Back to Blog

Lead in: Phalcon's Hack Blocking Saga

April 23, 2024
3 min read

Since BlockSec's debut in 2021, we have long maintained that code auditing alone cannot solve all Web3 security issues. Therefore, we have been investing in exploring new paradigms for Web3 security. Thus we created Phalcon, the world's first crypto hack-blocking system.

Before the launch of Phalcon, the system had been running internally for 2 years, successfully blocking over 20 hacks, and rescuing more than 20 million USD worth of assets, including $3.8M for Saddle Finance, $2.4M for Platypus, $5M for ParaSpace, and more.

In this series of articles, we will present representative stories of our system Phalcon. In sharing these cases, we aim to do more than validate the effectiveness of our system. We also want to demonstrate the transformative effect of proactive defense measures.

In the face of threats, we are not powerless. Together, we can usher in a new era of Web3 security.

Breaking Down: A Comprehensive Overview

About Phalcon

Phalcon is a security platform developed by BlockSec to monitor and block hacks. The system detects suspicious transactions, instantly alerts users, and takes automated actions in response.

Use cases of Phalcon
Use cases of Phalcon

Phalcon is a SaaS platform where users can directly log in through our official website to view different pricing plans and features, and subscribe immediately (supporting both credit card and crypto payments). For any questions, feel free to book a demo with our security experts who will address your concerns.

Support Tool: Phalcon Explorer

Phalcon Explorer is a support tool for the Phalcon platform. This powerful transaction explorer is designed for the DeFi community. It provides comprehensive data on call flows, balance changes, and transaction fund flows, as well as supports transaction simulation. This helps developers, security researchers, and traders to more intuitively understand transactions.

Sign up for the latest updates
Web3 Attack Surfaces: A Penetration Testing Overview
Security Services

Web3 Attack Surfaces: A Penetration Testing Overview

Crypto institutions keep every traditional attack surface and add the money-handling chain on top of it. This article gives testers a practical abstraction of the running system: a four-component model—Application, Authorization and Signing, Blockchain Interaction, and Infrastructure—with each component's responsibility, representative implementations, and inherited attack surfaces. It then structures web3-specific coverage into five attack-surface areas, from production and automation operations through signing intent, approval and withdrawal chains, and fund logic to on-chain transactions and deployed contracts.

~$23M Lost: Cosmos EVM, Moonwell Exploits | BlockSec Weekly
Security Insights

~$23M Lost: Cosmos EVM, Moonwell Exploits | BlockSec Weekly

During the reporting period (2026/08/22 - 2026/08/30), we cover 5 blockchain security incidents totaling approximately $22.7M in losses; an estimated $74M-$119.5M was drained from Tectonic, most of it erased when Cronos was rolled back to its pre-exploit state. The highlight is a six-chain Cosmos EVM exploit series (~$5.7M realized), traced on TAC Chain, where a shared balance-synchronization bug chained an underflow and an overflow to drain a staking pool. The report also analyzes Moonwell's combined collateral-accounting and oracle price manipulation, Tectonic's combined oracle-price and receipt-token exchange-rate manipulation of low-liquidity collateral, an Ajna liquidation business-logic flaw, and a Rain Card Contract Exploit Series with an Ed25519 signature-verification bypass (Avici, Tria, and others) on Solana.

Rules of Engagement and Production Safety for Institutional Blockchain Penetration Testing
Security Services

Rules of Engagement and Production Safety for Institutional Blockchain Penetration Testing

A penetration test that touches signing, withdrawal, and ledger systems is prepared before it runs. This article follows the engagement lifecycle: turning a business decision into objective, scope, named owners, and authorized access; recording authority, permitted techniques, operating limits, prohibited activity, communications, and evidence handling in a Rules of Engagement document; and protecting live service with measurable stop criteria, monitoring, change coordination, and named pause authority. It closes with the remediation and retest that turn findings into validated controls.

Lead in: Phalcon's Hack Blocking Saga