Blockaid, the onchain security platform used by Coinbase, MetaMask and Uniswap, said on Sept. 10 that it is expanding its Onchain Monitoring suite as crypto attacks increasingly move beyond smart contracts and into the infrastructure surrounding them. The New York-based company found that 74% of stolen crypto value in the first half of 2026 came from operational and infrastructure compromises rather than traditional smart-contract vulnerabilities, with the number of incidents running roughly 3.4x the total it recorded across all of 2025, according to a release the company published .
From smart-contract bugs to shared infrastructure
A compromised signer, an outdated deployment, a vulnerable third-party protocol or a shared piece of infrastructure can expose every asset and application connected to it, Blockaid warned. Its expanded suite is designed to continuously identify how an organization’s onchain footprint, and the risks surrounding it, change over time. The launch adds three core capabilities: continuously discovering onchain exposure, mapping third-party dependencies, and detecting ecosystem-wide threats before they reach a team’s assets.
Detection paired with automated response
System monitors track market and liquidity signals such as large liquidations, liquidity changes, oracle deviations and APR movements, alongside privileged activity including contract upgrades, ownership changes, role grants, pause events and parameter updates. When suspicious activity appears, Blockaid combines real-time machine learning with automated investigation, with agents that inspect contract bytecode, resolve proxies, analyze permissions, trace internal calls and simulate transactions to decide whether abnormal activity is an actual threat. Detection also feeds response through automated onchain circuit breakers and a 24/7 incident war room.
Why broader exposure changes security
The shift matters because exploits involving shared infrastructure, governance systems and privileged controls can now affect multiple protocols at once, as recent incidents have shown, including the $6 million Summer.fi exploit Blockaid flagged . For market makers and hedge funds, the suite can surface an external protocol failure before it reaches a position; for issuers, it tracks every deployment and the infrastructure behind it; for DeFi protocols, it shows how an incident can spread before the blast radius expands. Blockaid said it has scanned more than 6.3 billion transactions and blocked 585 million attacks since 2025.
