Threat Intelligence Data
Threat Intelligence in the Blockchain Space
Threat intelligence is the discipline of collecting, analyzing, and distributing information about active and potential security threats. In the context of blockchain, this means tracking exploits in real time, identifying new attack vectors, and warning the community before damage occurs.
Why Blockchain Threat Intelligence Is Specific
Unlike traditional cybersecurity, blockchain has unique characteristics that affect threat intelligence:
- Transparency of on-chain data: All transactions are public and visible in real time, which means attacks can be tracked as they happen.
- Irreversibility: Once funds are stolen, there is practically no way to recover them without the attacker’s cooperation or a centralized exchange.
- Global composability: DeFi protocols are interconnected, so an exploit of one can cascade and affect dozens of others.
- Pseudonymity: Attackers are pseudonymous, but their addresses are visible, which allows tracking of funds across the chain.
How We Track Threats
On-Chain Monitoring
We use a range of tools to monitor blockchain activity in real time:
- Forta Network, a network of detection bots that monitor suspicious transaction patterns
- Tenderly, transaction simulation and alert system
- Dune Analytics, custom SQL queries to track specific addresses and protocols
- Eigenphi, MEV and flash loan detection
Monitoring Communication Channels
Attackers often communicate on Discord servers, Telegram groups, and private forums before an attack. Monitoring darkweb forums, tracking GitHub activity of suspicious addresses, and monitoring Telegram bots that advertise “drainer” services provides early insight into upcoming attacks.
Smart Contract Monitoring
We monitor the deployment of new smart contracts, especially those that interact with known protocols. Suspicious contracts are analyzed: do they call flash loan functions of known protocols? Do they have functions for mass liquidity withdrawal? Is the deployer address new and funded via Tornado Cash?
Early Detections, Real Examples
Euler Finance ($197M, March 2023)
Security researcher Michael Bentley and his team identified the exploit within an hour of the attack and began writing a post-mortem. On-chain monitoring systems detected abnormal withdrawals from the protocol within minutes. The problem was that the exploit was fast, $197 million was drained in a single transaction.
Curve Finance Reentrancy (July 2023)
A vulnerability in the Vyper compiler (a programming language for Ethereum contracts) affected multiple Curve pools. Security researchers identified a potential exploit in Vyper code and warned the community, but before all affected pools could protect themselves, attackers exploited the vulnerability. Curve lost $73.5 million.
Indicators of Compromise (IoC) in Blockchain
Analogous to traditional cybersecurity, we define blockchain-specific IoCs:
- Deployer addresses funded via mixing services
- Contracts with functions that mimic legitimate protocols but have backdoor admin functions
- Abnormal increase in gas usage in specific protocols
- Flash loan borrowings followed immediately by withdrawals from the protocol
- Massive outflow of LP tokens in a short period (rug pull signal)
Threat Intelligence Feed
BlockchainSecurity.rs provides subscribers with regular threat intelligence reports that include:
- Weekly summary reports on exploits and total losses
- Profiles of active attacker addresses and their fund movements
- Analysis of new attack vectors identified in the current week
- Overview of audit reports published by leading firms
- Regulatory news relevant to security (SEC actions, OFAC sanctions)
In a world where a new exploit can emerge in seconds, timely information is the difference between protecting your funds and losing your entire portfolio.