Layla Zulfa
The Ethereum Foundation, in collaboration with leading security organizations Secureum, The Red Guild, and Security Alliance (SEAL), has successfully concluded its inaugural six-month ETH Rangers Program. Launched in late 2024, the initiative was designed to provide vital stipends to individuals dedicated to public goods security work within the Ethereum ecosystem, fostering independent efforts to bolster the network’s resilience. The program, which wrapped up in mid-2025, supported 17 stipend recipients whose diverse contributions spanned vulnerability research, security tooling, education, threat intelligence, and incident response, underscoring the critical need for a decentralized defense strategy in a decentralized network.
The Imperative of Ethereum Security: A Public Goods Challenge
Ethereum, as the leading smart contract platform, underpins a multi-trillion-dollar digital economy, hosting a vast array of decentralized applications (dApps), financial protocols (DeFi), and NFTs. This immense value, coupled with its open-source and permissionless nature, makes it a prime target for malicious actors, ranging from individual hackers to sophisticated state-sponsored groups. The history of the blockchain space is punctuated by high-profile exploits, often resulting in significant financial losses and erosion of user trust. Ensuring the security and integrity of the Ethereum network and its sprawling ecosystem is not merely a technical challenge but a continuous, collective endeavor.
Security work in a decentralized environment often falls under the category of "public goods." These are services that are non-excludable (everyone benefits, regardless of contribution) and non-rivalrous (one person’s use doesn’t diminish another’s). Crucial security activities, such as fundamental research into protocol vulnerabilities, the development of open-source security tools, comprehensive educational initiatives, and proactive threat intelligence, typically lack direct, immediate revenue streams. Consequently, such essential work can be underfunded and under-resourced.
Recognizing this critical gap, the Ethereum Foundation, alongside its partners, conceptualized the ETH Rangers Program. Secureum, known for its rigorous security education and audit methodologies, brought expertise in fostering security talent. The Red Guild contributed its deep knowledge in security research and community building, while Security Alliance (SEAL) offered invaluable experience in coordinating incident response and threat mitigation strategies. The program’s core objective was clear: to identify and empower individuals with proven track records of making meaningful, ecosystem-wide security contributions, providing them with the financial stability to dedicate their efforts to these vital public goods.
A Six-Month Odyssey: Program Timeline and Structure
The ETH Rangers Program was officially announced and initiated in late 2024, following a rigorous selection process. Candidates were evaluated based on their past contributions to Ethereum security, their proposed projects, and their potential to deliver significant impact. The program was structured as a six-month engagement, during which the 17 selected recipients received stipends to support their independent work. The Red Guild played a particularly hands-on role in this phase, providing detailed feedback, structuring milestones, and reviewing submissions to ensure that each project remained aligned with the program’s goals and delivered tangible results.
The program concluded in mid-2025, marking a significant milestone in the Ethereum Foundation’s commitment to fostering a robust security culture. The diverse range of projects undertaken by the Rangers highlights the multi-faceted nature of blockchain security, moving beyond mere bug hunting to encompass a holistic approach to safeguarding the ecosystem.
Consolidated Achievements: A Decentralized Shield
The collective output of the 17 ETH Rangers has laid a stronger foundation for Ethereum’s security posture. While individual projects varied greatly in scope and focus, their consolidated outcomes have significantly enhanced the ecosystem’s resilience across several key domains:
- Vulnerability Discovery and Protocol Hardening: Researchers delved into core Ethereum protocols and smart contract architectures, identifying critical vulnerabilities that could lead to network disruptions or financial exploits. This proactive research is vital for maintaining the integrity and stability of the underlying blockchain.
- Advanced Security Tooling and Infrastructure: Several Rangers focused on developing open-source tools that empower developers and security professionals to build more securely and efficiently. These tools range from formal verification frameworks to bytecode analysis extensions, making complex security tasks more accessible.
- Global Security Education and Capacity Building: A significant portion of the program’s impact came from educational initiatives, training new cohorts of security researchers and developers. These efforts are crucial for expanding the pool of skilled professionals capable of defending the ecosystem.
- Proactive Threat Intelligence and Rapid Incident Response: Rangers contributed to identifying emerging threats, monitoring malicious activities, and participating in rapid response efforts to mitigate ongoing exploits. This intelligence is critical for staying ahead of evolving attack vectors.
- Knowledge Dissemination and Community Empowerment: Many projects involved publishing detailed technical analyses, security best practices, and educational content, fostering a more informed and security-conscious community.
These achievements collectively demonstrate the profound truth that "securing a decentralized network requires a decentralized defense." By empowering independent researchers and fostering a culture of collaborative security, the ETH Rangers Program has multiplied security effects across the entire ecosystem, creating infrastructure that will benefit builders and users globally.
Spotlight on Innovation: Key Project Highlights
The ETH Rangers Program saw remarkable innovation from its participants. Here’s a closer look at some of the standout projects:
SunSec & DeFiHackLabs: Scaling Security Education
Under the leadership of SunSec, the DeFiHackLabs community emerged as a powerhouse of security education and tooling. Leveraging the stipend, DeFiHackLabs significantly expanded its reach, delivering an estimated 50+ intensive security workshops and training sessions to hundreds of aspiring security researchers and developers. Their output included the development of numerous open-source tools for vulnerability analysis, publishing dozens of detailed security reports on common DeFi attack vectors, and creating comprehensive educational materials on secure smart contract development. This initiative acted as a powerful multiplier, transforming a single stipend into a vast educational network that empowered a new generation of security professionals. Their efforts directly contributed to raising the overall security literacy within the Ethereum developer community, especially in areas historically underserved by advanced security training.
Ketman Project: Unmasking State-Sponsored Threats
One of the most unique and impactful projects was the Ketman Project, dedicated to uncovering and neutralizing the threat posed by North Korean (DPRK) IT workers infiltrating blockchain projects under false pretenses. This stipend recipient built and scaled an advanced intelligence operation, identifying dozens of suspicious profiles and collaborating discreetly with affected projects to facilitate their removal. Their work involved sophisticated open-source intelligence (OSINT) techniques, blockchain forensics, and cross-referencing data to expose these clandestine operations. The Ketman Project directly confronts one of the most severe operational security threats facing the Ethereum ecosystem today, as DPRK-backed groups have been implicated in some of the largest crypto hacks, using stolen funds to finance their weapons programs. The project’s success in identifying and mitigating these infiltrations represents a significant defensive win for the entire blockchain industry.
Nick Bax: The Frontlines of Incident Response and Threat Intelligence
Nick Bax made extensive contributions across multiple critical security fronts. As a key participant in SEAL 911, he was on the front lines of rapid incident response, providing crucial support during active exploits and helping to coordinate mitigation efforts. His work extended to DPRK threat mitigation, often collaborating with projects like Ketman to disseminate intelligence and fortify defenses against state-sponsored incursions. Bax also played a significant role in public awareness campaigns, publishing timely threat advisories and educational content to inform the community about emerging risks and best practices for operational security. His proactive engagement in threat intelligence and reactive capabilities in incident response proved invaluable in protecting users and protocols.
Guild Audits: Cultivating Talent in Underrepresented Regions
Guild Audits spearheaded an ambitious program of intensive smart contract security bootcamps, with a particular focus on empowering talent in Africa and other historically underrepresented regions. Over the program’s duration, Guild Audits organized several multi-week bootcamps, training over 100 participants in advanced smart contract auditing techniques, formal verification, and secure coding practices. These bootcamps were meticulously designed to provide hands-on experience and mentorship, creating a robust pipeline of skilled security researchers. The capacity-building impact of Guild Audits is profound, not only by increasing the global pool of security talent but also by fostering greater diversity and inclusion within the Ethereum security community, ensuring a broader range of perspectives in defense strategies.
Palina Tolmach – Kontrol: Advancing Formal Verification
Palina Tolmach of Runtime Verification focused on enhancing Kontrol, a cutting-edge formal verification tool for Ethereum smart contracts. Formal verification is a rigorous method used to mathematically prove the correctness of code, offering the highest level of assurance against critical bugs. Tolmach’s work centered on making Kontrol more accessible and usable for a wider audience of developers and security researchers. Key improvements included significant enhancements to Kontrol’s user interface and experience, the integration of new proof capabilities, and better compatibility with existing development workflows. These advancements aim to lower the barrier to entry for formal verification, enabling more projects to integrate this powerful technique into their security audits, ultimately leading to more robust and bug-free smart contracts. All of her work is open source, benefiting the entire formal verification tooling landscape.
Ethereum Execution Client DoS Research: Fortifying Core Infrastructure
A dedicated research team developed an innovative testing framework to systematically assess the resilience of Ethereum’s five major execution clients (Geth, Besu, Erigon, Nethermind, and Reth) against message-flooding denial-of-service (DoS) attacks. This critical work uncovered 14 distinct bugs across various network protocol layers within these clients. These vulnerabilities, if exploited, could lead to severe consequences such as network instability, significant node performance degradation, and even cascading failures across the Ethereum network. The findings underscore that no single execution client is entirely immune to sophisticated DoS attacks and highlight the urgent need for enhanced countermeasures, including adaptive rate-limiting mechanisms. The research team has shared their comprehensive framework and detailed results with the Ethereum Foundation’s Protocol Security team, directly informing ongoing efforts to harden the core infrastructure of the network.
Diverse Contributions from Other Stipend Recipients
Beyond the highlighted projects, the remaining stipend recipients made equally valuable contributions across a wide spectrum of security public goods, further solidifying Ethereum’s defenses:
- Kelsie Nabben authored a foundational book, "Decentralised digital security: community, Inscriptions," based on 2.5 years of ethnographic research into decentralized digital security communities, including SEAL. Her work provides critical academic and practical insights into the social and organizational dynamics of securing decentralized systems.
- The Mothra team built and open-sourced Mothra, a Ghidra extension for EVM bytecode reverse engineering, with crucial support for EOF decompilation. This tool significantly enhances the ability of security researchers to analyze complex smart contracts and identify vulnerabilities at a low level.
- SomaXBT published an impactful four-part series on blockchain forensics and the crypto threat landscape. This educational resource covered essential topics such as fund tracing, attribution techniques, and Open-Source Intelligence (OSINT) methods, equipping the community with vital skills to combat illicit activities.
- Peter Kacherginsky launched BlockThreat, a comprehensive platform for blockchain threat intelligence. BlockThreat meticulously analyzes past security incidents and their root causes, providing invaluable historical context and actionable insights for proactive defense strategies.
- Attack Vectors developed attackvectors.org, an open-source, continuously updated guide detailing the top attack vectors in DeFi, complete with practical prevention strategies. They also contributed significantly to SEAL’s Wallet Security Framework, becoming a recognized SEAL Steward and promoting community-driven security standards.
- Tim Fan developed D2PFuzz, a DevP2P protocol fuzzing framework that utilizes differential testing across multiple Ethereum execution layer clients. His work led to the discovery of several bugs through both single-client and cross-client testing, improving the robustness of the network’s peer-to-peer communication.
- nft_dreww engaged in multi-faceted security contributions, publishing insightful security articles, hosting educational classes through Boring Security, and conducting audits on various Ethereum public goods projects, directly improving their security posture.
- Jean-Loïc Mugnier developed a Web3 transaction simulation Chrome extension that intercepts and simulates transactions before they reach the user’s wallet. This crucial tool, coupled with his research on simulation spoofing, empowers users to avoid phishing and malicious transaction approvals, significantly enhancing user safety.
- Alexandre Melo produced a series of high-quality security workshop videos, covering advanced topics such as fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs. These videos make complex security concepts accessible to a broader audience.
- Ho Nhut Minh significantly enhanced CuEVM, a GPU-accelerated EVM implementation, by adding multi-GPU support and a Golang library for seamless integration with the Medusa fuzzer. His work, benchmarked on powerful Nvidia H100 GPUs, dramatically accelerates security analysis and vulnerability detection.
- Sergio Garcia built the Tracelon Monitoring Bot, a Telegram bot offering real-time block monitoring for Ethereum, Bitcoin, and Base, complete with ERC20 balance change alerts. He also continued his vital contributions to SEAL 911 incident response, providing real-time intelligence and support during security emergencies.
Looking Ahead: A Blueprint for Sustainable Security
The ETH Rangers Program was conceived to support the often "unglamorous but essential" security work that forms the bedrock of a robust decentralized ecosystem. The concluding results unequivocally demonstrate the program’s success in fostering a broad spectrum of contributions that extend far beyond simple bug fixes. It has championed the development of critical tools, facilitated the training of new talent, enriched the documentation of security knowledge, enabled rapid incident response, and ultimately made the Ethereum ecosystem demonstrably more resilient.
This decentralized approach to security, which empowers independent experts and communities, offers a sustainable and scalable model for addressing the ever-evolving threat landscape. By integrating new tools, research, and intelligence from diverse sources, the program has woven a tighter security fabric around the Ethereum network, benefiting developers, users, and the entire Web3 community. The success of this inaugural program provides a compelling blueprint for future initiatives aimed at cultivating public goods security work, ensuring Ethereum’s continued growth as a secure and reliable platform for innovation.
The Ethereum Foundation extends its profound gratitude to all 17 stipend recipients for their invaluable contributions. Special appreciation is also given to The Red Guild for their hands-on involvement in guiding projects, reviewing milestones, and providing crucial feedback throughout the program. The collaboration with Secureum and Security Alliance was instrumental in establishing and executing this groundbreaking initiative, further cementing their roles as pillars of the Ethereum security community.
