Services
What you get when you call us.
Six service lines, all free to constituents during active incidents, all designed for the operational realities of public blockchains.
0xCERT/ir
Incident Response
24/7 triage and containment for active blockchain incidents.
When a protocol is being drained, a bridge is compromised, or a key is leaked, every block matters. Our on-call team coordinates containment with affected projects, validators, sequencers, and centralized off-ramps in real time.
- 24/7 intake, initial triage within 24 hours (faster for active incidents)
- Coordination with exchanges, custodians, and bridge operators to freeze flows
- Forensic analysis of on-chain trace, calldata, and storage state
- War-room coordination with the affected project and downstream protocols
0xCERT/advisories
Advisories & Vulnerability Disclosure
CVE-style advisories for smart contracts and Web3 infrastructure.
0xCERT issues numbered advisories (0xCERT-YYYY-NNNN) for vulnerabilities affecting smart contracts, wallets, RPC providers, bridges, and node software, coordinating disclosure between researchers and maintainers.
- Embargoed coordinated disclosure with maintainers
- Public advisories with severity, affected versions, and remediation
- Cross-references to CVE, GHSA, and chain-specific identifiers
- Researcher acknowledgment and safe-harbor coordination
Recent advisories
All advisoriesPremia options vaults on Arbitrum drained of about $400k-$465k via empty option pools and flash loans
An attacker drained about $400k-$465k of collateral from six Premia options vaults on Arbitrum on 2026-11-01 by routing vault collateral into attacker-created option pools. Funds were bridged to Ethereum and swapped to BTC. Premia vault depositors should avoid the affected vaults until Premia confirms a fix.
b14g dual-staking protocol on Core: about 97M staked CORE withdrawn without authorization to attacker addresses
About 97M CORE staked through b14g was withdrawn without authorization on 2026-10-31 at 09:29 UTC and sent to attacker addresses. b14g paused the affected contracts. BTC staked via b14g is not affected. Exchanges should flag the two attacker addresses.
Troves xWBTC/WBTC vault on Starknet drained of about 8.57 WBTC via legacy rebalancer that kept vault permissions
On 2026-10-31 an attacker drained about 8.57 WBTC-equivalent (about $667k) from Troves' Ekubo xWBTC/WBTC vault on Starknet through a retired rebalancing contract that still held vault permissions. Troves revoked the permissions and paused affected vaults.
Kintsu DNS Hijack (StepDrainer Campaign)
Kintsu's website was hijacked via a registrar-level DNS attack and rerouted to a StepDrainer wallet-drainer page, in a campaign that also hit Flap and StonkBrokers.
filecoin-pin upload GitHub Action lets fork PRs spend the repository owner's Filecoin wallet
The filecoin-pin upload GitHub Action before 1.1.0 skips its fork check under workflow_run, letting an external contributor's fork PR upload attacker-controlled artifacts using, and spending funds from, the repository's Filecoin wallet. Upgrade to 1.1.0.
0xCERT/ioc
Threat Intelligence & IOC Feeds
Curated indicators of compromise for the Web3 attack surface.
We publish machine-readable feeds of malicious addresses, contracts, phishing domains, drainer signatures, and compromised front-ends so wallets, RPCs, and security tools can block known threats at the edge.
- Live feeds of drainer contracts and known-bad EOAs
- Phishing domain blocklists for wallet vendors and DNS providers
- Tagged on-chain entities (mixer hops, sanctioned addresses, exploit deployers)
- JSON, CSV, and STIX 2.1 exports for SIEM / TIP integration
0xCERT/takedown
Phishing & Drainer Takedowns
Coordinated takedown of malicious sites and front-end takeovers.
We work with registrars, hosting providers, CDNs, and wallet vendors to remove wallet-drainer infrastructure, fake airdrop sites, and compromised dApp front-ends as fast as possible.
- Registrar and hosting abuse coordination
- Indicator submissions to wallet-vendor and community blocklists, plus our own public IOC feeds
- Front-end integrity monitoring for high-value dApps
- DNS, IPFS, and ENS abuse handling
0xCERT/tracing
Stolen-Fund Tracing & Recovery Support
On-chain forensics to follow stolen assets across chains and mixers.
Our analysts produce evidentiary tracing reports usable by exchanges, law enforcement, and civil recovery teams, covering cross-chain bridges, mixers, and CEX off-ramps.
- Cross-chain attribution across L1/L2 ecosystems
- Mixer demixing where chain analytics permit
- Evidence packages for law enforcement and exchange compliance
- Liaison with major exchanges' financial crimes desks
0xCERT/training
Awareness & Training
Tabletop exercises and IR training for protocol and infra teams.
0xCERT runs incident response tabletops, key compromise drills, and threat-model workshops for protocol teams, foundations, DAOs, validators, and security service providers.
- Tabletop scenarios (key compromise, bridge exploit, governance attack)
- Runbook authoring and review for protocol teams
- Threat intel briefings for foundations and DAOs
- Public quarterly threat landscape reports