When the chain is on fire, someone answers.
0xCERT is an independent, non-commercial CERT. We coordinate incident response, advisories, and stolen-fund recovery across smart contracts, bridges, wallets, and Web3 infrastructure — on every chain that matters.
● On-call now · 24/7 intake · initial triage within 24 hours
- 14:23:07
Report received
Bridge outflows · Ethereum → Base
- 14:23:41
On-call paged
Analyst acknowledged
- 14:31:12
War room opened
Protocol, bridge, 3 exchanges
- 14:52:30
Attacker EOAs flagged
IOCs pushed to wallet vendors
- 15:06:04
Funds frozen at off-ramp
Partial recovery in progress
Built on CERT standards
- Stolen in 2025
- $2.1B+
- across tracked exploits
- Initial triage
- < 24 h
- from report to analyst
- Chains monitored
- 40+
- live health checks every 5 min
- Coverage
- 24/7/365
- on-call rotation
How response works
From first message to public advisory.
A repeatable playbook adapted from forty years of CERT practice to a world where the ledger is the crime scene.
- T+001
You reach out
Form, email, or a peer CERT. Partial information is fine — speed beats completeness.
- T+60s02
On-call is paged
A human analyst acknowledges and assigns a case ID (CASE-YYYY-NNNN).
- T+24h03
Triage & containment
War room with your team, exchanges, bridges, and wallet vendors to stop the bleeding.
- T+disclosure04
Public advisory
Post-mortem, IOCs, and remediation published — signed, numbered, and syndicated.
Mission
Nobody owns the incident. So we coordinate it.
Traditional CERTs were designed for IP networks, TLS certificates, and a small set of vendors. Blockchains have none of those assumptions. Code is the bank, the ledger is public, and the attacker keeps the funds the moment a transaction lands.
Protocols, bridges, wallets, validators, and exchanges all touch the blast radius of a single exploit, but none of them have the standing to coordinate the others. We do.
We are non-commercial, vendor-neutral, and chain-agnostic. We don't sell a product. We answer the phone, run the war room, publish the advisory, and feed the IOC list to everyone who needs it — for free.
Services
What we do, around the clock.
Incident Response
24/7 triage and containment for active blockchain incidents.
Advisories & Vulnerability Disclosure
CVE-style advisories for smart contracts and Web3 infrastructure.
Threat Intelligence & IOC Feeds
Curated indicators of compromise for the Web3 attack surface.
Phishing & Drainer Takedowns
Coordinated takedown of malicious sites and front-end takeovers.
Stolen-Fund Tracing & Recovery Support
On-chain forensics to follow stolen assets across chains and mixers.
Awareness & Training
Tabletop exercises and IR training for protocol and infra teams.
Recent advisories
Coordinated disclosure, made public.
reth trie bug can make reth, op-reth and Base nodes compute wrong state roots, stall or serve incorrect state proofs
A trie iterator bug in reth (fixed in PR #28264) can drop a leaf from incremental state-root calculations. Unpatched reth-based nodes may stall or return incorrect eth_getProof state proofs, and no loss of funds is known. Upgrade to reth v2.10.0, op-reth v2.8.1 or Base v1.5.3.
FLOKI trading bot taken offline after exploit; users told to stop depositing into bot wallets
FLOKI says it is investigating an exploit of its trading bot discovered early on 5 Nov 2026 and has taken the bot offline. Do not deposit into bot wallets; users who exported their private key should move remaining funds to a wallet only they control.
Loopscale pauses Solana lending protocol after week-long attack campaign on SOL and USDC Genesis Vaults
Loopscale paused protocol activity on Solana after a week-long campaign hit its SOL and USDC Genesis Vaults. Loopscale says affected vaults were made whole and no user deposits lost. It published four linked addresses. Treat them as hostile and follow official channels for when repayments resume.
Active incident?
Don't wait. Triage starts the moment you reach out.
Funds moving, a key exposed, or a front-end serving malicious code — open a report and our on-call engineer is paged immediately. No contract, no retainer.