Back to Blog

Ten Most Frequently Asked Questions About BlockSec Phalcon

Phalcon
December 15, 2023

Our automated attack monitoring and blocking system, BlockSec Phalcon, has been released for one month. During this time, we've held demo sessions with dozens of project teams and LPs, and found that the pain points and needs of users are generally similar. They want a security solution that detects threats promptly, has a low false positive rate, features automatic response mechanisms, and offers highly customizable configuration options.

We've created a list of the top 10 BlockSec Phalcon-related inquiries from users. Check it out to see if there's anything you've been curious about. 👀

Question 1: How does BlockSec Phalcon operate technically?

Our system monitors every transaction and utilizes an AI-based risky transaction early detection algorithm to determine the risk level of each transaction, complemented by user-defined trigger rules. When a risky transaction matches these rules, a pre-set incident response strategy will be automatically triggered.

Question 2: Can you describe some of the incident response strategies that BlockSec Phalcon supports?

BlockSec Phalcon is primarily intended for two types of users: protocol teams and LPs, and we have established different incident response strategies for each.

  • For project teams, in case of an emergency, BlockSec Phalcon can automatically execute transactions to pause protocols and front-run attack transactions.
  • For LPs, the system enables the automatic withdrawal of assets before the protocol fails.

Question 3: Can I customize my own response strategy? For example, withdrawing assets first and then executing swap operations. Is this possible?

Yes, users have the flexibility to customize their response strategies.

However, more complex response strategies may require the deployment of a smart contract, which can automatically execute when trigger conditions are met. For simpler response strategies, the protocol's internal functions can be called directly.

Question 4: Writing smart contracts might be challenging for us...

No need to worry! If your response strategy is complex and requires deploying a smart contract, we can assist you with writing, deploying, and auditing the smart contract.

Question 5: You mentioned that BlockSec Phalcon supports pausing protocols automatically. What if the protocol uses a smart contract wallet?

If the protocol uses a smart contract multi-signature wallet like Safe{Wallet}, BlockSec Phalcon also provides a compatible solution to ensure the automatic execution of authorized operations.

Question 6: What is your system's false positive rate?

We pay particular attention to false positives since they not only disrupt project operations but also undermine intelligence credibility.

As mentioned previously, we classify each transaction into different risk levels. During the two years of operating BlockSec Phalcon internally, 99% of the high-risk transactions reported were real attacks, with the false positive rate at around 1%. To be honest, no system can guarantee 100% accuracy of its alerts. We have minimized the false positive rate to the lowest possible level.

Furthermore, if users combine risk levels with self-defined trigger rules, the system's false positive rate will be zero.

Question 7: You mentioned high-risk transactions several times. What do the different risk levels mean?

Our system can achieve millisecond-level transaction risk grading through an AI-based early detection algorithm. We classify transactions into low, medium, and high-risk levels based on the probability of them being an attack.

Question 8: I think your system is very impressive. But, if I need to add protocols for monitoring, do I have to contact you each time? It would be too much trouble!

Our system is very flexible. Users can add the protocols they want to monitor themselves by simply adding the protocol's smart contract to the system. Of course, our security experts are always available. If you need assistance, we can also help you with the setup.

Question 9: Great! Which chains does the system support?

Currently, we support multiple blockchains including ETH, BSC, and Arbitrum. We also plan to support new chains based on users' feedback.

Question 10: Got it! What about the pricing?

BlockSec Phalcon operates on a subscription basis. We invite you to schedule a demo to experience the powerful features of BlockSec Phalcon firsthand. We will also recommend the most suitable plan based on your specific needs.

How to Access the Service

Since the launch of BlockSec Phalcon in November, we have gradually opened access to the system. You can book a demo with us to learn more about the product.

Let BlockSec Phalcon build a defense line for your protocol. It doesn't require much work on the protocol side and would never bring in additional risk. It's just like a shield providing an additional layer of safety. Book a demo now!

About BlockSec Phalcon

BlockSec Phalcon is an attack monitoring and automated blocking platform launched by BlockSec, a leading Web3 security company. The platform is capable of accurately identifying attacks and automatically blocking them. BlockSec Phalcon aims to provide comprehensive post-launch security protection for Web3 projects, including continuous monitoring, attack blocking, and emergency response, safeguarding on-chain assets for protocol providers, LPs, and DAO organization participants.

To date, BlockSec Phalcon has successfully blocked over 20 hacker attacks, rescuing more than $14 million in assets. Even in the early customer stage, BlockSec Phalcon gained recognition and a grant from the top DeFi protocol Compound and established an attack-blocking platform for it.

Website: https://blocksec.com/phalcon

Twitter: @Phalcon_xyz

Telegram: https://t.me/BlockSecTeam

See More Success Stories of BlockSec Phalcon

Sign up for the latest updates
The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis
Security Insights

The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis

This BlockSec deep-dive analyzes the KelpDAO $290M rsETH cross-chain bridge exploit (April 18, 2026), attributed to the Lazarus Group, tracing a causal chain across three layers: how a single-point DVN dependency enabled the attack, how DeFi composability cascaded the damage through Aave V3 lending markets to freeze WETH liquidity exceeding $6.7B across Ethereum, Arbitrum, Base, Mantle, and Linea, and how the crisis forced decentralized governance to exercise centralized emergency powers. The article examines three parameters that shaped the cascade's severity (LTV, pool depth, and cross-chain deployment count) and provides an exclusive technical breakdown of Arbitrum Security Council's forced state transition, an atomic contract upgrade that moved 30,766 ETH without the holder's signature.

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026

This BlockSec weekly security report covers four attack incidents detected between April 13 and April 19, 2026, across multiple chains such as Ethereum, Unichain, Arbitrum, and NEAR, with total estimated losses of approximately $310M. The highlighted incident is the $290M KelpDAO rsETH bridge exploit, where an attacker poisoned the RPC infrastructure of the sole LayerZero DVN to fabricate a cross-chain message, triggering a cascading WETH freeze across five chains and an Arbitrum Security Council forced state transition that raises questions about the actual trust boundaries of decentralized systems. Other incidents include a $242K MMR proof forgery on Hyperbridge, a $1.5M signed integer abuse on Dango, and an $18.4M circular swap path exploit on Rhea Finance's Burrowland protocol.

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026

This BlockSec weekly security report covers four DeFi attack incidents detected between April 6 and April 12, 2026, across Linea, BNB Chain, Arbitrum, Optimism, Avalanche, and Base, with total estimated losses of approximately $928.6K. Notable incidents include a $517K approval-related exploit where a user mistakenly approved a permissionless SquidMulticall contract enabling arbitrary external calls, a $193K business logic flaw in the HB token's reward-settlement logic that allowed direct AMM reserve manipulation, a $165.6K exploit in Denaria's perpetual DEX caused by a rounding asymmetry compounded with an unsafe cast, and a $53K access control issue in XBITVault caused by an initialization-dependent check that failed open. The report provides detailed vulnerability analysis and attack transaction breakdowns for each incident.