Web3 Technology Challenges

We hire almost all the time. This means we get at least 1000+ applicants every month. And we reject 90% of them. But we give them 5 things along with out rejection email. Instead of just sending a rejection email, we decided to offer something more. We sent each applicant freebies to help them upskill and grow and then reapply Here’s what we included: 1/ Newsletter Access- We gave them access to all the newsletters we’ve written to date, filled with insights and industry knowledge. 2/ Course Access- Our paid course, "Crack Those Socials," is included to help them sharpen their social media strategies. 3/ Monetization Guide- A step-by-step guide on "How to Make Your First $10,000 from LinkedIn" to boost their earning potential. 4/ AI Tools List: A curated list of 50 AI websites and tools to streamline their workflow and enhance productivity. 5/ Skillshare account access to learn more about content 📌 Why did we do this? Because rejection is tough, but it’s also an opportunity. By offering these resources, we hope to empower those who didn’t make the cut to keep pushing forward, to keep improving, and to eventually land their dream job. This wasn’t just about being nice; it was about investing in the community. Because when they grow, we all grow. #hiring

Any MFA is better than no MFA, but recent attacks make it clear: legacy MFA is no match for modern threats. Happy Cyberz Saturday! Check out this piece from my teammates Bob Lord & Grant Dasher on USDA’s FIDO implementation. BLUF: USDA’s success story should inspire all enterprises to migrate to FIDO authentication. Customers expect their providers to take security seriously, and given today’s threat landscape, organizations must ensure they are mitigating one of the most common and effective attack vectors.👇 As the saying goes, malicious actors don’t break in—they log in. There's a significant truth in that statement. Today, many organizations struggle to protect their staff from credential phishing, a challenge that's only grown as attackers increasingly execute “MFA bypass” attacks. In an MFA bypass attack, threat actors use social engineering techniques to trick victims into providing their username and password on a fake website. If victims are using “legacy MFA” (such as SMS, authenticator apps, or push notifications), the attackers simply request the MFA code or trigger the push notification. If they can convince someone to reveal two pieces of information (username and password), they can likely manipulate them into sharing three (username, password, and MFA code or action). Make no mistake—any form of MFA is better than no MFA. But recent attacks make it clear: legacy MFA is no match for modern threats. So, what can organizations do? Sometimes a case study can answer that question. Today, CISA and the USDA are releasing a case study that details the USDA’s deployment of FIDO capabilities to approximately 40,000 staff. While most of their staff have been issued government-standard Personal Identity Verification (PIV) smartcards, this technology is not suitable for all employees, such as seasonal staff or those working in specialized lab environments where decontamination procedures could damage standard PIV cards. This case study outlines the challenges the USDA faced, how they built their identity system, and their recommendations to other enterprises. Our personal favorite recommendation: "Always be piloting". FIDO authentication addresses MFA-bypass attacks by using modern cryptographic techniques built into the operating systems, phones, and browsers we already use. Single sign-on (SSO) providers and popular websites also support FIDO authentication. Here’s the remarkable part about FIDO: even if malicious actors craft a convincing scheme to steal staff credentials, and the staff comply, the attackers still won’t be able to compromise the account. The USDA’s success story should inspire all enterprises to migrate to FIDO authentication. Read the full case study here: https://lnkd.in/eGM2RZmz.

I wish someone taught me this in my first year as a PM. It would’ve saved years of chasing the wrong goals and wasting my team's time: "Choosing the right metric is more important than choosing the right feature." Here are 4 metrics mistakes even billion-dollar companies have made and what to do instead with Ron Kohavi: 1. Vanity Metrics They look good. Until they don’t. A social platform he worked with kept showing rising page views… While revenue quietly declined. The dashboard looked great. The business? Not so much. Always track active usage tied to user value, not surface-level vanity. 2. Insensitive Metrics They move too slowly to be useful. At Microsoft, Ronny Kohavi’s team tried using LTV in experiments. but saw zero significant movement for over 9 months. The problem is you can’t build momentum on data that’s stuck in the future. So, use proxy metrics that respond faster but still reflect long-term value. 3. Lagging Indicators They confirm success after it’s too late to act. At a subscription company, churn finally spiked… but by then, 30% of impacted users were already gone. Great for storytelling but let's be honest, it's useless for decision-making. You can solve it by pairing lagging indicators with predictive signals. (Things you can act on now.) 4. Misaligned Incentives They push teams in the wrong direction. One media outlet optimized for clicks and everything was looking good until it wasn't. They watched their trust drop as clickbait headlines took over. The metric had worked. They might had "more MRR". But the product suffered in the long run. It's cliche but use metrics that align user value with business success. Because Here's The Real Cost of Bad Metrics - 80% of team energy wasted optimizing what doesn’t matter - Companies with mature metrics see 3–4× stronger alignment between experiments and outcomes - High-performing teams run more tests but measure fewer, better things Before you trust any metric, ask: - Can it detect meaningful change in faster? - Does it map to real user or business value? - Is it sensitive enough for experimentation? - Can my team interpret and act on it? - Does it balance short-term momentum and long-term goals? If the answer is no, it’s not a metric worth using. — If you liked this, you’ll love the deep dive: https://lnkd.in/ea8sWSsS

Last week's White House Executive Order on advanced cryptographic attacks provided more clarity on timelines that have been missing from the post-quantum conversation. 2030 for key establishment. 2031 for digital signatures. The order applies to federal information systems first, but it extends the urgency to critical infrastructure operators, federal contractors, and any organization in regulated industries that follows federal procurement standards. My colleague Anand Oswal wrote about this clearly this week. The point that should land hardest with boards: adding support for post-quantum algorithms is not the same as safely migrating to them. You can have systems that technically support the new standards and still not be ready to use them at the scale and pace the timeline requires. The pattern should sound familiar. This is the same architecture we have been writing about for AI security. You cannot secure what you cannot see. Visibility leads, then assessment, then protection. The Discover, Assess, Protect sequence from yesterday's unified approach post applies just as cleanly to cryptographic readiness. The five actions Anand lays out track to the same operating model: 1️⃣ See cryptographic exposure across all environments. 2️⃣ Prioritize authentication, high-value assets, and long-lived sensitive data. 3️⃣ Modernize trust infrastructure to support evolving standards. 4️⃣ Automate cryptographic change so spreadsheets are not the operating model. 5️⃣ Govern readiness as a continuous discipline rather than a one-time project. The harvest now, decrypt later risk is the part most boards have not fully internalized. The data adversaries are capturing today is the data they plan to decrypt later. Organizations holding sensitive information with a multi-year shelf life have less time than the 2030 and 2031 milestones suggest. The Cryptographic Reset is already underway, and the window to organize a response is still open. The first step is visibility. https://lnkd.in/dTfyudrH

Are we ready to delegate our capital to a piece of code with on-chain reputation? The infrastructure is here. ERC-8004 is the bridge between LLMs and true financial autonomy. Most AI agents today suffer from a critical flaw: They are islands of trust. If you interact with an agent today, you have no proof of its identity, no idea if its reputation is legitimate, let alone whether the model it claims to run is actually processing your data. ERC-8004 (Trustless Agents) has just arrived to solve this. It's not just an identity standard; it's the foundational infrastructure for the Machine Economy. 🛠️ The Anatomy of ERC-8004 Unlike traditional smart contracts, ERC-8004 decouples the logic into three immutable registry layers: Identity Registry (Universal ID): Leverages token-bound account architecture (based on ERC-6551). Each agent is a "subject" with its own wallet, capable of owning assets and signing transactions autonomously. Reputation Registry: A permissionless feedback system. Users and other agents deposit proofs of performance. Being on-chain, it eliminates centralized reputation silos. Validation Registry: This is where the technical magic happens. It enables the integration of TEE (Trusted Execution Environments) or zkML (Zero-Knowledge Machine Learning) proofs. You can verify that an AI inference was correct without the agent revealing its proprietary weights. 💡 Applications We'll See in 2026 Autonomous Inter-DAO Arbitrage: Agents autonomously negotiating loans between protocols without human intervention. AI for Governance: Agents with verified on-chain reputation analyzing and voting on proposals based on community-defined parameters. Personal AI Agents: Your personal assistant autonomously paying for subscriptions and services, with spending and risk limits controlled by smart contracts. 🛡️ Risk Mitigation: Security by Design The standard not only facilitates autonomy but also incorporates emergency brakes: Sybil Attack Resistance: Reputation often requires "skin in the game" (staking) or historical validation, preventing a botnet from flooding the registry with fake identities. Execution Safeguards: Through the validation registry, "circuit breakers" can be programmed to halt agent activity if cryptographic proofs of its actions fail. Metadata Transparency: Any anomaly in agent behavior is visible to the market in real-time, allowing for algorithmic "quarantining." 👇 Do you believe decentralized AI will outperform centralized AI this year? Let me know in the comments! #Web3 #AI #ERC8004 #Ethereum #Blockchain #SmartContracts #MachineEconomy #zkML Alfredo Joaquim Miguel David Javier Jun Hidenori Paris Daniel

🔴 Enough is enough. A major $300M hack just hit "Decentralized Finance" again this weekend. Kelp was exploited. After Drift Protocol, Kelp DAO has now been hacked. 👉 Hack after hack, it’s becoming painfully clear why "Traditional Finance" built so many layers, controls, and safeguards over the years. Yes, that complexity can feel maddening. Part of DeFi’s original promise was to strip it away. But it’s also time to move past the myth of full decentralization. Much of DeFi today is far more centralized and fragile than many would like to admit. Not all complexity is useless. This needs to be said clearly: these exploits aren’t going away. They’re structural. I’ve been covering crypto for nine years. Before founding The Big Whale, I worked at Reuters and Les Echos, covering banks and financial markets. There’s a reason traditional finance has so many controls and safeguards. They weren’t built for fun, but after decades of crises and costly failures. If TradFi has weekend market shutdowns, multi-layer validation for large transactions, or reversibility in some cases, it’s because systems without guardrails eventually break. Crypto is learning that in real time, and at a high cost. And this shift is global. The move from tech-first hubs to finance-first hubs is happening everywhere, not just SF to NYC. It reflects a broader transition from experimentation to financial infrastructure. Many protocols remain alarmingly immature. Basic processes are missing, governance is fragile, and a small flaw can lead to hundreds of millions lost and market-wide chaos. At this point, parts of DeFi are no longer innovation. They’re negligence. Cutting corners on security or governance is no longer experimentation. It’s risk transfer to users and the ecosystem. Another issue: many teams are excellent engineers, but lack deep financial or risk expertise. The belief that everything can be simplified by code alone is being tested the hard way. We’ve seen this movie before. Only a handful of native DeFi players will survive the next wave of hacks. The ones still standing in 2–3 years will likely be regulated. Curators too, increasingly recognized as asset managers. Regulation will bring baseline standards for security and structure. What exists today in key management and permissions is often alarming. Institutionalization is already underway, and it always comes with regulation. Banks, asset managers, fintechs, and regulated crypto players under MiCA or the Clarity Act will increasingly launch on-chain products. They will set expectations for standards. Markets drive innovation, but they don’t solve systemic risk alone. Regulation is coming, and to some extent, it’s necessary. The challenge will be avoiding overreach that kills innovation. Native DeFi players now have a responsibility: lead by example and rebuild trust. Right now, behind the narratives, there’s still a long road ahead !

$2B+ raised in Web3 in Q1 2026.  Here’s what the smart money is actually funding 👇 𝟭/ 𝗦𝘁𝗮𝗯𝗹𝗲𝗰𝗼𝗶𝗻 𝗿𝗮𝗶𝗹𝘀 𝗮𝗿𝗲 𝘄𝗶𝗻𝗻𝗶𝗻𝗴 Rain ($250M Series C)  LMAX Group ($150M) VelaFi ($20M Series B) Mesh ($75M Series C) Stablecoins are moving from "crypto tool" to enterprise settlement layer. Cards, collateral, embedded finance — real payment plumbing. 𝟮/ 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 > 𝗛𝘆𝗽𝗲 BitGo ($212M IPO) Anchorage Digital ($100M Strategic) Talos ($45M Series B ext.) Institutions are consolidating around compliant infra. Less speculation — more operational depth. 𝟯/ 𝗥𝗪𝗔𝘀 𝗮𝗿𝗲 𝗲𝘅𝗽𝗮𝗻𝗱𝗶𝗻𝗴 𝗯𝗲𝘆𝗼𝗻𝗱 𝘁𝗿𝗲𝗮𝘀𝘂𝗿𝗶𝗲𝘀 BlackOpal ($200M Anchor) Superstate ($82.5M Series B) Gold.com ($150M Strategic) Private credit, tokenized gold, regulated issuance rails. Real-world yield is absorbing capital quietly. 𝟰/ 𝗘𝗺𝗯𝗲𝗱𝗱𝗲𝗱 𝘁𝗿𝗮𝗱𝗶𝗻𝗴 & 𝗰𝗮𝗿𝗱 𝗶𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 Alpaca ($150M Series D) Pomelo ($55M Series C) Brokerage APIs + card issuance. Web3 is fusing with fintech distribution. 𝟱/ 𝗖𝗼𝗺𝗽𝗹𝗶𝗮𝗻𝗰𝗲 𝗮𝗻𝗱 𝗿𝗶𝘀𝗸 𝗶𝘀 𝗻𝗼𝗻-𝗻𝗲𝗴𝗼𝘁𝗶𝗮𝗯𝗹𝗲 TRM Labs ($70M Series C) Project Eleven ($20M Series A) Defense is becoming proactive, not reactive. We’re building Web3 Antivirus™ around that exact shift — real-time monitoring and protection for teams that want to scale safely. 𝟲/ 𝗖𝗿𝘆𝗽𝘁𝗼-𝗻𝗮𝘁𝗶𝘃𝗲 𝗽𝗿𝗼𝗱𝘂𝗰𝘁 𝗹𝗮𝘆𝗲𝗿𝘀 𝘀𝘁𝗶𝗹𝗹 𝗴𝗲𝘁𝘁𝗶𝗻𝗴 𝗰𝗮𝗽𝗶𝘁𝗮𝗹 ZBD ($40M Series C) Jupiter ($35M Strategic) Flying Tulip ($25.5M Series A) Opinion ($20M Pre-Series A) Micropayments, liquidity aggregation, DEX optimization, prediction markets. Speculation evolves, but infra wins first. Your thoughts?

It's my 11th year in Web3. I could monetize my network for a couple of million a year. Instead, I walk away from every founder who wants me to sell "the right introductions."   Here's why I refuse to work with businesses who want intros without the groundwork 👇:   A warm intro won't close a deal when the ask is disproportionate to what you've built. Every connector who opens a door to an investor, yield provider, or financial money institution is putting THEIR reputation on the line - not just yours.   If your ask isn't backed by product quality, team track record, or real traction, you'll churn the intro and burn the bridge. For yourself and for the connector.   People often confuse disproportionate access with the company size. But, believe it or not, size does not matter.   Here's what does:   1️⃣ Traction. As an emerging project, you have to get traction the hard way first. Before pursuing a partnership with a Tier-1 exchange, establish early credibility signals by first closing a regional platform. 2️⃣ Team's track record. Sometimes, the founders I consult are so early that they don't have the product traction yet. What they do have, though, is exceptional experience from the team members. Previous exits, affiliation with a large investment bank, fund, or asset manager. 3️⃣ Product-market-fit. Unlike the retail audience, institutions do not buy hype or a promise of a roadmap. They are looking for sovereign-grade, secure, compliant products that clearly solve their problems. 4️⃣ Team with TradFi experience. Your own employees must speak institutional language. Warm intros die fast when the team can’t carry the conversation or build rapport. 5️⃣ Respecting expertise of the person you hire. When I (or someone like me) gives you the playbook to succeed and goes on a limb for you by securing warm access, you should respect their know-how. If you disagree with their methods, you're welcome to pursue other paths, but don't hire a specialist and then ask them to validate your ideas.   If you're building a product bridging financial primitives on-chain and looking to sign your first institutional client (and ready to do the hard work), send me a message.

It took me some extra hours in late night, but here you go. I have simplified an Ideal GitHub Actions Flow for you. 👇 1) 🧭 Triggers: 🧲 GitHub Event fires → Can be a push, PR, manual dispatch, or a scheduled trigger. 📜 Workflow file executes → GitHub reads the YAML config and starts the pipeline. 🔁 Workflow Trigger hits the CI Phase → We now jump into the first main section: CI. 2) 🔧 CI Phase: 📋 Lint & Validate → Checks formatting and file syntax — like YAML, Dockerfiles, Terraform, etc. 🏗️ Build Artifacts → Your app gets compiled or packaged (Docker images, binaries, etc). 🧬 Unit Tests → Quick tests that verify individual components or logic. 🧪 Integration Tests → Validates if your services/modules interact correctly. 📊 Code Coverage → Checks how much of your code is covered by tests — helps improve test quality. 🔒 Security Scanning → Tools like CodeQL or Trivy catch vulnerabilities early. 3) 🧮 Matrix + CI Result Evaluation 🧮 Matrix Execution → Parallel jobs (across OS versions, Python/Node versions, etc). ✅ CI Results → Only proceed if everything passes — block if even one test fails. 4) 🚀 CD Phase (Continuous Deployment) 🚀 CD Phase starts → If CI is clean, we move toward releasing. 🧪 Deploy to Staging → Ship to a safe sandbox environment that mirrors production. 🔥 Smoke Tests in Staging → High-level sanity checks (e.g., “Does the login page load?”). 🛑 Approval Required → Human checkpoint — usually from senior engineer or release manager. ✅ Approval Granted → Deploy to Production → This is your official go-live moment. 🔍 Post-Deployment Tests → Sanity and health checks to ensure production is stable. 5) ♻️ Ops, Rollbacks, and Notifications 🔁 Rollback Plan (if needed) → If post-deploy tests fail, we roll back to the last good version. 📣 Notify Engineers → DevOps team gets pinged (Slack, Teams, PagerDuty, etc). 📡 Monitoring & Logging → Live dashboards, alerts, and logs keep watch over the system. 6) ✅ Final Status Updates 🟢 Update Status Badge → Those fancy CI badges on your README get updated. 📌 GitHub Repository Status reflects build/deploy result → Shows up directly on your pull request for reviewers. Get started with GitHub Actions Hands-on way: https://lnkd.in/gcReECUU Consider ♻️ reposting if you have found this useful. Cheers, Sandip Das

Want to understand agentic commerce? This is a breakdown of the emerging stack and who does what. 𝟭. 𝗙𝗼𝘂𝗻𝗱𝗮𝘁𝗶𝗼𝗻 𝗺𝗼𝗱𝗲𝗹𝘀 Models such as OpenAI, Anthropic, Meta, xAI provide the reasoning layer that allows agents to interpret instructions, plan actions and make decisions. Without this layer, there are no autonomous agents. 𝟮. 𝗜𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 Providers such as AWS, Google Cloud, Cloudflare, Akash supply the compute and networking needed to run models and agents continuously. This is the infrastructure layer of the agent economy. 𝟯. 𝗔𝗴𝗲𝗻𝘁 𝗳𝗿𝗮𝗺𝗲𝘄𝗼𝗿𝗸𝘀 Frameworks like MCP and A2A allow developers to build agents that can call APIs, access services and coordinate tasks. This layer enables models to operate as agents. 𝟰. 𝗔𝗴𝗲𝗻𝘁 𝗻𝗲𝘁𝘄𝗼𝗿𝗸𝘀 Protocols such as Virtuals Protocol, Bittensor or Heurist allow agents to collaborate and coordinate with other agents rather than operating individually. These networks provide shared environments where agents can exchange tasks and services. 𝟱. 𝗗𝗶𝘀𝗰𝗼𝘃𝗲𝗿𝘆 Before an agent can act, it must discover available services, APIs or resources. Tools like x402scan and Unicity Labs allow agents to discover APIs, services or payment endpoints across the ecosystem. 𝟲. 𝗜𝗱𝗲𝗻𝘁𝗶𝘁𝘆 & 𝘁𝗿𝘂𝘀𝘁 Agents must prove who they are and whether they can be trusted. Protocols such as ERC-8004, Cred Protocol, AgentProof provide identity and and verifiable credentials so agents can transact securely. 𝟳. 𝗙𝗮𝗰𝗶𝗹𝗶𝘁𝗮𝘁𝗼𝗿𝘀   Platforms like Stripe, Coinbase, Openx402, thirdweb connect agents to services, payments and workflows. They act as the execution layer that lets agents actually do things. 𝟴. 𝗪𝗮𝗹𝗹𝗲𝘁𝘀 & 𝗮𝗰𝗰𝗼𝘂𝗻𝘁 𝗶𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲 Solutions such as Privy, MetaMask, Fireblocks, Coinbase Wallet allow agents to hold assets, manage keys and sign transactions. Technologies like ERC-4337 simplify account management so agents can transact programmatically. 𝟵. 𝗣𝗮𝘆𝗺𝗲𝗻𝘁 𝗶𝗻𝗳𝗿𝗮𝘀𝘁𝗿𝘂𝗰𝘁𝘂𝗿𝗲  Infrastructure such as x402, Stripe, Visa, Crossmint, Moonpay enables automated payments and settlement. This is what allows agents to pay for services or receive payments automatically. 𝟭𝟬. 𝗕𝗹𝗼𝗰𝗸𝗰𝗵𝗮𝗶𝗻𝘀  Networks like Base, Solana, Polygon, Avalanche, Arbitrum provide the settlement and execution environment where transactions are recorded. 𝟭𝟭. 𝗦𝘁𝗮𝗯𝗹𝗲𝗰𝗼𝗶𝗻𝘀  Assets such as USDC and USDT provide programmable digital money that agents can move instantly across networks. For many agent transactions, stablecoins act as the settlement asset. 𝟭𝟮. 𝗨𝘀𝗲𝗿 𝗶𝗻𝘁𝗲𝗿𝗳𝗮𝗰𝗲𝘀  Interfaces such as ChatGPT, Claude or Gemini are becoming the entry point where humans interact with agents and delegate tasks. These interfaces increasingly act as the control layer for agent activity. Opinions: my own, Graphic source: Artemis Analytics   𝐒𝐮𝐛𝐬𝐜𝐫𝐢𝐛𝐞 𝐭𝐨 𝐦𝐲 𝐧𝐞𝐰𝐬𝐥𝐞𝐭𝐭𝐞𝐫: https://lnkd.in/dkqhnxdg