Welcome to my homepage!

Weilin (William) Li
[Github] [Twitter] [Linkedin] [Google Scholar]
Email: hklst4r (at) gmail (dot) com
weilin (dot) li (dot) 24 (at) ucl (dot) ac (dot) uk
Last Update: Mar 17, 2026

Abstract

I am a CS PhD student of University College London (UCL), and I'm honored to be supervised by Prof. Jiahua Xu. I received my Bachelor's degree at the University of Science and technology of China (USTC).

My research interests primarily focus on blockchain technology and Decentralized Finance (DeFi). I've been actively engaged in the DeFi ecosystem since 2021. I continuously explore and implement highly profitable trading strategies (Ref. Highly Profitable Trading Strategy). I sometimes publish major Web3 analysis on my twitter @hklst4r.

I used to be a CTF player in Blockchain. I was the team captain of NEBULA, which achieved an annual global ranking of 137th (top 0.33% globally) on CTFtime (Summer 2022-Summer 2023).

Publications

Education

Experiences

Teaching

Selected Talks

2026

2023

Bug Bounties

I have submitted several bug reports for various projects. Below listed some of them that are released to public.

  • Impermax Finance Exploit, there was a rounding issue in Impermax Finance's liquidation mechanism causing an attacker to steal ~$500K. I helped the team analyze and reconstruct the attack, preventing potential future losses.
  • USDX Bad Debt on Lista , there was a rugpull on $USDX and a risk curator on Lista has 5M exposure to this asset. I managed to rescue around $400K for friends of mine during this crisis. Credits: 1 , 2
  • Arcadia Finance (20M TVL when the hack happened), there was an approval-related attack. I successfully performed whitehat rescues within hours of the original attacker, and helped the team preventing millions of potential losses.
  • Sumer.Money Lending (over $100M TVL as of May 2025), LP token price manipulation leads to drain of the market.
  • A top-tier launchpad (undisclosed), unprotected API endpoint allowing arbitrary admin private key signing. (Web2)
  • Tokenlon, flaw in token design leads to continous arbitrage opportunities.
  • Huckleberry Lending, interest-bearing token borrowing leads to drain of the market.
  • ...

    • Highly Profitable Trading Strategy

    This term draws inspiration from Avraham Eisenberg, a self-proclaimed "Applied Game Theorist" who famously netted $115 million by manipulating a token's price. I use it to describe lucrative, low-risk trading opportunities I've successfully identified and leveraged. (To be clear, these are not attacks or exploits.)

  • Mar 2026: $USR depeg when an attacker minted $80M unbacked USR. After identifying the collateral of USR is not affected and that depegging to $0.05 is caused by panic sell, I bought USR at the dip. See my blog (Chinese, English) for more details.
  • Mar 2026: I managed to profit $15K when an attacker tries to perform a Mango Market-style attack on the Venus $THE market, See my blog (Chinese, English) for more details.
  • Jan 2026: $DUSD Depegging (Hack) After a hacker exploited the $DUSD Curve AMM pool, I quickly discovered that only Curve AMM liquidity providers are affected and $DUSD is still fully backed by its collateral. With this understanding, I managed to purchase $DUSD at a discount, earning a decent percent of profit.
  • Nov 2025: Balancer Hack, I managed to short $BERA, the governance token of berachain during the Balancer hack incident. The largest DEX on berachain is BEX, a Balancer fork, who was exploited for ~12M and the chain paused. This led to $BERA's price drop.
  • July 2025, I built an option arbitrage bot that discovered the price difference on a decentralized option market and Polymarket. This resulted in a risk-free, astonishing 320% monthly return. (Where the protocol fixed this pricing in the next month).
  • Feb 2025: Eggs Protocol, By purchasing the EGGS token within 5 blocks of creation, I made a profit of 5x.
  • October 2024: Radiant Protocol Incident, Following a hack that drained 2/3 of the protocol's Total Value Locked (TVL), I capitalized on the ensuing panic by establishing a strategic short position on the governance token.
  • January 2024: MIM Depegging Event, I seized the opportunity to purchase MIM at a discount, effectively rebalancing my position on the Abracadabra platform.
  • March 2023: USDC Depegging Crisis, During this event, I used AAVE to create a DAI (long)/ USDT (short) position. Despite DAI's initial depeg alongside USDC due to the Peg Stability Module (PSM) allowing 1:1 USDC to DAI swaps, I recognized that Maker DAO's substantial reserve fund could potentially cover bad debt and stabilize DAI even if USDC's value plummeted to zero.
  • May 2022: Luna/UST Death Spiral, I managed to short $LUNA when $UST starts to depeg.
  • ...