When the chain is on fire, someone answers.
0xCERT is an independent, non-commercial CERT. We coordinate incident response, advisories, and stolen-fund recovery across smart contracts, bridges, wallets, and Web3 infrastructure — on every chain that matters.
● On-call now · 24/7 intake · initial triage within 24 hours
- 14:23:07
Report received
Bridge outflows · Ethereum → Base
- 14:23:41
On-call paged
Analyst acknowledged
- 14:31:12
War room opened
Protocol, bridge, 3 exchanges
- 14:52:30
Attacker EOAs flagged
IOCs pushed to wallet vendors
- 15:06:04
Funds frozen at off-ramp
Partial recovery in progress
Built on CERT standards
- Stolen in 2025
- $2.1B+
- across tracked exploits
- Initial triage
- < 24 h
- from report to analyst
- Chains monitored
- 40+
- live health checks every 5 min
- Coverage
- 24/7/365
- on-call rotation
How response works
From first message to public advisory.
A repeatable playbook adapted from forty years of CERT practice to a world where the ledger is the crime scene.
- T+001
You reach out
Form, email, or a peer CERT. Partial information is fine — speed beats completeness.
- T+60s02
On-call is paged
A human analyst acknowledges and assigns a case ID (CASE-YYYY-NNNN).
- T+24h03
Triage & containment
War room with your team, exchanges, bridges, and wallet vendors to stop the bleeding.
- T+disclosure04
Public advisory
Post-mortem, IOCs, and remediation published — signed, numbered, and syndicated.
Mission
Nobody owns the incident. So we coordinate it.
Traditional CERTs were designed for IP networks, TLS certificates, and a small set of vendors. Blockchains have none of those assumptions. Code is the bank, the ledger is public, and the attacker keeps the funds the moment a transaction lands.
Protocols, bridges, wallets, validators, and exchanges all touch the blast radius of a single exploit, but none of them have the standing to coordinate the others. We do.
We are non-commercial, vendor-neutral, and chain-agnostic. We don't sell a product. We answer the phone, run the war room, publish the advisory, and feed the IOC list to everyone who needs it — for free.
Services
What we do, around the clock.
Incident Response
24/7 triage and containment for active blockchain incidents.
Advisories & Vulnerability Disclosure
CVE-style advisories for smart contracts and Web3 infrastructure.
Threat Intelligence & IOC Feeds
Curated indicators of compromise for the Web3 attack surface.
Phishing & Drainer Takedowns
Coordinated takedown of malicious sites and front-end takeovers.
Stolen-Fund Tracing & Recovery Support
On-chain forensics to follow stolen assets across chains and mixers.
Awareness & Training
Tabletop exercises and IR training for protocol and infra teams.
Recent advisories
Coordinated disclosure, made public.
Keystone hardware wallet web shop breach exposed customer names, contact details and shipping addresses
Keystone says an unauthorized party accessed its official website and obtained customers' names, contact details, shipping addresses and order details; recovery phrases, keys and payment data were not exposed. Expect targeted phishing posing as Keystone refunds or replacement devices.
X100 Global on Ethereum drained of about $4.75M-$4.85M via flash-loan-funded Senate governance takeover
An attacker used flash-loaned funds to take two of X100 Global's three Senate seats and immediately execute a treasury proposal that dumped 400,000 X into an attacker-seeded pool, realising about $4.75M-$4.85M in USDT. Avoid interacting with X100 Freezer/treasury governance until the project publishes guidance.
X100 Global Senate Governance Takeover
A flash loan bought two of three governance Senate seats in a single block, passing a malicious proposal that drained roughly $4.85M from X100 Global's treasury.
Active incident?
Don't wait. Triage starts the moment you reach out.
Funds moving, a key exposed, or a front-end serving malicious code — open a report and our on-call engineer is paged immediately. No contract, no retainer.