Sari

Security Researcher 🚀

[samczsun @samczsun]

It's been an incredible journey, but I've made the difficult decision to step back from day-to-day operations at @_SEAL_Org. I'll be transitioning onto the Board while @sbatt55 transitions from COO to Interim CEO

[Security Alliance @_SEAL_Org]

SEAL Frameworks are now in the @fund_defi OPSeC Repository!

AI security, prompt injection, data exfiltration, sandboxing, security awareness, etc.

Free, chain-agnostic guidance that builders and policymakers can both use.

https://t.co/NNOQ2yaK58

[Security Alliance @_SEAL_Org]

https://t.co/sJxbtZpmTO

[Security Alliance @_SEAL_Org]

📣 New updates just landed across several SEAL Frameworks!

Check out what's new in the thread below.

https://t.co/XNhof9FYga

[Security Alliance @_SEAL_Org]

SEAL weekly stats, Sept 1-8: We dealt with 48 incidents.

Reported losses by category:

- Protocol compromise: $3.81M
- Infrastructure exploit: $3M
- Wallet compromise: $1.2M
- DPRK intrusion: $400K
- Malware: $119K
- Social engineering: $110K
- Malicious ad: 100 BTC

[Security Alliance @_SEAL_Org]

New framework on developer-targeted intrusions. Based on SEAL's incident responses, it covers the most common attack vectors we observe against devs. Learn to threat model your execution environment and stay secure against persistent malware campaigns.

https://t.co/H7rvawI8UO

[Security Alliance @_SEAL_Org]

It's finally happening!

SEAL Certifications are now open for business. 🎉

[Security Alliance @_SEAL_Org]

🌟 SEAL Frameworks Stewards Spotlight: Meet @n0guest & @hexnickk from @LidoFinance

Stewards are experts who maintain individual SEAL Frameworks, review contributions, and help others implement security best practices. They help keep our frameworks current and useful!

🧵 (1/3)

[Security Alliance @_SEAL_Org]

‼️ UPDATED LINKS FOR THE ETHEREUM SECURITY QF ROUND ‼️

SEAL has 5 projects participating in the QF round, please use these links (they've been updated & our previous post removed to avoid confusion):

1) https://t.co/FkIR1RA70a
2) https://t.co/VbxHFzWpYq
3) https://t.co/T8uSTN1OEZ
4) https://t.co/yf0koJEupL
5) https://t.co/8qP58JYi3V

[Security Alliance @_SEAL_Org]

⚠️ SEAL is tracking malicious Google Ads campaigns targeting DeFi apps, wallets & crypto services.
We blocked 356+ phishing URLs in recent weeks, but the campaign continues. Always inspect Google search results URLs!

Full write-up below:

https://t.co/PVWE7Q310L

[Security Alliance @_SEAL_Org]

Although the situation is still developing, we wanted to share some initial takeaways from the LayerZero DVN security incident

https://t.co/WjGtC81e8g

[Security Alliance @_SEAL_Org]

Framework of the Month for April: Incident Response Template

🆕 Brand new framework launching today!

The best time to build your incident response plan is before you need it. The second best time is right now.

Pre-built assets and practiced procedures are the difference between recovery and catastrophe. (1/x)

[Security Alliance @_SEAL_Org]

Up next in our Framework of the Month series: Multisig for Protocols

"We use a multisig," tells you nothing about actual security because configuration, signer selection, and operational procedures matter. Most multisigs fail on all three.

🔥 Remember that adding more signers ≠ more security. Poorly configured 5-of-9 multisig < well-configured 2-of-3. Real security comes from thoughtful design.

🎯 Our Framework covers the full multisig lifecycle:

- Threshold & signer selection strategy
- Signer security requirements & verification
- Operational procedures & approval workflows
- Key rotation & signer replacement protocols
- Emergency response & recovery procedures

Your multisig is only as secure as:
- The most compromised signer
- Your weakest operational procedure
- Your slowest emergency response time

🙏 Massive appreciation to @bl4ckb1rd71 @pinalikefruit @isaacpatka @DicksonWuML @PabloSabbatella @theSouilos and Geoffrey at @0xshield3 for contributing their implementation expertise to this framework!

🔗 Here's the complete Multisig for Protocols framework: https://t.co/d6J85P9adY

[Security Alliance @_SEAL_Org]

darkMode sessions cover things you can't learn from docs:

🦭 Active threat intel on state-sponsored groups
🦭 Post-mortems from $100M+ exploits
🦭 Hands-on privacy & OpSec workshops
🦭 Reality checks on AI auditing & tooling
🦭 Why incident response breaks (and how to fix it)

Every session led by people who've been in the war room.

Feb 16-17 | ETHDenver | FREE (ETHDenver ticket required)

Space is limited: https://t.co/LS3cIRFkA8

[Security Alliance @_SEAL_Org]

New for 2026 -- a new Framework of the Month spotlight: Encumbered Wallets 🔐

Many teams think wallet security = cold storage, but the most critical transactions happen in hot wallets that can't be air-gapped.

It's time to rethink operational security. (1/x)

[Security Alliance @_SEAL_Org]

Multiple victims were already affected by DPRK "Contagious Interview" campaigns utilizing VS Code Tasks abuse for malware execution. We took a deep dive and discovered connections to DPRK IT Workers. And, partially broken, yet still effective, malware.

https://t.co/mCjisf5Ttn

[Security Alliance @_SEAL_Org]

Watching SEAL Grow Up: Our 2025 Story

This year proved that security doesn’t mature in isolation. It grows through collaboration over competition.

We launched initiatives & the industry adopted them. Partners showed up. Researchers contributed. Companies trusted us. That’s what growth looks like.

Here’s a snip it of what we accomplished with all of your support👇

SEAL Safe Harbor
In February, we celebrated our Safe Harbor Agreement turning one. By October, we awarded our first Safe Harbor Champions based on your votes to @AlchemixFi and @Cointelegraph.

SEAL Safe Harbor is now protecting $70B+ in assets across 21 protocols and multiple blockchains!

SEAL Intel
Our threat intelligence team tracked and exposed multiple major threat actors this year, including:

- ELUSIVE COMET: https://t.co/iSJOdFq7fq
- PERPETUAL DRAINER: https://t.co/TP6Y7RR7BL
- SLOVENLY COMET: https://t.co/higWMGoqfh

+ We launched the Phishing Defense Network for real-time detection and protection against advanced phishing threats with founding partners @MetaMask, @WalletConnect, @Backpack, and @phantom.

https://t.co/FT1AEdVGpI

+ We built something genuinely new: cryptographic verification to solve the cloaking problem.

https://t.co/wuSjz8Eehu

Watching SEAL Intel mature into this coordinated response force? That’s good stuff. 💙

SEAL Frameworks
This year, we officially launched SEAL Frameworks (community-driven security playbooks) + published free resources in a dozen different aspects of web3 security, including:

- Community Management
- Security Awareness
- Incident Management
- Operational Security
- Wallet Security
- Multisig for Protocols
- External Security Reviews
- Domain & DNS Security
- DPRK IT Workers
- Security Testing
- ENS
- Safe Harbor

SEAL Certifications
Only a few weeks ago we published a Request for Comments for SEAL Certifications & 15+ pilots are already underway!

We’re ready to set standards.

https://t.co/YvXNtLIlli

SEAL 911
Through every headline, every crisis, every mid-night panic SEAL 911 kept running.

Our 24/7 emergency response team saved ~$95M USD this year.

🙏 THANK YOU!
Thanks to every journalist who covered our work. Every protocol that adopted Safe Harbor. Every researcher who contributed intel. Every domain expert stewarding a Framework. Every wallet that joined the defense network. Everyone reporting to phishing sites.

You’re not just supporting SEAL — you’re helping build crypto’s immune system.

Here’s to building a more secure 2026. 🥂🎉

[Security Alliance @_SEAL_Org]

After years running SEAL 911 and coordinating incident response, we've identified a critical gap: while many protocols have strong smart contract audits, there's no standardized way for them to demonstrate operational security maturity.

Today we're issuing an RFC for our newest initiative: SEAL Certifications

Full announcement: https://t.co/36xaOoLY1u

[matta ⚡🪷 @mattaereal]

Be careful if you use Booking.

If you get a sudden invitation to an event where the host pays for all the costs, and it seems too good to be true, be careful. There is some phishing that I haven't fully analyzed yet, but it involves attackers hijacking Booking profiles ⬇️

[Security Alliance @_SEAL_Org]

New monthly series! A deep dive into one SEAL Framework each month.

First up: External Security Reviews 🔍

Getting rekt isn't a rite of passage – it's a choice. (1/🧵)