragdakis - Fund-Flow Modeling by Solving Large Linear Algebra Systems
16:00-16:15 - Long Talk (15 minutes)
Christopher von Hessert - Never Send a Human to Do a Machine's Job
16:15-16:30 - Long Talk (15 minutes)
Clément Moller - Removing the Staking Oracle: Beacon Chain Proofs in Production
16:30-16:45 - Long Talk (15 minutes)
Igor Gulamov - Auditing the Chain Itself: Pointing an AI at Consensus, Mempool, and P2P
16:45-17:00 - Break
17:00-17:15 - Long Talk (15 minutes)
Dhairya Sethi & Tomer Ganor - Every Division Picks a Winner: Rounding and Accounting Hazards in Lending Protocols
17:15-17:30 - Long Talk (15 minutes)
Hrishikesh Bhat - Beyond the Bounty: The Next Era of Crowdsourced Security
17:30-17:45 - Long Talk (15 minutes)
Jan Kalivoda - Your laptop is in scope too
17:45-18:15 - Special Keynote Talk (30 minutes)
Ioannis Sachinoglou - Glamsterdam Hard Fork: When Spent Gas Comes Back
Day 2 - Monday, 2 November - Pearl
10:00-10:15 - Long Talk (15 minutes)
Jacob Czepluch - What you need to know about Core Solidity
10:15-10:30 - Long Talk (15 minutes)
Gerard Persoon - From EVM bytecode to Solidity and back to bytecode
10:30-10:45 - Long Talk (15 minutes)
Doris Benda - How clean is your code? Dirty Bits in Solidity
10:45-11:00 - Long Talk (15 minutes)
Martin Derka - Automated Flashloan Attack Discovery
11:00-11:15 - Break
11:15-11:30 - Long Talk (15 minutes)
Haoran Xu - Bitcoin DeFi (BTCFi) Auditing Is Its Own Discipline: A Practitioner's Map of Where It Breaks
11:30-11:45 - Long Talk (15 minutes)
Henri Binsztok - Your Multisig Can Correctly Approve the Wrong Transaction
11:45-12:00 - Long Talk (15 minutes)
Jork Leonhardt - RPC Trust Failures: A Checklist for Builders and Monitoring Tools
12:00-12:15 - Long Talk (15 minutes)
Ofir Eliasi - How to Kill Your Own Chain: A Security Playbook for Live Cosmos→EVM Migrations
12:15-12:30 - Break
12:30-12:45 - Long Talk (15 minutes)
Davit Kobakhidze - Sword vs. Shield: Navigating the AI Security Chaos in 2027
12:45-13:00 - Long Talk (15 minutes)
John Ennis - Onchain Security Markets in a World of Offensive AI
13:00-13:30 - Short Talks Session 1 (shared 30-minute session window)
Thomas Marques - Why a Boring LLM Pipeline Can Beat Agentic Complexity
Abhinav Sharma - Quantum-Safe Is Not Just Post-Quantum Signatures: The Five Other Layers Quantum Actually Breaks in Blockchains
Don Josey - Can security judgement be financialized without corrupting it?
Akand Sitra - Web3 Security - Real-Time Monitoring
nisedo - AI-Native Auditing in Five Minutes: Questions, Evidence, Coverage
13:30-14:30 - Lunch
14:30-15:00 - Short Talks Session 2 (shared 30-minute session window)
Christian Vari - The Audit Gap: A Four-Year Empirical Study of 23,818 Findings and 218 Exploits
Ofir Eliasi - Your Protocol Is Audited. Your RPC Isn't.
Elliot Friedman - Your Governance Proposal is Clean. Your Laptop Isn't.
Clément Moller - The Queue Is the Protocol: Finding DeFi Liveness Bugs with Stateful Invariants
Prabal Banerjee - Combatting Onchain Surveillance Infrastructure
15:00-15:15 - Long Talk (15 minutes)
Rahul Saxena - The Attestation Gap: Securing Private AI and TEE-Backed DeFi
15:15-15:30 - Long Talk (15 minutes)
Hudson Jameson - 2017 Parity Multi-Sig Hacks: A Behind the Scenes Retrospective
15:30-15:45 - Break
15:45-16:00 - Long Talk (15 minutes)
Vijaykumar Singh - Forging PLONK Proofs Against an Unchecked Verifying-Key Cache (gnark, BN254)
16:00-16:15 - Long Talk (15 minutes)
Zakaryae Boudi - When Two Correct Contracts Compose Into One Critical Bug: A Calculus for Seam Failures in DeFi
16:15-16:30 - Long Talk (15 minutes)
George Loukovitis - Detecting Unsafe ERC-20 Behavior: Deterministic Analysis and LLMs
16:30-16:45 - Long Talk (15 minutes)
Rogue Rotkosky & Arturo Roura - Confidential Smart Contracts: From Mechanics to Secure Design
16:45-17:00 - Break
17:00-17:15 - Long Talk (15 minutes)
Steffen Kux - Security Starts Before the Signature: Trustless Transaction Analysis for Ethereum Wallets
17:15-17:30 - Long Talk (15 minutes)
Suryansh Singh - The Missing Certification: What Web3 Can Gain from Standards
17:30-17:45 - Long Talk (15 minutes)
Jelle "0xFlint" Goethals - x402 Integration Pitfalls: What the Protocol Proves and What Your Application Must Enforce
17:45-18:00 - Long Talk (15 minutes)
Andy M. Lee - No Longer a Dark Forest: measuring What Fuzzing Actually Proves About Smart Contract Security
Day 1 programme ends at 18:00 in both rooms. Day 2 Pearl ends at 18:00; Amber concludes with Ioannis Sachinoglou’s special keynote, 17:45-18:15. Day 2 programme ends at 18:15.