His father is a sales consultant and his mother is a historian and a former high school social studies teacher. Hoffman created StripeSnoop, an application which analyzes data on magnetic stripes. He also created tinyDisk, a file system that runs on top of tinyURL.

He first became famous when, as a student at Georgia Tech, he discovered a security flaw in the campus magnetic ID card system called "BuzzCard." He gave a talk about the security flaw at the Atlanta hacker conference "Interz0ne" in Fall 2002.

At Interz0ne2 in April 2003 he attempted to give an updated version of the talk with Virgil Griffith, a student from the University of Alabama, but he and Griffith were served with a cease and desist letter a few hours before giving the presentation, and then within two days this was followed up by a lawsuit from Blackboard Inc, alleging that Griffith and Hoffman had violated the DMCA, the Espionage and Sedition Act, and that they had stolen trade secrets. The lawsuit was eventually settled.

In 2005, Hoffman graduated from Georgia Tech, with a degree in computer science. He has given talks on multiple subjects at such conferences as Interz0ne, Outerz0ne, Toorcon, Black Hat Federal, PhreakNIC, FooCamp, O'Reilly Media Emerging Technology Conference, and ShmooCon. He was also invited to speak at the FBI.

Hoffman is the author of the book Ajax Security, published in December 2007 by Addison Wesley

Hoffman worked as a security researcher for Atlanta start-up SPI Dynamics Inc, and then for Hewlett-Packard, which purchased SPI Dynamics on 01 August 2007 . He now works as a web performance consultant at Zoompf.