Back to Blog

Phalcon 2023 年度总结

January 1, 2024
3 min read

2023年,Web3 不仅怀揣着技术突破的宏伟愿景,也面临着前所未有的严峻安全挑战。在这一年里,Phalcon 也完成了从交易浏览器到全面安全套件的转型。Phalcon 现已覆盖协议安全的全生命周期,从上线前测试、上线后监控及攻击拦截,到事后事件分析。

让我们通过 Phalcon 的故事,一同回顾 BlockSec 在 2023 年为推动 Web3 安全所付出的不懈努力。

Phalcon 的安全理念:超越代码审计 🤔💡

自 BlockSec 成立之初,我们的立场就从未动摇——单纯的代码审计不足以抵御 Web3 黑暗森林中无处不在的安全风险(尽管我们在代码审计方面做得非常出色)。一旦项目上线,主动防御和快速响应机制就变得至关重要。

传统的攻击监控系统会向我们发出威胁警报,但团队往往反应迟缓或对如何有效应对感到犹豫不决。我们开始思考:如何才能标准化我们的事件响应能力,以便更好地协助更广泛的项目? 这促成了 BlockSec Phalcon 的诞生,一个旨在自动拦截攻击的系统。

今年二月,当 Platypus 协议遭受攻击时,BlockSec Phalcon 帮助挽回了 240 万美元的潜在损失。

一个月后,该系统再次证明了其价值,成功拦截了对 Paraspace 的攻击,估计挽回了 500 万美元。🛡️💰

十一月,在伊斯坦布尔的 Devconnect 会议上,BlockSec Phalcon 的发布 标志着一个重要的里程碑,这充分证明了我们两年来的不懈努力和精心打磨。该系统脱颖而出,成为首个能够自动拦截黑客攻击的 Web3 安全产品。

我们的使命:推动 Web3 安全 🚀

一次又一次,我们收到项目方和用户的求助,希望在遭受黑客攻击和网络钓鱼后获得帮助,这更加坚定了我们提升 Web3 社区安全意识的决心。

今年,我们参加了一系列活动,包括 DeFi 安全峰会TOKEN 2049DevconnectETHBerlinACM CCS。我们分享了关于 Web3 易受黑客攻击的观点,强调了 主动防御的重要性,讨论了事件响应策略,并介绍了实用的安全工具。

此外,我们还设立了 🏆 BlockSec 区块链安全奖 🏆,这是一个为期三年的奖学金计划,旨在表彰在香港理工大学攻读区块链技术硕士学位的优秀学生。通过此举,我们希望帮助行业培养更多具备扎实安全功底的合格安全专业人才和开发人员。🎓

作为一家安全公司,我们认为培养人才、推动区块链安全发展,为行业的蓬勃增长做出贡献,是我们的责任和愿景。

展望未来

随着新年的临近,我们致力于不断创新,并将 Phalcon 打造成一个更实用、更全面的安全产品。我们也将继续与更广泛的 Web3 社区分享我们的安全见解和愿景。

提前祝大家新年快乐!🎉

愿您在新的一年里 Web3 之旅顺风顺水,事业兴旺。

愿来年带给您健康与幸福。🥳

Sign up for the latest updates
~$15.9M Lost: Trusted Volumes & More | BlockSec Weekly
Security Insights

~$15.9M Lost: Trusted Volumes & More | BlockSec Weekly

This BlockSec bi-weekly security report covers 11 notable attack incidents identified between April 27 and May 10, 2026, across Sui, Ethereum, BNB Chain, Base, Blast, and Berachain, with total estimated losses of approximately $15.9M. Three incidents are analyzed in detail: the highlighted $1.14M Aftermath Finance exploit on Sui, where a signed/unsigned semantic mismatch in the builder-fee validation allowed an attacker to inject a negative fee that was converted into positive collateral during settlement; the $5.87M Trusted Volumes RFQ authorization mismatch on Ethereum; and the $5.7M Wasabi Protocol infrastructure-to-contract-control compromise across multiple EVM chains.

Newsletter - April 2026
Security Insights

Newsletter - April 2026

In April 2026, the DeFi ecosystem experienced three major security incidents. KelpDAO lost ~$290M due to an insecure 1-of-1 DVN bridge configuration exploited via RPC infrastructure compromise, Drift Protocol suffered ~$285M from a multisig governance takeover leveraging Solana's durable nonce mechanism, and Rhea Finance incurred ~$18.4M following a business logic flaw in its margin-trading module that allowed circular swap path manipulatio

~$7.04M Lost: GiddyDefi, Volo Vault & More | BlockSec Weekly
Security Insights

~$7.04M Lost: GiddyDefi, Volo Vault & More | BlockSec Weekly

This BlockSec weekly security report covers eight attack incidents detected between April 20 and April 26, 2026, across Ethereum, Avalanche, Sui, Base, HyperLiquid, and MegaETH, with total estimated losses of approximately $7.04M. The highlighted incident is the $1.3M GiddyDefi exploit, where the attacker did not break any cryptography or use a flash loan but simply replayed an existing on-chain EIP-712 signature with the unsigned `aggregator` and `fromToken` fields swapped out for a malicious contract, demonstrating how partial signature coverage turns any historical signature into a generic permit. Other incidents include a $3.5M Volo Vault operator key compromise on Sui, a $1.5M Purrlend privileged-role takeover, a $413K SingularityFinance oracle misconfiguration, a $142.7K Scallop cross-pool index injection, a $72.35K Kipseli Router decimal mismatch, a $50.7K REVLoans (Juicebox) accounting pollution, and a $64K Custom Rebalancer arbitrary-call exploit.