Known-threat-actor cluster has touched protocol
A threat intelligence & recon factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score#
What this measures
This real-time signal fires when an address from a curator-maintained threat-actor cluster — comprising past exploiters, labeled attacker families, and sanctioned addresses — has interacted with the monitored protocol within the trailing 30 days. The threat-actor cluster is drawn from Chainalysis TRM labels, OFAC SDN list entries, curator-maintained attacker address lists derived from post-mortem analysis, and known DPRK/Lazarus wallet sets. Category 11 context: attacker-side reconnaissance precedes the majority of DeFi exploits; a known threat actor interacting with a protocol is the highest-confidence forward-looking threat intelligence signal available.
Why it matters
The T-01 synthesis documents approximately eight in-sample hack precedents where known-threat-actor addresses were interacting with target protocols before the exploit. Radiant Capital II ($53M, 2024) included a failed exploit attempt six days before the successful attack — if the attacker address were labeled from the failed attempt, a second interaction would have triggered this signal. Post-mortem analysis consistently identifies attacker addresses that were active in earlier hacks — attacker address reuse across protocols is documented. The signal is P0 because a labeled threat actor probing a protocol is the most actionable pre-exploit intelligence available, regardless of the absence of on-chain vulnerability evidence.
Green / Yellow / Red
Green is the baseline when no known-threat-actor cluster addresses have interacted with the protocol in the trailing 30 days per the current cluster feed. Yellow fires when a medium-confidence threat-actor address (curator-labeled but not OFAC-sanctioned) interacts with the protocol — elevated but potentially a coincidental interaction. Red fires when a high-confidence labeled threat-actor address (OFAC SDN, Chainalysis-confirmed exploiter, or prior DPRK-attributed address) interacts with the protocol within the trailing 30 days.
Common gray cases
Gray applies when the cluster feed has not been updated within 30 days (stale data) or when the protocol operates on a chain where cluster coverage is materially incomplete, making the absence of hits unreliable as a green signal.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Detect whether an address from the curator-maintained threat-actor cluster (past exploiters, labeled attacker families) interacted with this protocol in the last 30 days.