The security engine most crypto users never see - and the one Coinbase, MetaMask, Uniswap and OKX quietly run to stop scams before a single token moves.
Every day, millions of people tap "confirm" on a blockchain transaction they do not fully understand. A wallet asks for a signature; behind that request could be a legitimate swap - or a drainer built to empty the account. For most of crypto's history, the burden of telling the difference fell on the user.
Blockaid was built to move that burden off the human and onto a machine. Founded in 2022, the company runs a real-time engine that simulates and validates a transaction or decentralized app before it executes, then decides whether it is safe. When the answer is no, the wallet warns or blocks the user - often without the person ever realizing a threat was there.
That invisibility is the point. Blockaid does not sell to the people it protects. It sells to the platforms they already trust - exchanges, wallets, marketplaces, and protocols - which embed its detection engines through an API. The result is a security layer that lives inside other companies' products and, by design, disappears into them.
It has spread quickly. Within roughly a year of leaving stealth, Blockaid's technology was running inside some of the largest names in the industry, including Coinbase, MetaMask, Uniswap, Stellar, and OKX. The company says its platform has screened billions of transactions and helped prevent more than $13 billion in theft.
Blockaid describes itself as "the trust layer for onchain finance." In practice, that means catching the specific ways money gets stolen or misdirected onchain - and doing it at the moment of the transaction rather than after the fact.
Wallet drainers that trick users into signing malicious approvals. Phishing dApps dressed up as legitimate protocols. Scam and honeypot tokens. Social-engineering fraud like "pig butchering." And, for institutions, the risk of unknowingly touching sanctioned or stolen funds. These threats move in seconds; a quarterly audit notices them in months.
Rather than investigate after a hack, Blockaid simulates the outcome first. Its dApp Scanning Engine fully runs every possible interaction with an app inside a sandbox to judge whether it is malicious. Its transaction engine previews what a signature will actually do. If something is wrong, the platform flags it before execution.
Blockaid ships a set of engines that platforms mix and match - from consumer wallet protection to institutional compliance.
Simulates and validates transactions before execution, previewing outcomes so wallets can warn or block users pre-signature.
Fully simulates all user interactions with a dApp in a sandbox; scans over 15M sites daily and surfaces hundreds of new malicious apps.
Detects malicious, spam, and high-risk tokens to protect users from scam assets and honeypots.
Measures onchain risk and enables programmatic, automated response for DeFi protocol builders.
Intercepts social-engineering scams such as pig-butchering for exchanges, banks, and fintechs.
Real-time compliance suite - Risk Screening API, Cosigner Policy Engine, and DeFi Toxicity Monitors - for institutions enforcing policy at DeFi speed.
Blockaid's customers are the platforms; their users are the people protected. Public integrations span leading wallets, exchanges, marketplaces, and protocols - reaching tens of millions of end users.
The web3 security market has two broad camps. On one side sit analytics and investigation firms - Chainalysis, Elliptic, TRM Labs - that trace illicit funds, largely after they move. On the other sit consumer point tools that flag risky sites.
Blockaid's distinction is where and when it operates. It works in real time, at the moment of the transaction, and it embeds directly inside the products people use rather than sitting in a compliance dashboard. Prevention, not forensics; the edge, not the report.
That positioning also explains the 2026 move into Risk Exposure. As banks, custodians, and asset managers push deeper into onchain finance, they need compliance that runs at network speed - screening fund flows before illicit exposure spreads. Blockaid is extending the same pre-execution logic it built for wallets into institutional policy enforcement.
The founders come from Israel's Unit 8200 cyber-intelligence unit and the Office of the Prime Minister, a background that shapes the company's research-first culture. The bet is a familiar one for maturing markets: the boring, load-bearing layers - clearing, settlement, security, compliance - get built once activity is real. Blockaid is building one of them.
B2B SaaS and API. Platforms embed Blockaid's engines and pay based on usage and enterprise contracts tied to transaction volume and modules. Estimated annual revenue is around $12.9M.
Real-time transaction simulation, sandboxed dApp analysis, ML-driven onchain and offchain threat intelligence, and - increasingly - programmable compliance for institutions.
| Round | Amount | Date | Lead / Investors |
|---|---|---|---|
| Seed | $6M | 2023 | Sequoia, Greylock, Cyberstarts |
| Series A | $27M | Oct 2023 | Ribbit Capital, Variant (co-leads) + existing |
| Series B | $50M | Feb 2025 | Ribbit Capital (lead), GV, Variant, Cyberstarts |
Total raised: approximately $89M.
Ido Ben-Natan and Raz Niv, former Israeli cyber-intelligence operators, start the company to secure onchain activity.
Emerges publicly with $6M seed and $27M Series A backed by Sequoia, Greylock, Cyberstarts, Ribbit, and Variant.
Adds address validation, onchain monitoring and response, and crypto fraud prevention as adoption grows.
Raises a round led by Ribbit Capital with GV, bringing total funding to roughly $89M.
Introduces a real-time compliance infrastructure suite to help institutions enforce policy at DeFi speed.
▶ Watch: Blockaid founder interviews & onchain security demos on YouTube