Marc Stevens
Dutch cryptanalyst who turned MD5 and SHA-1 collisions from theory into working attacks.
At CWI in Amsterdam, Stevens developed chosen-prefix collisions for MD5. In 2008 the technique, plus a cluster of PlayStation 3 consoles, produced a forged but valid certificate authority certificate. In 2012 his analysis showed that the Flame espionage malware had used its own, previously unknown variant of the same attack.
In 2017 he and Google released SHAttered, the first public SHA-1 collision. His collision-detection library is used by Git, among others, to catch tampered objects.