Threat Hunting and Intelligence in Web3 Security Operations, Milan Velev, Nexo | ETHSofia 2025

Transcript

[Music] Thank you. Thank you. I'm happy to be here. Hi everyone. My name is Milan Vev. I am chief information security officer at Nexo. And today we are going to talk a little bit about the dark side of the chain. First of all, I would like to thank ETH Sophia for this opportunity to share with you my insights on chat hunting and intelligence in WebG security operations and why it is so important.

As you probably know in web tree and crypto security and innovation are inseparable. So today we are going to talk about thread hunting. What this actually means and what we can do in order to be better while we are being in the web3 domain. Over the years, smart contracts, DeFi, and NFTs accumulated trillions in value. But by doing so, they attracted cyber criminals, AP groups, and state

sponsored hackers. That's why since we are in 2025, it's not enough just to react. We need to act proactively. And thread hunting is actually doing some proactive activities in finding our adversaries. Tread hunting means searching for hidden adversaries be before they strike. Chat hunting itself consists of five phases. The first one is building a hypothesis.

This means what could actually happen. It's extremely important to build a solid hypothesis because as you probably see this the foundation of a threat hunting effort. It could be build on previous malicious activities knowing well our critical processes and assets or a combination of both. An example hypothesis could be an act threat actor probing a liquidity pool with small trial flesh wounds.

So what we do next? The next step is collecting data. We are very fortunate that the web tree is built on transparency and decentralization. So we could use various sources including me monitoring, smart contract walks, GitHub commits and social media chatter. You should never underestimate the power of social media especially in web3 security. There are very useful telegram channels and X accounts that could provide very useful insights.

Once data gets collected, we move into the next stage which is investigation. We should actually analyze all the gathered data and see what actually happens. We could look for anomalies, suspicious wallets or tactics, techniques and procedures which could be attributed to different web3 hacking groups.

Once the data gets analyzed, we move into the validation stage. Validation is extremely important because over there we eliminate the false positives. Validation is focused on creating actionable insights. Once the validation stage is over, we move into action. action depends on the hypothesis and what exactly we want to achieve. But generally speaking in chat hunting when we are looking for uh adversaries we could either create new rules, update

detection logics as well as informing stakeholders and if possible freezing funds. Why chat hunting in web three and not using the tools that we have already built supposedly in web two? As some probably say it's entirely different ball game in web 3. Traditional security tools present a lot of limitations.

Conventional tools struggle with blockchain technology. it attacks evolve all the time. WebG attacks are faster. They are automated and on the top of that they are centralized decentralized sorry and as I've mentioned we are looking for a proactive approach. This proactive approach could give us the ability to detect early an attack and respond accordingly. So this is an example of real world web three chat actors tactics, techniques

and procedures. The main goal private key thefts. How could it be accomplished? Of course fishing and malware campaigns that are targeting wallet owners. This is pretty common. fleshwhon and governance attacks over there. It could be achieved by manipulating token prices and voting processes. Another TTP is oracle manipulation pretty common feeding false data to defy protocols.

And the last one is bridge protocol breaches. We can achieve this by by exploring crosschain transfer vulnerabilities. In order to implement a solid thread hunting program, we need two things. Knowing our assets and having a solid thread intelligence foundation. In thread hunting, we need to build a blockchain specific thread intelligence pipeline. This threat intelligence pipeline would allow us to implement and

achieve better results with our thread hunting efforts. What the threat intelligence pipeline rely upon sources? Of course, we need onchain data, off-chain data, meu monitoring and social media chatter enrichment. We need crosschain identity correlation. And of course, we need automation bots plus API for our triage. This is extremely important. And once this threat intelligence pipeline gets created and automated, it could provide us with the needed foundation for the

threat hunting activities. So how does actually onchain data and meu monitoring uh for early detection work? We can use a couple of different activities. transactional patterns, flu, abnormal and suspicious activities. This is extremely important for us just to be aware of what actually happens. Gas price manipulation detect priority fee anomalies. Another one, a word generation. We can trigger response for suspicious activities. And

of course, contract deployment. Watch for suspicious smart contracts. Another fundamental of thread hunting is defining playbooks. As much as a process gets predefined and automated, we in a stressful situation will be following the process and not following our emotions. So that's why we can defy chat hunting playbooks for defi for dows for bridges.

One of the playbooks that we can create is the defi protocol jing. What we can consist of of course monitor for large approvals as well as watch for flash setups and track price manipulation attempts. In terms of Dow proposal and vote buying, it's also critical to have a predefined playbook because in this way we will be able to hunt effectively. What we look for over there? Detect token consolidation, track suspicious delegate activity and monitor proposal timing patterns.

Bridge liquidity draining. The playbook should consist of watching validator networks, monitor signature threshold events, and track unusual crosschain activities. Once defined, these playbooks should be implemented in our thread hunting strategy and would allow us to look for state sponsored hackers, AP groups, and so on so forth. Of course, web three thread hunting cannot live on its own. It should be in correlation with web tree data and telemetry.

This data could allow us to get a better insight over what actually happens and attribute different activities to individuals, groups, and so on and so forth. In terms of web two data points, what we could actually use fishing domains, IP addresses, email infrastructure, hosting providers. All these data could be correlated with web three identities, wallet addresses, smart contracts, ENS domains and transaction patterns. How this actually work? Most of you have heard I hope that

no one in this room have been a victim of such an attack but there were a lot of fishing emails that led to compromising MetaMask wallets. So if you have IP address fishing domain email infrastructure we could correlate this data and provide us with insights on hunting effectively for attackers. Another thing is having an IP or geocation associated with certain wallet and its activities. So all this data is extremely important. Security by itself is not a standalone effort. It should be done in collaboration and that's why we

use web to telemetry and web three insights in order to have the entire picture and the bigger picture. A presentation is not good enough without a case study. Here is an example of hunting for a fleshwound attack preparation and how we can do it. First of all, we need early detection mechanisms. We should look for me pattern monitoring that catches suspicious transaction sequences.

Once it's done, we move into token movement analysis. We look for large token swaps and contact approval that trigger awards. Once this phase gets completed, we move into simulation. What simulation consist of? This is a forkchain simulation that predicts exploit PS. So for example, if there is a malicious smart contract that actually compromise our transaction, we can actually see if the funds will go to a certain wallet or to a different one.

Some might speculate that the recent attack against bite bit could be potentially prevented with uh such a sim simulation. And the last stage is response. Responding is extremely important. All these actions should lead to some activities from a security and defensive standpoint. So security team uh should deploy counter measures before attack completion completion. This case study is focused on a lot of attacks that have happened in the past especially uh in terms of fleshw attack

preparations. Some speculate that such thread hunting fleshwhon uh playbook would be uh very beneficial in the 2020 attack against uh BZX lending protocol. Of course, as I've mentioned, security is not a single effort. It should be done in collaboration. And through the years it has shown that actually by working together we can be stronger.

In 2020 makers Dar community monitoring actually detected a malicious proposal and thanks to that the attack was prevented. This governance proposal didn't happen. Thanks thanks to the collaborative efforts of the entire industry and by working together we can prevent a lot of the things that actually happened or hope to do so. There is a slight misconception in our domain that thread hunting should be done and could be done exclusively via commercial tools. From my perspective,

it's not like that. uh the best way is to create a cooperative environment between commercial and open-source platforms. But even if an organization doesn't want to invest into thread hunting tools, there are a lot of open-source platforms that could allow us to prepare and implement thread hunting in Web3. Chain analysis. Even though it's a commercial platform provides a free uh option to uh search for sanctioned addresses which is extremely useful.

Tenderly a great platform that is focused on smart contract simulation and debugging. Fora provide us with realtime security alert uh via detection bots and you can use as well EGFI which is onchain attacks and visual visualization sorry. So to close, we should evolve beyond web 2.

Traditional models are insufficient for blockchain threats. We should be up to date with the latest trends, attacks, and threats. In order to be on point, we should provide uh and use a holistic visibility. We should combine onchain data, offchain monitoring and meu monitoring and we should implement a cooperation between people and AI. So far AI is not able to replace completely human in humans into uh IT and security

but automation amplifies extremely expert analysis. the dark side of the chain is growing but so is our ability to defend. Thank you. And now I'll take your questions. How early uh before attack good threat intelligence could uh help us to defend against?

>> Uh as early as possible the idea of threat hunting is to proactively look for a potential of compromise. So that's why re we rely on knowing our critical assets and knowing the threats in our domains as well as receiving insights from our threat intelligence platforms or programs. So we should know what actually happens, what has happened, what we should safeguard and protect and once we have the entire picture we can go and look for threats.

So as early as possible, thread hunting is it's a preventive measure. It's not a reactive measure. So uh once we implement chat hunting, I believe that a lot of a lot of the attacks that actually occur could be diminished or uh defended. Uh yes, there are a few questions from Slido actually. Uh one is does AI have a place in helping to monitor and defend everinccreasing attack surface?

>> Uh AI definitely helps. uh but from my experience uh while using AI in thread intelligence and thread hunting we should always always validate uh the insights that we received because sometimes we tend to receive some false positives or things that look like an attack but actually are harmless. So we should take it with a grain of salt. Uh let's put it this way. It's very useful. It's extremely useful for automating repetitive tasks or thing that don't require too much decision making. Uh but we cannot rely solely on the uh efforts of AI in order to protect

ourselves. >> Thank you. One more. Can you give us more info? What is the current accuracy of this threat hunting? What is the percentage of attacks that were found and attacks that weren't? uh in terms of nexo or generally speaking >> I think it's general >> generally speaking it it depends a lot as I mentioned uh there are examples of preventive measures that have been implemented successfully in some attacks uh the thing is that sometimes with threat hunting is difficult to further elaborate on the percentage because it prevents the attacker actually happening and without having the result. We cannot

be 100% sure that it has actually prevented and to what percent it was prevented, but for sure you can diminish the chance of being hacked or being hacked in a severe way. So these are efforts that couldn't be measured at this point, but it's still good to have them and implement it. >> Thank you. I I don't see any more questions from Slido. Thank you. >> Thank you.