It’s time for blockchain security firms to join forces

Working alongside security experts from rival firms, not only with colleagues, will minimize risk for all of crypto

OPINION
article-image

FLY:D/Unsplash modified by Blockworks

share

The lack of open communication between blockchain security firms requires urgent action. 

Following a spate of high-profile hacks, the time to address the prevalence of multi-million-dollar hacks is severely overdue. Not even respected figureheads like Vitalik Buterin and Mark Cuban are immune, with over $1 million lost following a hacked Twitter account and wallet, respectively. 

Without a doubt, technical capabilities matter in securing funds against bad actors. However, there is a critical component that is being overlooked in the present: teamwork. If we are to successfully neutralize the risks of financial and reputational loss to the industry, communication and collaboration between blockchain security firms is necessary. 

As one prominent example, the lack of effective communication exacerbated the Curve hack this summer and should serve as an important wake-up call for the industry. 

Read more: Mixin halts withdrawals as network suffers $200M loss in hack

Security experts faced challenges in rapidly coordinating their actions, resulting in missed opportunities for effective execution. Multiple security teams operated independently to recover and protect user funds, causing redundant efforts and a delayed response time. Due to the ambiguous nature of white hat hacking, certain security teams sought explicit permission from Curve before initiating any recovery efforts. Consequently, the attacker managed to steal funds before the coordinated white hat team could secure them. 

Openly discussing exploits, vulnerabilities and root causes is already the norm in traditional cybersecurity, as firms follow established protocols for the responsible disclosure of vulnerabilities. 

Blockchain security firms can and should adopt similar practices, ensuring that they are able to communicate vulnerabilities responsibly to relevant projects and communities to minimize risk in the most efficient way possible. 

Solid examples of streamlined communication seen in more traditional cybersecurity include Europol, a criminal information and intelligence database that collates information on cybercrime, making this information available to the wider public. Another example is the Common Vulnerabilities and Exposures (CVE), a publicly available database listing known cybersecurity vulnerabilities. 

Working alongside security experts from rival firms, not only with colleagues, is a valuable approach driven by an ethos of collaboration for the greater good. One such example already in action in crypto is the Seal 911 initiative, a collective of blockchain security experts working together to offer support from within a Telegram group. So far, Seal 911’s coordinated response has helped prevent a $200,000 theft.

Resources that pool information empower the community to more effectively monitor vulnerabilities and respond accordingly. However, there is no one such standardized process in Web3.

Read more: Mark Cuban loses nearly $900k on MetaMask fake

As the industry is still relatively nascent, this is not surprising. However, blockchain security firms should join together to create standardized protocols for common vulnerabilities for all Web3 projects — using the traditional cybersecurity resources as templates.

Crypto cybersecurity practices now are simply lacking

Relying on white hat hackers in crypto has proven extremely valuable up until now, saving individual projects millions in financial losses with each hack averted. However, relying on white hat hackers alone is not an efficient catch-all strategy. 

The execution of a white hat strategy necessitates a costly on-chain procedure to transfer funds to a trusted third party, followed by the need for that trusted third party to return the funds to the protocol or individual users. 

While advertising a white hat bounty can entice the most skilled white hat hackers to solve security issues quickly, it can also inadvertently provide attackers with hints that important or sensitive work is underway. This can propagate misinformation, potentially causing confusion about whether the event is an external attack or an asset protection operation (done by internal teams). Solving security issues publicly is not always the most effective solution. 

Web3’s penchant for anonymity, often due to legal and regulatory pressure, can also create uncertainty, as it can be unclear how to contact a trustworthy person within a protocol. Vulnerabilities should ideally be communicated to relevant parties first, in order to allow projects a fair opportunity to correct them before disclosing vulnerabilities to a wider audience. Yet the reality is that bad actors are often tipped off inadvertently at the same time, making the situation worse.

Collaboration must be embraced by blockchain security firms and experts. Only by working together cohesively can blockchain security firms establish best practices and standards for securing blockchain networks and decentralized applications.



Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Industry City | Brooklyn, NY

TUES - THURS, JUNE 24 - 26, 2025

Permissionless IV serves as the definitive gathering for crypto’s technical founders, developers, and builders to come together and create the future.If you’re ready to shape the future of crypto, Permissionless IV is where it happens.

Brooklyn, NY

SUN - MON, JUN. 22 - 23, 2025

Blockworks and Cracked Labs are teaming up for the third installment of the Permissionless Hackathon, happening June 22–23, 2025 in Brooklyn, NY. This is a 36-hour IRL builder sprint where developers, designers, and creatives ship real projects solving real problems across […]

recent research

Research Report Templates (19).png

Research

Suilend has grown into the top money market and liquid staking provider on Sui. STEAMM, Suilend’s Superfluid AMM, presents a compelling avenue for growing market share within Sui’s DEX landscape and revenue generation for the protocol. Suilend’s multi-product suite position it well for owning market share across key verticals. While current metrics across the Sui ecosystem are likely inflated due to Sui Foundation incentive programs, SEND trades at amongst the lowest multiples in the lend/borrow sector, suggesting that a bull case for continued growth in the ecosystem may be mispriced.

article-image

Silk Road founder Ulbricht made a triumphant return to the Bitcoin Conference, 10 years on from sentencing

article-image

A Blockworks Research report looked at who could take up some of the marketshare in the launchpad space

article-image

Business-to-business stablecoin payments are on the rise, per a report from Artemis, Dragonfly and Castle Island

article-image

Crypto continues to do its thing: incentivizing behavior

article-image

Kraken will soon offer Backed ‘xStocks’ as Solana tokens

article-image

In a unanimous decision, the US Court of International Trade has ruled that Trump’s IEEPA tariffs are unlawful