It’s time for blockchain security firms to join forces

Working alongside security experts from rival firms, not only with colleagues, will minimize risk for all of crypto

OPINION
article-image

FLY:D/Unsplash modified by Blockworks

share

The lack of open communication between blockchain security firms requires urgent action. 

Following a spate of high-profile hacks, the time to address the prevalence of multi-million-dollar hacks is severely overdue. Not even respected figureheads like Vitalik Buterin and Mark Cuban are immune, with over $1 million lost following a hacked Twitter account and wallet, respectively. 

Without a doubt, technical capabilities matter in securing funds against bad actors. However, there is a critical component that is being overlooked in the present: teamwork. If we are to successfully neutralize the risks of financial and reputational loss to the industry, communication and collaboration between blockchain security firms is necessary. 

As one prominent example, the lack of effective communication exacerbated the Curve hack this summer and should serve as an important wake-up call for the industry. 

Read more: Mixin halts withdrawals as network suffers $200M loss in hack

Security experts faced challenges in rapidly coordinating their actions, resulting in missed opportunities for effective execution. Multiple security teams operated independently to recover and protect user funds, causing redundant efforts and a delayed response time. Due to the ambiguous nature of white hat hacking, certain security teams sought explicit permission from Curve before initiating any recovery efforts. Consequently, the attacker managed to steal funds before the coordinated white hat team could secure them. 

Openly discussing exploits, vulnerabilities and root causes is already the norm in traditional cybersecurity, as firms follow established protocols for the responsible disclosure of vulnerabilities. 

Blockchain security firms can and should adopt similar practices, ensuring that they are able to communicate vulnerabilities responsibly to relevant projects and communities to minimize risk in the most efficient way possible. 

Solid examples of streamlined communication seen in more traditional cybersecurity include Europol, a criminal information and intelligence database that collates information on cybercrime, making this information available to the wider public. Another example is the Common Vulnerabilities and Exposures (CVE), a publicly available database listing known cybersecurity vulnerabilities. 

Working alongside security experts from rival firms, not only with colleagues, is a valuable approach driven by an ethos of collaboration for the greater good. One such example already in action in crypto is the Seal 911 initiative, a collective of blockchain security experts working together to offer support from within a Telegram group. So far, Seal 911’s coordinated response has helped prevent a $200,000 theft.

Resources that pool information empower the community to more effectively monitor vulnerabilities and respond accordingly. However, there is no one such standardized process in Web3.

Read more: Mark Cuban loses nearly $900k on MetaMask fake

As the industry is still relatively nascent, this is not surprising. However, blockchain security firms should join together to create standardized protocols for common vulnerabilities for all Web3 projects — using the traditional cybersecurity resources as templates.

Crypto cybersecurity practices now are simply lacking

Relying on white hat hackers in crypto has proven extremely valuable up until now, saving individual projects millions in financial losses with each hack averted. However, relying on white hat hackers alone is not an efficient catch-all strategy. 

The execution of a white hat strategy necessitates a costly on-chain procedure to transfer funds to a trusted third party, followed by the need for that trusted third party to return the funds to the protocol or individual users. 

While advertising a white hat bounty can entice the most skilled white hat hackers to solve security issues quickly, it can also inadvertently provide attackers with hints that important or sensitive work is underway. This can propagate misinformation, potentially causing confusion about whether the event is an external attack or an asset protection operation (done by internal teams). Solving security issues publicly is not always the most effective solution. 

Web3’s penchant for anonymity, often due to legal and regulatory pressure, can also create uncertainty, as it can be unclear how to contact a trustworthy person within a protocol. Vulnerabilities should ideally be communicated to relevant parties first, in order to allow projects a fair opportunity to correct them before disclosing vulnerabilities to a wider audience. Yet the reality is that bad actors are often tipped off inadvertently at the same time, making the situation worse.

Collaboration must be embraced by blockchain security firms and experts. Only by working together cohesively can blockchain security firms establish best practices and standards for securing blockchain networks and decentralized applications.


Brian Pak is CEO & Co-Founder of ChainLight, an award-winning blockchain security firm that specializes in smart contract audits and on-chain monitoring. He is also a co-founder of Theori, an established US-based offensive cybersecurity company, since 2016, which he still leads today, having now amassed trusted partners including Microsoft, Google and Samsung. Brian’s early career started when he co-founded and developed Kaprica Security, inventing and patenting the Skorpion Charger, an Android mobile charger that can detect malicious software with no user action required. He has worked on research and development projects with the Defense Advanced Research Projects Agency (DARPA) of the US. Brian is also a founder of the team PPP (Plaid Parliament of Pwning) which won DEF CON CTF, one of the most prestigious hacker competitions held in Las Vegas, in 2013, 2014, 2016, 2017, 2019, 2022 and 2023. Brian graduated with a Masters Degree in Software Security Research from Carnegie Mellon University.

Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Unlocked by Template (10).png

Research

Innovations on Aptos’ technical design through Raptr, Shardines, and Zaptos approach near-optimal latency and throughput by unlocking 100% utilization of network resources, with the capacity to settle 260k transactions per second with latencies less than 800ms. The original Move language was revamped with the launch of Move 2, supporting more expressivity in smart contract logic and a scalable ability to interact with high volume datasets. The ecosystem has benefitted from strong asset inflows, now hosting over $1.3B in stablecoins, $450M in bridged BTC, and $530M in RWAs. Activity in the Aptos ecosystem has grown notably over the past year, with monthly application revenue reaching ~$835k and monthly DEX volumes growing to over $5B, both at new all time highs.

article-image

Interchain Labs will focus on sovereign L1s and institutional demand, abandoning plans for smart contracts on the Cosmos Hub

article-image

Also, only three tokens have outperformed bitcoin so far this year: XMR, HYPE and SKY

article-image

The fund group has submitted proposals in recent months for other funds that would hold litecoin, solana, XRP, HBAR, Sui and others

article-image

Momentum’s back — BTC leads, risk assets follow

article-image

Ondo Finance’s acquisition of blockchain development company Strangelove follows its buy of Oasis Pro

article-image

Cryptocurrency and stock traders alike had a lot to unpack Wednesday