Back to Blog

Phalcon 2023 年度回顾

January 1, 2024

2023年,Web3不仅承载着技术突破的愿景,也面临着前所未有的安全挑战。在这一年里,Phalcon也从一个交易浏览器蜕变为一个全面的安全套件。Phalcon现已覆盖协议安全的整个链条,从上线前测试、上线后监控和攻击阻断,到事后分析。

通过Phalcon的故事,让我们一起回顾BlockSec在2023年为推进Web3安全所做的持续不懈的努力。

Phalcon 的安全理念:超越代码审计 🤔💡

自BlockSec成立以来,我们的立场一直坚定不移——单凭代码审计不足以应对Web3黑暗森林中无处不在的安全风险(尽管我们在代码审计方面做得非常出色)。一旦项目上线,主动防御和快速响应机制就变得至关重要。

传统的攻击监控系统会向我们发出威胁警报,但项目团队往往反应迟缓或不确定如何有效应对。我们开始思考:如何才能标准化我们的事件响应能力,以便更好地协助更广泛的项目? 这催生了BlockSec Phalcon的诞生,一个旨在自动阻止攻击的系统。

今年2月,当Platypus协议遭受攻击时,BlockSec Phalcon帮助挽回了240万美元的潜在损失。

一个月后,该系统再次证明了其价值,成功拦截了针对Paraspace的攻击,挽回了约500万美元的损失。🛡️💰

11月,在伊斯坦布尔举行的Devconnect大会上,BlockSec Phalcon的发布标志着一个重要的里程碑,这得益于我们两年来的不懈打磨。该系统是首个能够自动阻止黑客攻击的Web3安全产品。

我们的使命:推进Web3安全 🚀

一次又一次,项目团队和用户在遭受黑客攻击和网络钓鱼后主动联系我们寻求帮助,这更加坚定了我们提升Web3社区安全意识的决心。

今年,我们参与了包括DeFi Security SummitTOKEN 2049DevconnectETHBerlinACM CCS在内的一系列活动。我们分享了关于Web3易受攻击性的见解,强调了主动防御的重要性,讨论了事件响应策略,并介绍了实用的安全工具。

此外,我们还启动了🏆 BlockSec区块链安全奖🏆,这是一项为期三年的奖学金,旨在表彰在香港理工大学攻读区块链技术硕士学位的优秀学生。我们的目标是帮助行业培养更多具备扎实安全资质的合格安全专业人才和开发者。🎓

作为一家安全公司,我们认为培养人才和推进区块链安全是我们的责任和愿景,为行业的稳健发展贡献力量。

展望未来

随着新的一年即将到来,我们致力于持续创新,专注于将Phalcon打造成一个更加实用和全面的安全产品。我们也承诺将继续与更广泛的Web3社区分享我们的见解和安全愿景。

提前祝您新年快乐!🎉

愿您在新的一年里,Web3之旅一帆风顺,硕果累累。

愿新的一年里,您身体健康,万事如意。🥳

Sign up for the latest updates
Drift Protocol Incident: Multisig Governance Compromise via Durable Nonce Exploitation
Security Insights

Drift Protocol Incident: Multisig Governance Compromise via Durable Nonce Exploitation

On April 1, 2026 (UTC), Drift Protocol on Solana suffered a $285.3M loss after an attacker exploited Solana's durable nonce mechanism to delay the execution of phished multisig approvals, ultimately transferring administrative control of the protocol's 2-of-5 Squads governance with zero timelock. With full admin privileges, the attacker created a malicious collateral market (CVT), inflated its oracle price, relaxed withdrawal protections, and drained USDC, JLP, SOL, cbBTC, and other assets through 31 rapid withdrawals in approximately 12 minutes. This incident highlights how durable nonce-based delayed execution can decouple signer intent from on-chain execution, bypassing the temporal assumptions that multisig security implicitly relies on.

Weekly Web3 Security Incident Roundup | Mar 23 – Mar 29, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Mar 23 – Mar 29, 2026

This BlockSec weekly security report covers eight DeFi attack incidents detected between March 23 and March 29, 2026, across Ethereum and BNB Chain, with total estimated losses of approximately $1.53M. Incidents include a $679K flawed burn mechanism exploit on the BCE token, a $512K spot-price manipulation attack on Cyrus Finance's PancakeSwap V3 liquidity withdrawal, a $133.5K flash-loan-driven referral reward manipulation on a TUR staking contract, and multiple integer overflow, reentrancy, and accounting error vulnerabilities in DeFi protocols. The report provides detailed vulnerability analysis and attack transaction breakdowns for each incident.

Newsletter -  March 2026
Security Insights

Newsletter - March 2026

In March 2026, the DeFi ecosystem experienced three major security incidents. Resolv Protocol lost ~$80M due to compromised privileged infrastructure keys, BitcoinReserveOffering suffered ~$2.7M from a double-minting logic flaw, and Venus Protocol incurred ~$2.15M following a donation attack combined with market manipulation.