Back to Blog

Phalcon 2023 年度总结

January 1, 2024
3 min read

2023年，Web3 不仅怀揣着技术突破的宏伟愿景，也面临着前所未有的严峻安全挑战。在这一年里，Phalcon 也完成了从交易浏览器到全面安全套件的转型。Phalcon 现已覆盖协议安全的全生命周期，从上线前测试、上线后监控及攻击拦截，到事后事件分析。

让我们通过 Phalcon 的故事，一同回顾 BlockSec 在 2023 年为推动 Web3 安全所付出的不懈努力。

Phalcon 的安全理念：超越代码审计 🤔💡

自 BlockSec 成立之初，我们的立场就从未动摇——单纯的代码审计不足以抵御 Web3 黑暗森林中无处不在的安全风险（尽管我们在代码审计方面做得非常出色）。一旦项目上线，主动防御和快速响应机制就变得至关重要。

传统的攻击监控系统会向我们发出威胁警报，但团队往往反应迟缓或对如何有效应对感到犹豫不决。我们开始思考：如何才能标准化我们的事件响应能力，以便更好地协助更广泛的项目？ 这促成了 BlockSec Phalcon 的诞生，一个旨在自动拦截攻击的系统。

今年二月，当 Platypus 协议遭受攻击时，BlockSec Phalcon 帮助挽回了 240 万美元的潜在损失。

一个月后，该系统再次证明了其价值，成功拦截了对 Paraspace 的攻击，估计挽回了 500 万美元。🛡️💰

十一月，在伊斯坦布尔的 Devconnect 会议上，BlockSec Phalcon 的发布 标志着一个重要的里程碑，这充分证明了我们两年来的不懈努力和精心打磨。该系统脱颖而出，成为首个能够自动拦截黑客攻击的 Web3 安全产品。

我们的使命：推动 Web3 安全 🚀

一次又一次，我们收到项目方和用户的求助，希望在遭受黑客攻击和网络钓鱼后获得帮助，这更加坚定了我们提升 Web3 社区安全意识的决心。

今年，我们参加了一系列活动，包括 DeFi 安全峰会、TOKEN 2049、Devconnect、ETHBerlin 和 ACM CCS。我们分享了关于 Web3 易受黑客攻击的观点，强调了 主动防御的重要性，讨论了事件响应策略，并介绍了实用的安全工具。

此外，我们还设立了 🏆 BlockSec 区块链安全奖 🏆，这是一个为期三年的奖学金计划，旨在表彰在香港理工大学攻读区块链技术硕士学位的优秀学生。通过此举，我们希望帮助行业培养更多具备扎实安全功底的合格安全专业人才和开发人员。🎓

作为一家安全公司，我们认为培养人才、推动区块链安全发展，为行业的蓬勃增长做出贡献，是我们的责任和愿景。

展望未来

随着新年的临近，我们致力于不断创新，并将 Phalcon 打造成一个更实用、更全面的安全产品。我们也将继续与更广泛的 Web3 社区分享我们的安全见解和愿景。

提前祝大家新年快乐！🎉

愿您在新的一年里 Web3 之旅顺风顺水，事业兴旺。

愿来年带给您健康与幸福。🥳

Sign up for the latest updates
The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis
Security Insights

The Decentralization Dilemma: Cascading Risk and Emergency Power in the KelpDAO Crisis

This BlockSec deep-dive analyzes the KelpDAO $290M rsETH cross-chain bridge exploit (April 18, 2026), attributed to the Lazarus Group, tracing a causal chain across three layers: how a single-point DVN dependency enabled the attack, how DeFi composability cascaded the damage through Aave V3 lending markets to freeze WETH liquidity exceeding $6.7B across Ethereum, Arbitrum, Base, Mantle, and Linea, and how the crisis forced decentralized governance to exercise centralized emergency powers. The article examines three parameters that shaped the cascade's severity (LTV, pool depth, and cross-chain deployment count) and provides an exclusive technical breakdown of Arbitrum Security Council's forced state transition, an atomic contract upgrade that moved 30,766 ETH without the holder's signature.

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 13 – Apr 19, 2026

This BlockSec weekly security report covers four attack incidents detected between April 13 and April 19, 2026, across multiple chains such as Ethereum, Unichain, Arbitrum, and NEAR, with total estimated losses of approximately $310M. The highlighted incident is the $290M KelpDAO rsETH bridge exploit, where an attacker poisoned the RPC infrastructure of the sole LayerZero DVN to fabricate a cross-chain message, triggering a cascading WETH freeze across five chains and an Arbitrum Security Council forced state transition that raises questions about the actual trust boundaries of decentralized systems. Other incidents include a $242K MMR proof forgery on Hyperbridge, a $1.5M signed integer abuse on Dango, and an $18.4M circular swap path exploit on Rhea Finance's Burrowland protocol.

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026
Security Insights

Weekly Web3 Security Incident Roundup | Apr 6 – Apr 12, 2026

This BlockSec weekly security report covers four DeFi attack incidents detected between April 6 and April 12, 2026, across Linea, BNB Chain, Arbitrum, Optimism, Avalanche, and Base, with total estimated losses of approximately $928.6K. Notable incidents include a $517K approval-related exploit where a user mistakenly approved a permissionless SquidMulticall contract enabling arbitrary external calls, a $193K business logic flaw in the HB token's reward-settlement logic that allowed direct AMM reserve manipulation, a $165.6K exploit in Denaria's perpetual DEX caused by a rounding asymmetry compounded with an unsafe cast, and a $53K access control issue in XBITVault caused by an initialization-dependent check that failed open. The report provides detailed vulnerability analysis and attack transaction breakdowns for each incident.