The Light in the Code: Alex Babits’ Journey Through Web3 Security

Not every security researcher begins with a clear path. Some arrive from unexpected places, drawn by a stubborn curiosity and the thrill of understanding systems from the inside out.

Alex belongs to this second category — the kind of person who doesn’t chase the spotlight, yet quietly builds a foundation strong enough that others can’t help but notice.

Meet Alex Babits — one of the most steadily rising researchers in the Web3 security space.

On HackenProof, he currently holds rank #12 on HackenProof, built on 2578 reputation, 41 paid reports, and 4 achievements — numbers earned not by shortcuts, but by consistency and depth of thinking.

And like many of the best stories in this field, his begins not with confidence, but with curiosity — the kind that slowly grows into mastery.

Introduction

When you first meet Alex Babits, you don’t get the typical hacker origin story. He didn’t come from a computer science background or follow a traditional security path.

Instead, he graduated as a mechanical engineer — only to realize that the world of machines wasn’t the one he wanted to build in.

What truly captured his attention was something far more abstract — how smart contracts work, and how code shapes entire ecosystems. That single discovery became his entry point into the Web3 security world, and he hasn’t stopped exploring it since.

Today, Alex focuses on the most intricate corners of Web3 — cryptography, on-chain privacy, and experimental protocols. He thrives in the strange and novel: the kind of projects that push both logic and creativity to their limits. Whether it’s Move, Solidity, or niche languages like Circom and Noir, he seeks out the challenges most would avoid.

Driven by a quiet curiosity and an unshakable work ethic, Alex has become one of those rare researchers who find beauty in complexity — and light in the darkest parts of code.

Origins: Before the First Hack

For Alex, everything began with a single concept — the smart contract. That idea unlocked a new world where logic, security, and creativity intertwined. Curious to understand how it all worked, he dove into hands-on challenges like Ethernaut and Damn Vulnerable DeFi, learning through breaking and rebuilding.

Content creators also played a surprising role. Alex recalls watching @smartcontractprogrammer and @Johnnytime — their CTF walk-throughs and conceptual breakdowns helped him frame problems more clearly and build intuition for vulnerabilities he would later find in the wild.

Without a computer science background, Alex had to grind through every concept slowly — but that patience became his edge. He calls himself “slow to start”, yet once he gains momentum, he keeps up with the best. Those early experiments and late-night coding sessions set the tone for a career built on discipline, curiosity, and persistence.

The Turning Point: Discipline, Flow, and Freedom

As Alex’s skills matured, he learned that progress in security research has less to do with talent and more with discipline. Setting daily work hours became his quiet contract with himself — a way to stay consistent when excitement faded. What kept him moving forward wasn’t external reward, but the inner tension between frustration and discovery.

He started to see hacking as a reflection of self-mastery: learning to stay calm amid complexity, to think clearly when things seem impossible. This mindset — patient, introspective, and quietly relentless — became a core part of who he was.

One quote that deeply resonates with Alex captures this philosophy perfectly:

“Humans are like balloons tethered to the bottom of the ocean by all of our negative qualities. No matter how hard you struggle you will never reach the surface. However, if you cut the chains that bind you, you’ll just naturally float.”
— John McAfee

For Alex, these words reflect the process of hacking itself — not a constant struggle against the system, but a gradual release of what holds you back until the path forward becomes clear.

Breaking Through: The CircuitDAO Discovery

The real breakthrough came during a CircuitDAO audit. While reviewing their auction logic, Alex spotted an overlooked timing flaw — a bug that allowed bids to be placed in the past and instantly settled for far less than intended. It was almost a solo finding, and that made it special.

That moment turned slow progress into real momentum. It proved that his patience and persistence weren’t just habits — they were strengths. From then on, Alex approached every contest and audit with sharper focus, confident that breakthroughs come not from luck, but from showing up every day and doing the work.

Evolving as a Researcher

As Alex gained experience, his approach to research became more deliberate and personal. He built his own auditing checklist — though he jokes he’s never actually used it — and developed a workflow rooted in precision and clarity. Before diving into any codebase, he reformats it, adds spacing, and deletes unnecessary comments until everything feels structured and readable.

His process might seem slow, but it’s intentional. He relies on manual tracing to validate findings, exploring every function line by line. Over time, this habit has shaped his strength as a researcher — patient, analytical, and unwilling to skip steps.

Even as AI tools enter the scene, Alex keeps his work deeply human: methodical thinking first, automation second.

What It Takes to Keep Going

Alex’s journey wasn’t defined only by wins. In fact, some of the hardest moments came early on — moments that nearly pushed him away from the field altogether.

He recalls his first C4 contest, where no vulnerabilities were found and the entire prize pool was redirected to QA reports. Newcomers were encouraged to submit QA, so he did — but his didn’t qualify for any payout.

He describes that moment plainly: it was depressing. That prize would have been a huge boost, and instead he walked away empty-handed.

But he kept going. And that persistence shaped his philosophy today.

In Alex’s view, mastery in Web3 security isn’t about knowing everything — it’s about knowing what matters. He lives by a simple rule: go deep or go home. The best lessons, he says, come not from tutorials but from real battles with unfamiliar codebases.

His advice to newcomers is straightforward: “Just jump into things and build stuff.” Don’t wait until you feel ready — dive in, struggle, fail, and learn fast.

He also encourages beginners not to overlook smaller contests:

Smaller prize pools attract fewer researchers, which means higher chances of placing well — and getting your name out there.
Critical-only payouts also tend to have less competition.

It’s practical, honest advice from someone who has climbed the ladder step by step.

And above all:

“Never learn anything extraneous unless you enjoy the act of learning itself.”

That discipline — to ignore noise and follow genuine curiosity — is what turned slow beginnings into steady, meaningful growth.

Community, Light, and What Comes Next

For Alex, community is the real engine of progress in Web3 security. He sees the best researchers as those who combine sharp skills with curiosity, honesty, and humor. In his words, “Good memes, truth-seeking conversations, and passion for clever attacks” are what make the ecosystem thrive.

His ambitions reach far beyond competitions. Alex is working toward becoming a Lead Security Researcher at a top-tier firm — one that experiments with cryptography, on-chain privacy, and emerging technologies. He’s also eager to build his own privacy-focused tools and contribute to shaping a safer, more transparent Web3.

One verse he often recalls captures both his mindset and his mission:

“And the light shineth in darkness; and the darkness comprehended it not.”
— John 1:5

This verse mirrors what hacking truly is — finding light where others see only obscurity.

Closing Note

If Alex’s journey resonated with you, we also invite you to explore the story of another remarkable researcher — Zakaria (former MrOwl), whose path proves that determination and resourcefulness can take you further than perfect conditions ever will.

And if you’re ready to apply some of these insights yourself, don’t miss our currently active bug bounty programs — a great place to start building your own track record in Web3 security.