VINCENZO IOZZO▊
One of the best iPhone-exploit writers of his generation — the man who, with a partner, popped a fully patched iPhone at Pwn2Own with the first public return-oriented-programming attack on an ARM chip, then went on to Trail of Bits, CrowdStrike, and the Black Hat review board. In February 2026 DEF CON banned him for life, not for anything he was charged with or convicted of, but because his name appears in the DOJ’s Epstein files and a decade-old email from Joi Ito introduced the two men. He is accused of no crime. His spokesperson calls the ban “entirely performative.” This one is a fight about guilt by association, and both sides get the microphone.
I never observed nor participated in any illegal activity or behavior. I regret the past association and take full responsibility for not exercising greater judgment at the time.
Vincenzo Iozzo, on-record statement — The Register, Feb 19, 2026. His own site: vincenzoiozzo.com
- WHO
- Vincenzo Iozzo — Italian security researcher; two-time Pwn2Own winner; co-founder & CEO of SlashID FACT
- RECORD
- Pwn2Own iPhone (2010) & BlackBerry (2011); co-founder / Director of Security Engineering, Trail of Bits; Senior Director, CrowdStrike (post-2017 acquisition); Black Hat Review Board; co-author, iOS Hacker’s Handbook FACT
- THE DRAMA
- Named in the Jan 2026 DOJ Epstein release; per reporting, introduced to Epstein by a May 2014 Ito email; permanently banned by DEF CON, Feb 2026 (see Joi Ito, Pablos Holman, DEF CON) ATTRIBUTED
- DISPOSITION
- No criminal charge. No conviction. DEF CON does not accuse him of criminal wrongdoing. He denies any wrongdoing; his spokesperson calls the ban “entirely performative” FACT
- STATUS
- BANNED, DENIES WRONGDOING — still shipping product as a working security founder
This file is not an accusation. Iozzo is charged with nothing, convicted of nothing, and the conference that banned him says in the same breath that it is not accusing him of a crime. What is documented is narrow and real: his name is in the files, an email exists, and a private conference drew a line. What is disputed is what any of that should mean. The through-line here is the oldest problem in a scandal — the distance between appearing in someone else’s paperwork and doing something wrong — and a man with a genuine, decorated research career standing on the far side of it, saying so.
the drama timeline
ACT I — THE EXPLOIT MERCHANT (2009–2018)
Before any of the drama, there is the work — and the work is real. This is a first-rank offensive researcher, on the record, for a decade.
-
MAR 2010
The iPhone falls
At Pwn2Own, Iozzo and Ralf-Philipp Weinmann compromise a fully patched iPhone 3GS through Safari, demonstrating the first public return-oriented-programming exploit on an ARM processor and exfiltrating the SMS database. It is one of the marquee results of the contest’s history. He repeats the feat on BlackBerry in 2011.
-
2012–2017
Poacher to firm-builder
Iozzo co-authors the iOS Hacker’s Handbook (Wiley, 2012), co-founds and serves as Director of Security Engineering at Trail of Bits, and joins the Black Hat Review Board — the committee that vets what gets on stage at the industry’s largest conference. His own company is later acquired by CrowdStrike, where he becomes a Senior Director.
ACT II — THE INTRODUCTION (2014–2018)
Here is the whole of the thing DEF CON would later act on: an email he did not send, an introduction he did not seek, and business that, by his account, went nowhere.
-
MAY 2014
“One of the best network security guys I know”
Per the 2026 reporting, Joi Ito introduces Iozzo to Epstein in a May 2014 email, describing him as “one of the best network security guys I know” and proposing a business connection. The record is the email traffic; the introduction is Ito’s, made about Iozzo rather than by him. (See the Joi Ito file — the convener trait, exercised on the wrong contact.)
-
2014–2018
Business that never materialized
Per TechCrunch, Iozzo “interacted with Epstein between 2014 and 2018,” and the two appear together in several of the emails. Iozzo has characterized those interactions as “limited to business opportunities that never materialized, as well as discussion of the markets and emerging technologies,” and was, in the period, a research affiliate at the MIT Media Lab that Ito ran.
ACT III — THE FILES AND THE BAN (2026)
Twelve years later the files open, and a private conference does the one thing a private conference can do: it closes the door. Iozzo says the door was barely one he used.
-
JAN 30, 2026
Three million files
The Department of Justice releases roughly three million Epstein-investigation files. Among the disclosures is email traffic tying Ito, Pablos Holman, and Iozzo to Epstein, and reporting on Epstein’s interest in the major hacker conferences.
-
FEB 18, 2026
DEF CON bans three
DEF CON permanently bans Ito, Holman, and Iozzo, citing their appearance in the DOJ files and prior reporting. The conference frames the action as a response to documented contact; the men are not accused of any criminal wrongdoing. DEF CON declined to comment to TechCrunch beyond its statement. Iozzo remains uncharged.
-
FEB 18–19, 2026
“Entirely performative”
Iozzo’s spokesperson, Joan Vollero, responds on the record: “DEF CON’s actions are entirely performative, given that Mr Iozzo has barely attended the conference in the past twenty years. It was a rush to judgment not based on any investigation or wrongdoing by Mr Iozzo,” adding that he “did not provide exclusive access to DEF CON or any other conference” and “has no idea if Epstein ever actually attended any conference.” Iozzo himself: he “never observed nor participated in any illegal activity or behavior,” while regretting “the past association.”
both sides, on the record
What the reporting establishes: Iozzo’s name appears in the DOJ’s Epstein file release, and he interacted with Epstein between 2014 and 2018; the two appear together in several of the emails, and a May 2014 email from Joi Ito introduced them [1] [2].
The sanction: DEF CON, a private conference, weighed that documented contact and permanently banned him alongside Ito and Holman — a private organization’s judgment about who it wants in its rooms [1] [2].
His own regret: Iozzo himself says he regrets the past association and takes responsibility for “not exercising greater judgment at the time” — his words, not ours [2].
He denies any wrongdoing, flatly. Iozzo states he “never observed nor participated in any illegal activity or behavior.” He is charged with no crime, convicted of nothing, and DEF CON itself does not accuse him of criminal wrongdoing — the ban rests on contact, not conduct [1] [2].
The ban is “entirely performative.” His spokesperson calls it “a rush to judgment not based on any investigation or wrongdoing,” notes he has “barely attended the conference in the past twenty years,” provided no one “exclusive access,” and has “no idea if Epstein ever actually attended any conference” — i.e., the punishment is a gesture aimed at a man who was scarcely there [2].
The introduction was not his. The 2014 email that connects the two men was written by Ito, about Iozzo, to Epstein; being the subject of another person’s introduction is not an act, and his own account of the ensuing contact is “business opportunities that never materialized” [1].
The career is real and undisputed. None of this is contested: two Pwn2Own wins, Trail of Bits, CrowdStrike, the Black Hat Review Board, a standard reference text. He remains a working security founder, not a defendant [3].
YOU DECIDE
Scoped to the claims, never the man. Two things are settled and narrow: Iozzo’s name is in the DOJ files and he had documented contact with Epstein from 2014 to 2018, and a private conference banned him for it. Everything past that is where he stands his ground — and the exculpatory facts are strong. He is charged with nothing. He is convicted of nothing. DEF CON does not accuse him of a crime. The email that ties him in was written by someone else, about him. He denies any wrongdoing outright, and his spokesperson calls the ban “entirely performative… a rush to judgment not based on any investigation or wrongdoing.”
Weigh it honestly. A conference is entitled to decide who sits in its rooms; a man is entitled to point out that appearing in another person’s paperwork is not the same as doing anything wrong. Both of those can be true at once, and here they are.
The archive does not judge. The archive keeps the email, the ban notice, and the denial — and lets you read all three.
evidence locker
THE 2026 BAN — PRIMARY REPORTING
The Register — “DEF CON bans three Epstein-linked men from future events” (Feb 19, 2026) FACT — the full Vollero statement (“entirely performative… a rush to judgment not based on any investigation or wrongdoing”); Iozzo’s own denial (“never observed nor participated in any illegal activity or behavior”); “contact, not wrongdoing” framing.
theregister.com/2026/02/19/def_con_epstein_bans/
CAREER RECORD — STATED AS FACT
Wikipedia — Pwn2Own ATTRIBUTED — the 2010 iPhone / first-public-ARM-ROP result (Iozzo & Weinmann) and the contest record.
en.wikipedia.org/wiki/Pwn2Own
SUBJECT’S OWN CHANNEL — THE SPECIMEN, UNEDITED
vincenzoiozzo.com SELF-PUBLISHED — his own site: CEO/co-founder of SlashID; former Director of Security Engineering at Trail of Bits; former Senior Director at CrowdStrike; two-time Pwn2Own winner; Black Hat Review Board member. His words, his venue.
vincenzoiozzo.com
CONTEXT & CROSS-LINKS
The standard. Everything above is sourced to contemporaneous reporting, the subject’s own on-record statements, and his own site. His security-research career is stated as fact, because it is one. The Epstein contact and the 2014 introduction are stated as the reporting’s and wear their source; the introduction was another person’s act, made about the subject. The defense is presented at full strength — his flat denial of any illegal activity, the absence of any criminal charge or conviction, DEF CON’s own “contact, not wrongdoing” scope, and his spokesperson’s “entirely performative… rush to judgment” statement. No motive is asserted, no private character diagnosed, no crime alleged. The burden of proof is on us, not the subject. If a line here couldn’t survive a defamation challenge, it wouldn’t be on this page.