Back to Blog

Lead in: Phalcon's Hack Blocking Saga

April 23, 2024
3 min read

Since BlockSec's debut in 2021, we have long maintained that code auditing alone cannot solve all Web3 security issues. Therefore, we have been investing in exploring new paradigms for Web3 security. Thus we created Phalcon, the world's first crypto hack-blocking system.

Before the launch of Phalcon, the system had been running internally for 2 years, successfully blocking over 20 hacks, and rescuing more than 20 million USD worth of assets, including $3.8M for Saddle Finance, $2.4M for Platypus, $5M for ParaSpace, and more.

In this series of articles, we will present representative stories of our system Phalcon. In sharing these cases, we aim to do more than validate the effectiveness of our system. We also want to demonstrate the transformative effect of proactive defense measures.

In the face of threats, we are not powerless. Together, we can usher in a new era of Web3 security.

Breaking Down: A Comprehensive Overview

About Phalcon

Phalcon is a security platform developed by BlockSec to monitor and block hacks. The system detects suspicious transactions, instantly alerts users, and takes automated actions in response.

Use cases of Phalcon
Use cases of Phalcon

Phalcon is a SaaS platform where users can directly log in through our official website to view different pricing plans and features, and subscribe immediately (supporting both credit card and crypto payments). For any questions, feel free to book a demo with our security experts who will address your concerns.

Support Tool: Phalcon Explorer

Phalcon Explorer is a support tool for the Phalcon platform. This powerful transaction explorer is designed for the DeFi community. It provides comprehensive data on call flows, balance changes, and transaction fund flows, as well as supports transaction simulation. This helps developers, security researchers, and traders to more intuitively understand transactions.

Sign up for the latest updates
~$4.72M Lost: TAC, Transit Finance & More | BlockSec Weekly
Security Insights

~$4.72M Lost: TAC, Transit Finance & More | BlockSec Weekly

This BlockSec weekly security report covers 3 notable attack incidents identified between May 11 and May 17, 2026, across TRON, TON, and Ethereum, with total estimated losses of approximately $4.72M. Three incidents are analyzed in detail: the highlighted $1.88M Transit Finance exploit on TRON, where a deprecated swap bridge contract with lingering token approvals was exploited through arbitrary calldata forwarding; the $2.8M TAC TON-to-EVM bridge exploit caused by missing canonical wallet verification in the jetton deposit flow; and the $46.75K Boost Hook exploit on Ethereum, where spot price manipulation on a Uniswap V4 hook-based perpetual protocol forced the protocol to buy tokens at inflated prices using its own reserves.

~$15.9M Lost: Trusted Volumes, Wasabi & More | BlockSec Weekly
Security Insights

~$15.9M Lost: Trusted Volumes, Wasabi & More | BlockSec Weekly

This BlockSec bi-weekly security report covers 11 notable attack incidents identified between April 27 and May 10, 2026, across Sui, Ethereum, BNB Chain, Base, Blast, and Berachain, with total estimated losses of approximately $15.9M. Three incidents are analyzed in detail: the highlighted $1.14M Aftermath Finance exploit on Sui, where a signed/unsigned semantic mismatch in the builder-fee validation allowed an attacker to inject a negative fee that was converted into positive collateral during settlement; the $5.87M Trusted Volumes RFQ authorization mismatch on Ethereum; and the $5.7M Wasabi Protocol infrastructure-to-contract-control compromise across multiple EVM chains.

Newsletter - April 2026
Security Insights

Newsletter - April 2026

In April 2026, the DeFi ecosystem experienced three major security incidents. KelpDAO lost ~$290M due to an insecure 1-of-1 DVN bridge configuration exploited via RPC infrastructure compromise, Drift Protocol suffered ~$285M from a multisig governance takeover leveraging Solana's durable nonce mechanism, and Rhea Finance incurred ~$18.4M following a business logic flaw in its margin-trading module that allowed circular swap path manipulatio