Aave now has access to Claude's Cyber Defense tools, giving the protocol AI tooling for finding vulnerabilities, according to @ethandefi_ quoting @stanikulechov.
[1]← Week of Oct 18Oct 18 – Oct 24 UTC Every claim links to the posts behind it01 02 03 04 05 06 07 08 09 10 11 12 13 14 8 posts on X 2 weeks
Narrative / Rank 19 / Week of Oct 18 – Oct 24
Claude gets pulled into defense work: Aave gains access to its Cyber Defense tools while The Information reports attackers used Claude and Grok to hit 400+ Latin American financial targets
Peak / day10tracked accounts
Peak dayThuOct 22 · busiest day in the panel
Rest of X / peak day357distinct accounts outside the panel
Cited claims146 dropped by automated checks
Market—no token attached
Attention
Who was talking, day by day
Tracked paneldistinct tracked accounts / day
Rest of Xdistinct other accounts / day
What happened
Aave now has access to Claude's Cyber Defense tools, giving the protocol AI tooling for finding vulnerabilities, according to @ethandefi_ quoting @stanikulechov. The Information reported that hackers used Claude and Grok to automate attacks against financial organisations in Latin America, targeting more than 400 banks and other financial targets, per @icplegend1966 quoting @kimmonismus. The 400+ figure describes targets, not 400 independently confirmed bank breaches, and AI agents appear to have stolen data and accessed bank accounts in one of the first documented cases of its kind.
+ 11 more in the evidence register ↓Why it matters
Claude shows up this week on both sides of the same security conversation, which is what makes the Aave access and the Latin America attack report land together rather than as separate trivia: the same assistant is being handed to a major DeFi protocol as defensive tooling in one post and named as attacker tooling in another. The LiteLLM compromise widens that exposure to credentials, since Claude Code configs are explicitly listed among the stolen material, meaning developers' own setups are in scope, not just bank targets. The Polymarket odds question is the market-side mirror: traders are pricing Fable 5.2+ at 97% by Dec 31 while one poster points out Anthropic's own Fable 5 to Fable 5.1 gap was 84 days and the last release was September 1, so the betting market is assuming a faster cadence than the release history shows.
Observed reaction
Tooling-and-serious-use tone around Claude as a coding and agent workhorse, with alarm concentrated in the two @icplegend1966 security posts (Latin America attack campaign, LiteLLM supply-chain compromise) and skepticism in @0xkyz's pushback on Polymarket's Fable 5.2+ odds. Elsewhere Claude is treated matter-of-factly as the default assistant for building, tracking usage and analyzing on-chain bots.
Spread
Where it started and who carried it
- First seen
- Oct 18, 06:03 UTC by @aakashgupta
- Accounts
- 29 tracked · 49 elsewhere on X
- Communities
- general ct (7), ai crypto (5), eth defi (4), memecoins solana (3)
- Key accounts
- @clairlemon, @cranefomo, @starmexxx, @artificialanlys, @polymarket
Explainability
Evidence register
The Information reported that hackers used Claude and Grok to automate attacks against financial organisations in Latin America, targeting more than 400 banks and other financial targets, per @icplegend1966 quoting @kimmonismus.
[1]The 400+ figure describes targets, not 400 independently confirmed bank breaches, and AI agents appear to have stolen data and accessed bank accounts in one of the first documented cases of its kind.
[1]LiteLLM was compromised in a supply-chain attack hiding malware that runs on Python startup, stealing SSH keys, cloud credentials and Claude Code configurations, and raiding the LiteLLM database for stored AI provider API keys, per @icplegend1966 quoting @intcyberdigest.
[1]@0xkyz noted Polymarket odds for Claude Fable 5.2+ at 52% for Oct 21, 70% for Oct 24, 82% for Oct 31 and 97% for Dec 31, against Anthropic's release spacing of Fable 5 on June 9 and Fable 5.1 on September 1 (84 days).
[1]A Fable 5.5 leak appeared in an Azure-related catalog update on October 13 and the entry was removed the next day after checks couldn't confirm availability.
[1]@stocksandbox reviewed $SPECTRE on the weekly BTW and suggested Claude could look for features or data on the platform, saying they are looking forward to the API.
[1]@anubis_crypto_ built an Alexa+ escape room over five and a half weeks as an MCP server, with Claude Haiku on Amazon Bedrock writing narration, the escape code requested through MCP elicitation, and Claude Code writing and testing the code, with 104 tests passing.
[1]@althanasiusd11 uses ChatGPT, Claude and Gemini almost daily and described the CONSO AI Usage Tracker for prompts, tokens, model usage and estimated API costs.
[1]A 35-year-old software engineer with stage 4 breast cancer has been running 30+ Claude agents on her tumor since March, with separate agents for papers/trials, number verification, and 2-3 agents answering hard questions independently, producing a Zürich biopsy protocol and a 3D map of metastases from 2 PET scans.
[1]@scratcherrrr gave Claude Opus 5.5 a Polymarket bot's wallet address, which pulled its last 2,619 fills and found a third are 1-10 cent tickets on the side the book has already written off; the bot was green 24 of 30 days, +$34,407 in 30 days and +$299,217 all time across 183,843 markets since December.
[1]@altcoinmillie quoted a Ditto MCP pitch that gives Claude memory across a Telegram thread, a Claude Code session and a prior chat, connecting Claude, Cursor or Codex with one key per device.
[1]@tittomikhati listed starting to build with Claude again among things they focused on amid a bad NFT market.
[1]@zerkerthegreek joked that Claude has the controls and is flying @cz_binance around, quoting CZ's 'Now, it controls us.'
[1]Angles
- Aave gets Claude Cyber Defense access for vulnerability hunting — contrast directly with the same week's report that attackers used Claude and Grok against 400+ Latin American financial targets (mark the attack report as unverified, and note 400 = targets, not breaches)
- The dual-use problem in one week: Claude shipped to a DeFi protocol as defense tooling while The Information reports it used offensively
- LiteLLM supply-chain compromise stole Claude Code configs plus SSH keys, cloud credentials and AI provider API keys — developers' local setups are the target, not just exchanges
- Polymarket is pricing Fable 5.2+ at 97% by Dec 31; the release-history counterargument is 84 days between Fable 5 (June 9) and Fable 5.1 (September 1)
- The Fable 5.5 Azure catalog entry appeared Oct 13 and vanished Oct 14 when checks couldn't confirm availability — a leak-versus-real-release question
- Claude as default dev tool in non-crypto contexts: an Alexa+ MCP escape room (Claude Haiku on Bedrock, Claude Code, 104 tests) and a 30+ agent medical case where 2-3 agents answer separately so disagreements surface
- Claude Opus 5.5 as an on-chain forensics tool: reversing a Polymarket bot's fill pattern (a third of fills are 1-10 cent tickets) from its last 2,619 fills
Formats in use
- quote-tweet amplification of security news (@icplegend1966 quoting @kimmonismus and @intcyberdigest; @ethandefi_ quoting @stanikulechov)
- prediction-market odds breakdown with a release-history counterargument (@0xkyz listing Polymarket percentages against Anthropic's Fable 5/5.1 dates)
- personal build threads citing exact Claude models and test counts (@anubis_crypto_, MCP server with Claude Haiku on Bedrock, 104 tests)
- product recommendation with a soft Claude tie-in (@stocksandbox on $SPECTRE, @althanasiusd11 on the CONSO AI Usage Tracker)
- war-story / bot-teardown thread (@scratcherrrr on 30+ Claude agents for a cancer patient, and Claude Opus 5.5 reversing a Polymarket bot's 2,619 fills)
Risks
- The Latin America campaign (Claude and Grok used to attack 400+ banks) is a media report relayed by @icplegend1966 quoting @kimmonismus citing The Information — treat as unverified; the 400+ number is targets, not confirmed breaches, and '@icplegend1966's post explicitly makes that distinction. Do not restate it as 400 banks hacked.
- The LiteLLM supply-chain compromise details come from @icplegend1966 quoting @intcyberdigest and should be marked as reported until confirmed by LiteLLM or a security vendor.
- The Fable 5.5 Azure catalog leak (Oct 13, removed Oct 14) is unconfirmed; the post itself says checks couldn't verify availability.
- Polymarket odds in @0xkyz's post are market-implied probabilities on an unannounced product, not price targets — present them as odds, no prediction or financial advice.
- Some posts in this set are soft product promotion (@stocksandbox on $SPECTRE and its API, @althanasiusd11 on the CONSO AI Usage Tracker, @altcoinmillie quoting Ditto's MCP pitch, @cryptorob35's airdrop farming recap) and may be paid or coordinated; keep them out of the headline and flag as promotional if used.
- The cancer-treatment agent post names no individual and describes a personal medical case; use only the claims as written, do not add medical assertions or identify the person.
Observed content
Most-engaged posts
If you're building on $NEAR, or thinking about it, this hackathon deserves your attention. $250k in prizes, paid in NEAR. A $55k grand prize, plus $10k, $3k and $2k for the top three in each of the 13 tracks. That's 40 prizes in total. The jury: Illia Polosukhin, Mert Mumtaz (HOpen on X →
Here’s what $SPECTRE looks like on the weekly BTW Impressed with this platform every time I use it. So much value, can be overwhelming if unfamiliar with the platform Maybe Claude can check things out and look for features you like or data you want ;) Looking forward to tOpen on X →
Aave now has access to Claude's Cyber Defense tools. Very cool to see, as this gives Aave access to powerful AI tools for finding vulnerabilities that hackers can’t use. All DeFi protocols that take security seriously should apply to programs like this.Open on X →
RT @heydittoai: Claude has never opened your Telegram. It still knows what you said there. Ditto's MCP gives Claude your memory: the Telegram thread, this morning's Claude Code session, the decision from yesterday's chat. Ask Cursor the same question and you get the same answerOpen on X →
🫡 Last week on Solana was all about market structure. Tokenized assets hit records. Onchain equities broke free of market hours. Privacy and structured yield took big steps forward. Everything you missed in 90 seconds 👇 ⸻ 📈 TOKENIZED ASSETS ARE SCALING → @solana tokenizedOpen on X →
The benefit of such a horrible NFT market like the current one is that you can focus on building and your irl experiences. Started to work out again Focused on my family & friends Started to build with Claude again Started to learn wrestling Fuck the market, focus on yourself.Open on X →
🚨 $ICP ♾🔥 AI-DRIVEN ATTACKS ARE TURNING FINANCIAL SECURITY INTO A SOFTWARE ARCHITECTURE TEST. The Information reports hackers used Claude and Grok to automate attacks against financial organisations in Latin America. (https://t.co/kjEuavLsUk) The reported campaign targetedOpen on X →
a 35-year-old software engineer has stage 4 breast cancer. since March she's been running 30+ Claude agents on her own tumor. one agent reads papers and hunts for trials in other countries. one only checks every number against its source. on hard questions 2-3 agents answer sepaOpen on X →
History
Weeks this story made the report
- #13steadyAnthropic's own threat report: hackers ran AI agents on Claude, Grok and Kimi against 400+ banks, as Claude text gets watermarked from Nov 3
- #19steadyClaude gets pulled into defense work: Aave gains access to its Cyber Defense tools while The Information reports attackers used Claude and Grok to hit 400+ Latin American financial targets