Phalcon's 2023 Year-End Recap

Phalcon's 2023 Year-End Recap

In 2023, Web3 harbors not just aspirations for technological breakthroughs but also grapples with security challenges of unprecedented scale. The year also witnesses the transformation of Phalcon from a transaction explorer to a comprehensive security suite. Phalcon now covers the entire spectrum of protocol security, from pre-launch testing, post-launch monitoring and attack blocking, to post-incident analysis.

Through the story of Phalcon, let's explore the relentless efforts made by BlockSec to advance Web3 security in 2023.

Phalcon's Security Philosophy: Go Beyond Code Audits 🤔💡

Since the very foundation of BlockSec, our standpoint has remained consistent - code audits alone are inadequate to safeguard against the ever-present security risks in the Web3 dark forest (although we do a great job at code audits). Once a project is live, proactive defenses and swift response mechanisms become critical.

Traditional attack monitoring systems alert us to threats, yet teams are often too slow or uncertain about how to respond effectively. We began to question: How could we standardize our incident response capabilities to better assist a wider range of projects? This led to the creation of BlockSec Phalcon, a system designed to automatically block attacks.

In February of this year, when the Platypus protocol was under attack, BlockSec Phalcon helped recover $2.4 million in potential losses.

A month later, the system once again proved its worth by intercepting an attempt on Paraspace, saving an estimated $5 million. 🛡️💰

November marked a milestone with the introduction of BlockSec Phalcon at the Devconnect conference in Istanbul, a testament to our two years of dedicated refinement. The system stands out as the first Web3 security product with the ability to automatically block hacks.

Our Mission: Advancing Web3 Security 🚀

Time and again, we've been approached by project teams and users seeking assistance after hacks and phishing attempts, which solidified our determination to help elevate security awareness in the Web3 community.

This year, we participated in a series of events, including the DeFi Security Summit, TOKEN 2049, Devconnect, ETHBerlin, and ACM CCS. We shared insights on the susceptibility of Web3 to hacks, underscored the significance of proactive defense, discussed incident response strategies, and introduced practical security tools.

Additionally, we've initiated the 🏆 BlockSec Blockchain Security Award 🏆, a three-year scholarship to honor exceptional students at PolyU pursuing a Master's degree in blockchain technology. In doing so, we aim to assist the industry in cultivating a greater number of qualified security professionals and developers with robust security qualifications. 🎓

As a security company, we consider it our responsibility and vision to nurture talent and advance blockchain security, contributing to the industry's robust growth.

Looking Forward

As the new year unfolds, we are dedicated to the pursuit of innovation, with a focus on developing Phalcon into a more practical and well-rounded security product. We also commit to continually sharing our insights and vision for security with the wider Web3 community.

Happy New Year in advance! 🎉

May your Web3 journey in the new year be prosperous and smooth.

May the coming year bring you all health and happiness. 🥳

Sign up for the latest updates
Weekly Web3 Security Incident Roundup | Feb 9 – Feb 15, 2026

Weekly Web3 Security Incident Roundup | Feb 9 – Feb 15, 2026

During the week of February 9 to February 15, 2026, three blockchain security incidents were reported with total losses of ~$657K. All incidents occurred on the BNB Smart Chain and involved flawed business logic in DeFi token contracts. The primary causes included an unchecked balance withdrawal from an intermediary contract that allowed donation-based inflation of a liquidity addition targeted by a sandwich attack, a post-swap deflationary clawback that returned sold tokens to the caller while draining pool reserves to create a repeatable price-manipulation primitive, and a token transfer override that burned tokens directly from a Uniswap V2 pair's balance and force-synced reserves within the same transaction to artificially inflate the token price.

Top 10 "Awesome" Security Incidents in 2025

Top 10 "Awesome" Security Incidents in 2025

To help the community learn from what happened, BlockSec selected ten incidents that stood out most this year. These cases were chosen not only for the scale of loss, but also for the distinct techniques involved, the unexpected twists in execution, and the new or underexplored attack surfaces they revealed.

#10 Panoptic Incident: XOR Linearity Breaks the Position Fingerprint Scheme

#10 Panoptic Incident: XOR Linearity Breaks the Position Fingerprint Scheme

On August 29, 2025, Panoptic disclosed a Cantina bounty finding and confirmed that, with support from Cantina and Seal911, it executed a rescue operation on August 25 to secure roughly $400K in funds. The issue stemmed from a flaw in Panoptic’s position fingerprint calculation algorithm, which could have enabled incorrect position identification and downstream fund risk.