Back to Blog

封锁 Saddle Finance 攻击：行业首个有影响力阻断，拯救 380 万美元

May 19, 2022
3 min read

自 BlockSec 于 2021 年首次亮相以来，我们一直认为代码审计本身无法解决 Web3 安全问题。因此，我们一直在投入探索 Web3 安全的新范式。因此，我们创建了**Phalcon**，这是世界上第一个加密货币黑客拦截系统。

在 Phalcon 推出之前，该系统已在内部运行了 2 年，成功阻止了 20 多次黑客攻击，并挽救了价值超过 2000 万美元的资产，其中包括为 Saddle Finance 挽回的 380 万美元，为 Platypus 挽回的 240 万美元，为 ParaSpace 挽回的 500 万美元，以及更多。

在本系列文章中，我们将展示我们系统 Phalcon 的代表性成功案例。今天，让我们来看看行业首个挽回 380 万美元的重要拦截案例。

我们是如何阻止针对 Saddle Finance 的攻击的

2022 年 4 月 30 日，Saddle Finance 遭到攻击者攻击。总共有 4900 个以太坊面临风险。幸运的是，我们成功地保住了 1360 个以太坊，当时价值 380 万美元。

有关漏洞的根本原因分析以及发起攻击的方式可以在我们之前的报告中找到。

攻击者在每次尝试中都遵循了相同的模式。首先，他们创建了一个攻击合约，然后调用已部署合约的函数 0xaf8271f7 来发起攻击。总共有三次攻击尝试；第一次成功了，而第二次由于 gas 不足在区块 14684432 失败。因此，攻击者发起了第三次尝试。

当时，当第一次尝试溜走时，我们的系统还很稚嫩，但它已经准备就绪，正在等待第二次尝试。就在关键时刻，它发现了失败的交易，披上了超级英雄披风，并在区块 14684434 发送了一笔救援交易来阻止后续的尝试。就这样，攻击者的第三次尝试被挫败了，他们获得的赃物远远少于预期的。

救援交易的资金流（点击放大图像）
救援交易的资金流（点击放大图像）

虽然并不完美，但它无疑标志着一个里程碑，是行业首个主动抵御持续威胁的重要拦截行动。这一胜利增强了我们的信心，并激励我们追求更大的进步。这次经历，特别是其中的挫折，揭示了需要改进的领域，并指导我们完善我们的系统。别担心，一个更复杂、更强大的系统即将到来！

如何访问服务

  • Phalcon 是一个 SaaS 平台。您可以登录我们的网站来探索功能、查看定价并直接订阅。
  • 您还可以预约演示以了解更多关于 Phalcon 的信息并获得专家安全建议。

查看更多 Phalcon 的成功案例

关于 Phalcon

Phalcon 是 BlockSec 推出的攻击监控和自动化拦截平台。该平台能够准确识别攻击并自动进行拦截。Phalcon 旨在为 Web3 项目提供全面的上线后安全保护，包括持续监控、攻击拦截和应急响应，从而保护协议提供商、LP 和 DAO 组织参与者的链上资产。

迄今为止，Phalcon 已成功拦截了 20 多次黑客攻击，挽回了超过 2000 万美元的资产。即使在早期客户阶段，Phalcon 也获得了顶级 DeFi 协议 Compound 的认可和资助，并为其建立了一个攻击拦截平台。

网站：https://blocksec.com/phalcon

Twitter：@Phalcon_xyz

Telegram：https://t.me/BlockSecTeam

Sign up for the latest updates
The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis
Security Insights

The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis

This BlockSec deep-dive analyzes the KelpDAO $290M rsETH cross-chain bridge exploit (April 18, 2026), attributed to the Lazarus Group, tracing a causal chain across three layers: how a single-point DVN dependency enabled the attack, how DeFi composability cascaded the damage through Aave V3 lending markets to freeze WETH liquidity exceeding $6.7B across Ethereum, Arbitrum, Base, Mantle, and Linea, and how the crisis forced decentralized governance to exercise centralized emergency powers. The article examines three parameters that shaped the cascade's severity (LTV, pool depth, and cross-chain deployment count) and provides an exclusive technical breakdown of Arbitrum Security Council's forced state transition, an atomic contract upgrade that moved 30,766 ETH without the holder's signature.

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026

This BlockSec weekly security report covers four attack incidents detected between April 13 and April 19, 2026, across multiple chains such as Ethereum, Unichain, Arbitrum, and NEAR, with total estimated losses of approximately $310M. The highlighted incident is the $290M KelpDAO rsETH bridge exploit, where an attacker poisoned the RPC infrastructure of the sole LayerZero DVN to fabricate a cross-chain message, triggering a cascading WETH freeze across five chains and an Arbitrum Security Council forced state transition that raises questions about the actual trust boundaries of decentralized systems. Other incidents include a $242K MMR proof forgery on Hyperbridge, a $1.5M signed integer abuse on Dango, and an $18.4M circular swap path exploit on Rhea Finance's Burrowland protocol.

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026

This BlockSec weekly security report covers four DeFi attack incidents detected between April 6 and April 12, 2026, across Linea, BNB Chain, Arbitrum, Optimism, Avalanche, and Base, with total estimated losses of approximately $928.6K. Notable incidents include a $517K approval-related exploit where a user mistakenly approved a permissionless SquidMulticall contract enabling arbitrary external calls, a $193K business logic flaw in the HB token's reward-settlement logic that allowed direct AMM reserve manipulation, a $165.6K exploit in Denaria's perpetual DEX caused by a rounding asymmetry compounded with an unsafe cast, and a $53K access control issue in XBITVault caused by an initialization-dependent check that failed open. The report provides detailed vulnerability analysis and attack transaction breakdowns for each incident.