"Failed to compile: missing dependency" sound familiar?
Whether you're building open-source software or running mystery binaries, our new tool, Deptective automatically discovers the packages you need for successful execution.

Read the blog: https://blog.trailofbits.com/2025/07/08/investigate-your-dependencies-with-deptective/
Another tool in our software supply chain security arsenal. Try Deptective: https://github.com/trailofbits/deptective

DARPA's AI Cyber Challenge finals are underway. Seven autonomous AI systems are competing to find and patch vulnerabilities in critical open-source programs like the Linux kernel, SQLite, and cURL that power our digital infrastructure.

Learn more: https://blog.trailofbits.com/2025/07/02/buckle-up-buttercup-aixccs-scored-round-is-underway/

Did you know the biggest cause of crypto hacks in 2024 goes entirely unnoticed by most security audits? This attack vector was responsible for 43% of the crypto stolen in 2024, and isn't eligible as a finding in audit contests or most audit engagements

Answer: Private key compromise.

In this post, you'll learn how to make protocols resilient to private key leaks using our 4-level framework: https://blog.trailofbits.com/2025/06/25/maturing-your-smart-contracts-beyond-private-key-risk/

As a Go developer, do you fully understand Go's JSON/XML/YAML parsers? They are surprisingly prone to attacks with simple misconfigurations:
Three unexpected attack scenarios:
1. Marshaling private data with misconfigured tags
2. Parser differentials in a microservices architecture
3. Cross-format confusion attacks (JSON→XML)

https://blog.trailofbits.com/2025/06/17/unexpected-security-footguns-in-gos-parsers/

$5B in revenue, millions of mobile players, one question: are the dice rolls fair?

When Monopoly GO! players questioned their dice roll outcomes, the game's developers hired us to conduct an independent cryptographic design assessment of their PRNG architecture.

Our cryptographic design assessment evaluated two core concerns:
✅ If the random number generator produces unbiased outcomes for all players
✅ Do the countermeasures effectively prevent malicious actors from predicting or manipulating results through client-side attacks

Read the case study: https://trailofbits.info/monopolygo-casestudy

In 2023, we audited Axiom's Halo2 circuits and found 35 security issues, including 4 high-severity soundness bugs that could break the ZK system entirely.

The Axiom team engaged us early in development. They fixed all issues, and we helped them build comprehensive test suites to strengthen their security posture.

https://trailofbits.info/axiom-blog