Banco Galicia's Live Hacking Event at ekoparty 2026

I spent a couple of days hacking a bank with YesWeHack. I can't tell you the bugs, but I can tell you how it went and what I hunted them with.

In October I was at ekoparty, in Buenos Aires. There were two Live Hacking Events that week: one at Meta's offices and one with Banco Galicia and YesWeHack. I want to talk about the second one.

If you've never seen one: they put you in a room with a bunch of good hunters, hand you real targets, and start the clock. Two and a half days. No time for theory, no room for excuses. You find things or you don't.

It went well. I sent over 80 reports, 17 were rewarded, I finished fourth, and I took home the "Full Spectrum" award. That's the one I liked most: you don't get it for one lucky find, you get it for covering a lot of different vulnerability classes. I wrote about it on LinkedIn too.

What I found, I won't tell you. It's under coordinated disclosure between YesWeHack, the bank and me, and that's where it stays. Same discretion I give any client's work.

What I can tell you is what I hunted with. A while back I built a system of my own, DS-AI. It doesn't replace experience; it takes the boring part off my hands. The recon, the repetitive checks, going over the whole surface again and again. The machine handles that, and I'm free for the part that matters: grabbing a thread and pulling until it hurts.

Seen that way, the "Full Spectrum" makes sense. When you don't have to remember to check every corner by hand, you check all of them.

And that, in the end, is what I offer. Not a once-a-year snapshot, but someone watching your systems all the time, with the same head you bring to an event like this. If you want to see it from the organizers' side, YesWeHack wrote it up here.