HypernativeLabs

Detect and neutralize Web3 threats in real time. 200+ dApps, chains, wallets, and financial institutions rely on Hypernative to prevent hacks, exploits & fraud.

[HypernativeLabs @HypernativeLabs]

An attempted exploit on @ParallelMoney’s vaults was stopped automatically today. Hypernative detected the pattern and paused the relevant contracts within seconds. No funds lost.

This comes after a brutal stretch for onchain security. April alone saw major incidents at Drift and KelpDAO, part of a wider surge in successful exploits. Attackers are coming prepared. The difference, increasingly, is whether the protocols are too.

Credit to the Parallel team for having the monitoring and automated response in place before it was needed. That’s the work that doesn’t make headlines until it does.

[HypernativeLabs @HypernativeLabs]

In October 2025, the Myanmar military raided a compound called KK Park. Inside they found 20,000 people working 17- to 18-hour shifts running coordinated romance scams, fake crypto investment schemes, and social engineering operations at industrial scale.

Alex Rabke, VP Americas at Hypernative, walked through the case during our recent webinar on the onchain fraud prevention blueprint. The takeaway is uncomfortable: many of the workers were human trafficking victims, the operation was professionally managed, and what they were running is the new baseline for what fraud looks like targeting digital asset users.

Watch the full session on demand: https://t.co/0eAMlXrw69

[HypernativeLabs @HypernativeLabs]

.@ParallelMoney's automated response on May 7 didn't happen by accident. It was the product of architecture decisions made during onboarding, months earlier.

The key design choice: separate alert thresholds from pause thresholds. A mild deviation triggers a human-readable alert. A severe deviation triggers an automated onchain pause, with no human required at the moment of execution. Making that work meant granting the pause role directly to a Hypernative-controlled address, not routing it through a multisig. A multisig approval flow introduces latency. In a real attack, that latency can cost you.

Watchlists covered the full deployment: Ethereum, Base, HyperEVM, Avalanche, and Monad. Monitored contracts included the core USDp stablecoin, the savings vault, the swapper and bridgeable token contracts, and the LayerZero bridging module.

The architecture was in place before the attacker ever moved.

Full case study: https://t.co/dYpQpnwjdD

[HypernativeLabs @HypernativeLabs]

The biggest DeFi attacks of 2026 had something in common that almost no one is talking about.

Drift. Hyperbridge. Kelp. Three incidents, three different technical specifics, one structural failure mode. Every transaction in every one of these attacks passed every conventional security check at the moment of execution. Valid signatures. Verified proofs. Authorized attestations. The contracts behaved exactly as designed.

The industry has focused on the human layer as the new attack surface. That diagnosis is correct and incomplete. It explains how attackers get in. It does not explain why so much money leaves once they do.

Hypernative's research team is hosting a live session to walk through all three incidents, isolate the common architectural gap, and show what monitoring and onchain policy enforcement look like together as a complete defensive layer.

📅 June 17 | Register: https://t.co/hTZEKOdzMg

[HypernativeLabs @HypernativeLabs]

Hypernative co-founder & CEO @GalSagie joined Henri Arslanian on The Future of Crypto Compliance to talk through how crypto attacks have evolved, why the threat model has moved from smart contract bugs to people and infrastructure providers, and what real-time detection actually requires.

38 minutes on DPRK's organizational playbook, why compliance-after-the-fact can't keep pace with onchain fraud, and how AI agents change the attack surface on both sides.

[Henri Arslanian @HenriArslanian]

How North Korean hackers target crypto companies with @HypernativeLabs CEO @GalSagie.

The full interview is available on my YouTube and podcast platforms.

YouTube: https://t.co/MSOb19vjzm
Apple: https://t.co/tjBeZeDD62
Spotify: https://t.co/zTIC5iKokW

Powered by @acxcompliance – the world’s largest crypto compliance specialised managed services provider.

By crypto compliance professionals. For crypto compliance professionals.

[HypernativeLabs @HypernativeLabs]

Most people don't realize attackers have to expose their hand before they strike.

When a threat actor deploys an attack contract, something they almost always need to do to compose multiple operations in a single transaction, that bytecode is visible on the blockchain.

@gbvpzffd2r, CTO of Hypernative, joined @CapApp's CTO @the_weso on The Cap Room to explain how Hypernative runs an ML model on every contract deployed across monitored chains, flags dangerous bytecode, traces where it points, and fires an automated response before the attacker can execute.

In the Parallels case, the attacker deployed the attack contract, Hypernative detected it, and paused the protocol in time. The hacker fired and missed.

You can read the full case study here: https://t.co/cwh1YxDyy7

[HypernativeLabs @HypernativeLabs]

Upshift is bringing their vault standard to Stellar, the first deployment outside the EVM family.

Hypernative provides real-time risk monitoring across Blend, Aquarius, SushiSwap, and Templar from launch. Opening vaults go live in the coming weeks.

[Upshift @upshift_fi]

Upshift is launching vault infrastructure on @StellarOrg.

We're integrating with Stellar to grow DeFi TVL across the network, with a vault roadmap that spans RWAs, DeFi, and asset management infrastructure for Stellar ecosystem apps.

[HypernativeLabs @HypernativeLabs]

Phishing and blind signing attacks have become the primary vectors as smart contract security has improved.

Institutions need to simulate every transaction before signing it, enforce policies automatically, and know exactly what they are approving before it goes onchain.

From our Ultimate Guide to Web3 Security: https://t.co/w08LpPUig9

[HypernativeLabs @HypernativeLabs]

Catching an exploit in real time and accurately assessing what happened afterward are two different problems.

Hypernative joined the Firelight Risk Consortium to contribute threat detection and security monitoring to a credible, independent claims review process for onchain cover events.

[Firelight @Firelightfi]

We’re proud to introduce the Firelight Risk Consortium!

Together with @cyfrin, @CredoraNetwork, @HypernativeLabs, @nativeinsurance, and @labsGFX, the consortium establishes a transparent, neutral review process for onchain cover events.

https://t.co/x7q07SPW9e

[Upshift @upshift_fi]

Upshift is launching vault infrastructure on @StellarOrg.

We're integrating with Stellar to grow DeFi TVL across the network, with a vault roadmap that spans RWAs, DeFi, and asset management infrastructure for Stellar ecosystem apps.

[HypernativeLabs @HypernativeLabs]

The fundamental integrity check every bridge depends on: locked assets on the source chain versus minted assets on the destination chain, compared continuously, block by block.

Hypernative monitors every dimension of that exposure:

🔹 Balance and supply integrity: Locked vs. minted assets compared continuously, block by block, across every chain pair
🔹 Transaction and message integrity: Unexpected mints and burns, exact transaction matching, nonce sequencing
🔹 Access and governance: Ownership changes, contract upgrades, new token listings
🔹 Market signals: Price deviation, pool composition shifts, large holder exits
🔹 Operational health: Executor gas levels, oracle feed integrity

https://t.co/gsYARyrr2b

[HypernativeLabs @HypernativeLabs]

July 1 is 30 days out. Most of the industry conversation around MiCA has been about authorization. The harder conversation starts after.

Getting licensed means clearing a checklist at a point in time. What supervisors examine is whether the controls described in the application are actually running, and whether the evidence is retrievable on demand. Those are different problems.

We break it down on our blog: https://t.co/80OR5p176J

[HypernativeLabs @HypernativeLabs]

Crypto natives want privacy from governments and surveillance. Banks want privacy from competitors and counterparties. The underlying instinct is exactly the same.

Dan Caspi, CTO at Hypernative, put it directly at Consensus Miami: selective disclosure for institutional finance is the Wall Street version of what crypto was built for.

A group of 20 banks transacting together do not need to expose which institution is on which side of each trade. They need to know the group is legitimate and the settlement is guaranteed. That is privacy.

Institutions are not asking for something foreign to crypto. They are asking for the enterprise version of what the ecosystem already believes in.

Learn more at https://t.co/XTbHuzNkNy

[HypernativeLabs @HypernativeLabs]

$390B in annual stablecoin payment volume. GENIUS Act. MiCA. CLARITY Act. A new generation of institutional programs being built on onchain rails.

2026 is when stablecoins stop being a crypto asset class and start being financial plumbing.

The security model has to match that shift. Onchain transactions are irreversible. Controls cannot be batch-processed. Oversight has to be continuous. Governance has to be treated as a live attack surface, not a formality.

That is the framework our webinar on stablecoin security was built around.

Watch the full recording on demand: https://t.co/xFWffUvSiD

[HypernativeLabs @HypernativeLabs]

Tomorrow evening in Tel Aviv: two panels on the hard questions facing onchain asset managers. Custody and compliance. Onchain security. Then drinks.

Our VP Sales EMEA, Adi Zepkowitz, is on the security panel. Hosted by @ColliderVC and @kpk_io.

If you're in Tel Aviv, it's worth the evening.

https://t.co/C7PR4nHCoR

[HypernativeLabs @HypernativeLabs]

What does it actually mean to monitor a blockchain in real time?

@gbvpzffd2r, CTO of Hypernative, joined @CapApp's CTO @the_weso on The Cap Room to break it down: every block that gets mined, every transaction inside it analyzed. The goal is to catch threats before they cause damage, and when a customer has configured automated response, Hypernative can execute a pause or fund withdrawal within seconds of detection.

Dan cited a recent example where Hypernative fully prevented a hack on Parallels, saving millions of dollars.

Read the full case study here: https://t.co/cwh1YxDyy7

[HypernativeLabs @HypernativeLabs]

Every leveraged DeFi position depends on one assumption: the price feed is accurate.

When it isn't, liquidations trigger on healthy positions, collateral gets overvalued, and the loss lands on the asset manager. Oracle manipulation preceded some of the largest exploits in DeFi history, yet most institutional operations treat it as the protocol's problem to solve.

It isn't. The infrastructure underneath every position is monitorable. Most institutions just aren't monitoring it.

The full piece breaks down why oracle risk is institutional DeFi's most undermonitored exposure, and what monitoring it actually looks like.

https://t.co/hGc9Wb44wV

[Nomatic @Nomaticcap]

Every vault has its own automated agents running in two layers.

Layer 1 reacts instantly to clear risks like exploits, token pauses, or oracle ownership transfers.

Layer 2 flags the less obvious stuff for a human to review.

The important part: these agents can move funds between approved markets in seconds, but they can’t send funds to outside addresses. So the fast response happens inside a controlled sandbox.

[HypernativeLabs @HypernativeLabs]

The most expensive problem in crypto is also the least covered. Last year, scams and fraud took $17B to $35B from users, more than what protocol exploits and hacks cost in the same period.

Alex Rabke, VP Americas at Hypernative, opened our recent webinar on the onchain fraud prevention blueprint with that comparison. The headline-grabbing hacks are the smaller line item. The quieter loss vector is what's actually draining wallets and eroding trust in the platforms users hold their assets with.

Watch the full session on demand: https://t.co/Jfb6vjsnVK

[HypernativeLabs @HypernativeLabs]

An audit tells you a protocol was safe at the moment it was reviewed.

Six months later, governance proposals, new strategies, and liquidity shifts can change that picture entirely. Onchain risk is dynamic. Due diligence needs to be too.

From our Ultimate Guide to Web3 Security: https://t.co/bZSSsasL3R

[Api3 @Api3DAO]

The Api3 shields are up. 🛡️

We've partnered with @HypernativeLabs to add an additional protective layer over our Morpho vaults - a specialized second set of eyes watching for malicious actors, on top of the security already built into our curation and oracle stack. 🧵