.png)
Join the Waitlist for Early Access
Year-over-year, DeFi incidents are up 68%, with approximately $771M stolen in the first four and a half months of 2026. April alone accounted for $606M of that total, making it the single worst month for crypto theft since the Bybit breach in February 2025.
Attack vectors are broadening and code exploits are no longer the primary threat. In Q1 2026, over 80% of losses came from wallet compromises and social engineering rather than smart contract vulnerabilities. Attackers are targeting infrastructure, private keys, and operational processes.
And the pace is accelerating. AI-assisted tooling is now being used to automate vulnerability discovery, lowering the barrier to sophisticated attack construction. Attackers scan for accounting edge cases, bridge anomalies, and access control weaknesses at a scale no human analyst can match. The Parallel protocol attacker, for example, spent 57 days quietly building a 99% position in a savings vault before executing a $1.52M ERC4626 inflation attack. That kind of methodical preparation, combined with automated execution, is the new normal.
Configuring protection manually takes weeks. Attackers armed with AI need minutes.
But the harder problem sits underneath all of it. Most organizations don't know their full exposure in the first place. Security teams configure monitors one at a time, working from the threats they already know about. The risks they've never mapped stay invisible, and an attacker only needs one gap the team didn't know existed for a successful exploit to land.
Today we're introducing Hypernative ION, available now in Early Access: an AI agent that acts as your interactive onchain security architect, operator, and analyst. It works alongside your team and our security engineers to identify and close these gaps systematically, build and deploy security controls in minutes, and analyze your operations to adapt these controls as the risk landscape changes and your organization grows. All the while, it keeps your team in total control of every security decision made along the way.
The Gap Between What You Think You’re Protected Against and What You Actually Are
Hypernative monitors all contracts, wallets, and onchain interactions across 80+ chains in real-time and has been working with 350+ organizations to secure their onchain operations. In setting up every one of those deployments, our security engineers execute battle-tested onboarding procedures: understand the customer’s onchain activity, map the applicable risk types, and configure the right monitors and automated responses.
It is an ironclad process, but it takes time, and it depends on what our team and yours already know. It also assumes flawless internal coordination: in a large organization, separate teams launch products, add wallets, and move onto new chains independently, and every one of those changes opens a coverage gap unless it's communicated and mapped as it happens. Your protection is only as good as the orchestration behind it.
This is the configuration gap, and in large organizations it can multiply. The threats a team has thought about get configured, but the threats they haven't don't. That blind space is where most breaches begin:
- A financial institution running a stablecoin platform may monitor its core contracts but not the mint and burn operational wallets, the bridge exposure on secondary chains, or the access control logic on its admin keys.
- A payment provider may screen outbound flows for compliance risk but have no monitoring on the infrastructure contracts underpinning those flows.
- An asset manager may know its DeFi positions are monitored but have no visibility into whether the bridge it routes through has thrown anomaly signals in the last 48 hours.
ION closes that gap. The risk knowledge our security engineers have built through that work is now encoded into the agent and put to work for every customer, regardless of what their own team already knows, and delivered in minutes instead of days or weeks.
One AI Agent, Three Modes, with Your Team in Total Control
ION works across the Hypernative platform in three modes. The Architect maps the risks specific to your operations and identifies any coverage gaps. The Operator builds and deploys the controls to cover them. And the Analyst keeps watch and adapts as you grow or the risk landscape changes. Together they take an organization from "we're not sure where we are exposed" to fully covered, and keep it there.
One core principle runs through all three: ION proposes, but your team always decides. This matters more for security than for almost anything else software does, since a tool that reconfigures your defenses on its own is a new risk, not a reduction of one. So ION never acts alone. It prepares the plan, shows the reasoning behind every recommendation, and waits for your approval before anything takes effect. The judgment stays with the people accountable for it, and what you get back is the time you used to spend assembling that judgment from scratch. That’s the difference between an agent that acts on behalf of you and one that works for you.
Architect: Identify & Fully Close Your Coverage Gaps
With Architect mode, point ION at your organization and it studies the contracts and wallets you actually interact with, either by analyzing your onchain footprint directly or by talking it through with you, and builds a live map of the threats that apply to your specific operations. Each risk it surfaces is tied to a real asset and a real control, so you're not looking at a generic checklist but at your own operations, seen clearly.
This is where the "what am I not seeing?" question finally gets an answer. Whether you're running staking and lending positions, mint and burn operations, payment flows, or custody infrastructure, ION derives your risk map from what you actually do, drawing on Hypernative's accumulated best practices and live threat intelligence from across the ecosystem. The risks your team has thought about and the ones it hasn't are both surfaced, from day one.
The Architect mode's risk mapping extends across the Hypernative platform, including Transaction Guard. Here, ION analyzes the historical activity of your connected wallets and automatically surfaces custom monitoring recommendations, framed as the specific risks they represent rather than the underlying rule mechanics. As your transaction activity evolves, these recommendations update continuously, so your coverage keeps pace with how you actually operate.
Operator: Build Custom Controls & Deploy in Minutes
Knowing your risks is one thing. Covering them is the part that normally takes days of manual configuration. ION does that heavy lifting, working with your team and our engineers to onboard in minutes rather than weeks of back-and-forth.
Tell ION what you need in plain language, be it a watchlist, a custom monitor, or specific alert type, and it translates that into deployed protection across the platform. It takes the controls that address each risk in your map and configures them for you, and as your operations grow it keeps recommending the new controls that growth calls for. This frees your team and our engineers to spend their time on the decisions that need human judgment, rather than the manual assembly.
That includes transaction-level policies, the rules that govern what your wallets and contracts are allowed to do. Drawing on patterns from institutions Hypernative has secured since 2022, ION recommends the policies that fit how you actually operate, then deploys them on your approval. You're not starting from a blank page or a generic template; you're starting from what has worked for organizations like yours.
And your team stays in the loop at every stage. ION prepares each configuration, you confirm it, and nothing goes live until you say so.
Analyst: Stay Ahead of Changing Risk with Always-on Reconfiguration Recommendations
A robust security posture isn't a one-time setup. A new wallet, a new chain, a new product launch: each one opens exposure the original configuration didn't account for. ION keeps watch so the gap doesn't quietly reopen. It tracks your live coverage against your risk map, surfaces where protection has fallen behind your activity, and gives you a measurable view of your security posture that stays current as your operations change, a number that always comes with a story for the next board or audit conversation.
In addition, ION's Analyst mode triages incidents as they happen, delivering your team critical, timely context on risks within the wider web3 ecosystem. When Hypernative's monitoring detects a critical threat, ION generates an incident report in real time, analyzing the attacker's contract, identifying the likely attack vector and root cause, and delivering it in clear, human-readable language, even when your team is offline and would otherwise be starting from scratch at 3 a.m.
That last part isn't theoretical. During the Parallel protocol incident on May 7, Hypernative's Automated Response paused the relevant contracts within seconds of the attack contract being deployed. At the same time, ION's triage report reached the Parallel team, giving them the full picture of what had happened and why before they'd taken any action themselves. The attacker had positioned to extract $1.52M. None of it moved.
Built on the Same Battle-Tested Detection Engine and Four Years of Onchain Security Expertise
ION isn't a new engine but a way to provide greater access to the Hypernative’s leading engine that’s been in live production for four years.
Underneath every mode sits the same foundation: Hypernative's accumulated expertise, and the ML-powered detection and automated response that has protected onchain operations since day one. That core still does the work, but ION makes it more accessible, deployable, and continuously current for every customer, without waiting on a configuration project to get there.
Just as important, ION doesn't work alone. Our security engineers and your team continue to work alongside it, refining and tuning your environment as your operations evolve. ION handles the scale and the speed; the experts stay in the loop where judgment matters.
What This Looks Like in Practice
For financial institutions and banks building onchain products, ION means a risk map covering contract monitoring, operational wallet security, bridge exposure, mint and burn access controls, and compliance screening, all derived from your actual deployment rather than a template. When regulators or auditors ask for evidence of your security posture, you have a live, measurable view, not a static audit that's already out of date.
For asset managers and funds with positions across multiple protocols and chains, ION surfaces the risks embedded in third-party dependencies: the bridge you route through, the oracle your positions rely on, the pool your capital sits in. These are exactly the risks behind the largest losses of 2026, and exactly the ones most teams have never configured monitors for.
For payment providers and on/off-ramp operators, ION covers infrastructure contract monitoring alongside compliance and fraud controls on payment flows. The Resolv Labs breach in March 2026 came through a cloud infrastructure key used to mint 80M unbacked tokens, an infrastructure gap, not a code vulnerability. Those are the gaps ION is built to find.
For protocols and DAOs, ION compresses what used to take a security engineer days of manual configuration into minutes, and when a critical alert fires, the triage report arrives on its own rather than waiting for someone to start investigating.
Available Now in Early Access
ION is rolling out to a select group of organizations in Early Access. To join the waitlist to see ION in action, request early access here.
Reach out for a demo of Hypernative’s solutions, tune into Hypernative’s blog and our social channels to keep up with the latest on cybersecurity in Web3.
Proactive Security for Onchain Finance.
