Phalcon Real-Time Threat Monitoring & Attack Prevention

BlockSec's Phalcon platform provides comprehensive real-time threat monitoring and automatic attack blocking for DeFi protocols, L1/L2 chains, and multi-signature wallets. The platform detects every threat, alerts what truly matters, and blocks attacks automatically before execution to prevent losses.

Phalcon Security for Protocols and Chains

Phalcon Security is BlockSec's flagship real-time threat monitoring and automatic hack blocking platform. The system scans transactions at the mempool stage to detect hacks before they execute on-chain, scrutinizing over 200 typical hacking characteristics to achieve highest precision detection with less than 1% false positive rate and 99%+ detection accuracy.

Comprehensive Risk Coverage

The platform identifies risks across four key dimensions: operational risks (unauthorized admin actions, dangerous upgrades), interaction risks (malicious external calls, oracle manipulation), financial risks (abnormal token movements, suspicious liquidations), and multi-sig wallet risks through Safe{Wallet} monitoring integration.

Automated Attack Blocking

When attacks are detected, Phalcon automatically initiates response actions using a gas-bidding strategy to place counter-transactions on-chain ahead of the attack transaction. This blocks the hack before it can execute, preventing loss. The system supports both EOA and multi-sig wallet triggering modes, offering flexibility and strict protocol authority controls.

Real-World Impact

Phalcon has protected over $50 billion in on-chain assets, successfully blocked 20+ attacks, and rescued $20+ million in funds through automated responses. The platform pioneered industry firsts including the first successful hack blocking (HomeCoin, March 2022), first influential blocking rescuing $3.8M (Saddle Finance, May 2022), first 'hacking back' rescuing $300K (TransitSwap, November 2022), first counter-exploitation of hacker's contract (Platypus, March 2023), and most significant rescue of $5M (ParaSpace, April 2023).

Safe{Wallet} Monitor

Specialized security monitoring for multi-signature wallets using the Safe (formerly Gnosis Safe) protocol. The monitor tracks all proposed transactions in Safe{Wallets}, analyzing them for potential security risks before execution. It provides transaction simulation capabilities showing the outcome and state changes before signers approve transactions. Risk alerts notify wallet signers of suspicious or high-risk transactions, helping prevent social engineering attacks, malicious proposal exploitation, and unauthorized access attempts.

STOP for L2 Chains

STOP is BlockSec's sequencer-level security platform designed specifically for Layer 2 blockchain chains. Unlike traditional monitoring that operates at the mempool or execution layer, STOP integrates directly with L2 sequencers. When malicious transactions are detected, STOP prevents them from being included in blocks at the sequencer level, providing the strongest possible defense for L2 ecosystems.

Why L2 Chains Need STOP

Many L2s don't have public mempools, making traditional threat detection methods less effective. L2 sequencers process high transaction volumes requiring real-time, automated security responses. By blocking attacks before they execute, STOP protects the L2 ecosystem's leading protocols, preserves user confidence in the chain's security, prevents contagion effects where one protocol exploit impacts others, and maintains the chain's reputation as a secure environment.

Simplified Configuration

Users can easily import addresses via protocol or CSV file, and the system automatically generates monitors tailored to the risks associated with those addresses. For complex scenarios, users can create custom monitors using templates, customize detection rules, combine different rule types, and adjust parameters.

Supported Chains

Phalcon supports Ethereum, BSC, Solana, Base, Arbitrum, Avalanche, Optimism, Manta, Merlin, Mantle, Sei, Bitlayer, Core, BoB, Story, Sonic, Berachain, Gnosis, opBNB, B2, and Taiko, with additional L1/L2 chains in the pipeline.

Integration and Access

The platform is available as a SaaS application with flexible subscription plans. Users can book demos and receive implementation support from BlockSec's technical team. Notification channels include email, Telegram, Discord, Slack, PagerDuty, and webhook integrations.