Connects crypto theft to devices, signing workflows and organizational controls, drawing on the work of the security firm he co-founded.
Why read Dan Guido?
Dan Guido's account of a fake Bloomberg invitation shows how an ordinary business call can become a security incident. The attacker uses a legitimate remote-control feature and a misleading participant name to obtain access. Read the encounter first, then compare staff procedures with controls that restrict the application's permissions. It makes the gap between recognizing a scam and preventing access tangible.
His coauthored Bybit article broadens the question to signing infrastructure, independent transaction checks and incident preparation. It was published on the day of the February 2025 theft and includes an early hypothesis about the compromise, so use it for the organizational questions it raises. Guido leads Trail of Bits, a security-services firm; the writing explains a provider's approach to defending teams.
Start with the original
Selected work
-
Case study ·
Mitigating ELUSIVE COMET Zoom remote control attacks
Start with the fake media invitation and the remote-control permission request, then read the layered controls. The device-management examples address macOS and a specific attack route.
Cite this selection
XFollowList, “Mitigating ELUSIVE COMET Zoom remote control attacks” reading notes in the Dan Guido profile. https://xfollowlist.com/people/dan-guido#work-57ed7a67f9d2
The linked work is the original source; this permalink identifies XFollowList’s reason to read it. Original work published .
Profile-source checking date and references · Dated reading map
-
Analysis ·
The $1.5B Bybit Hack: The Era of Operational Security Failures Has Arrived
Coauthored with Benjamin Samuels and Anish Naik. Read the sections on segmentation, layered controls and preparedness; the same-day account contains preliminary assumptions about the attack.
Cite this selection
XFollowList, “The $1.5B Bybit Hack: The Era of Operational Security Failures Has Arrived” reading notes in the Dan Guido profile. https://xfollowlist.com/people/dan-guido#work-9b4648837cb3
The linked work is the original source; this permalink identifies XFollowList’s reason to read it. Original work published .
Profile-source checking date and references · Dated reading map
Projects & roles
Trail of Bits
The security research, audit and tooling firm he co-founded and leads. Company publications also include work by other named researchers.
Community rating
Sources & further reading
Profile sources checked . This describes checking these references, separately from the publication dates of selected works.
- Own site identifies his Trail of Bits role and links x.com/dguido and GitHub.
- Own byline and the firm's account of the attempted social-engineering approach.
- Names all three authors and dates the initial response to the Bybit incident.
Cite this profile’s source check
XFollowList, Dan Guido profile sources. Sources checked 2026-10-11. https://xfollowlist.com/people/dan-guido#sources-checked