DeFi Security Alliances: SEAL, OPSeC and Crypto ISAC

By Owen ThurmPublished November 14, 202611 min read

Quick answer. There is no single DeFi Security Alliance. SEAL runs the SEAL 911 hotline, Safe Harbor and SEAL-ISAC; OPSeC is a 2026 coalition for open resources and policy; Crypto ISAC shares threat intelligence among members; BSSC writes standards.

Watch: DeFi Security Alliances: SEAL, OPSeC and Crypto ISAC 1:52

Video transcript

There is no single DeFi security alliance. Each group does a different job, and calling the wrong one costs time in an incident.

SEAL runs SEAL 911, a free emergency hotline. Safe Harbor pre-authorises whitehat rescues. SEAL-ISAC shares threat intelligence, and SEAL Certifications assess controls.

SEAL reports over 180 million dollars rescued, a self-reported total. Responders are volunteers, working as bandwidth allows.

OPSeC, convened by the DeFi Education Foundation, launched in June 2026. It offers open resources, training and a policy bridge, not an emergency desk.

Crypto ISAC is a separate member network for threat intelligence. BSSC writes standards. TRM's Beacon Network alerts exchanges when tagged funds arrive. Treasury's OCCIP serves U.S. firms, and JPCrypto-ISAC serves Japan.

Match the group to the moment. Call SEAL 911 during an exploit. Adopt Safe Harbor and join networks beforehand.

Membership adds people, not sight. A Guardian informational finding for Gamma lists admin functions, including pause and unpause, that emit no events. Monitors would miss them, and so would anyone you call.

Before you need them, save the SEAL 911 bot, decide on Safe Harbor, name who triages intelligence, emit events for privileged changes, and staff every Critical alert.

Alliances help once you know something is wrong. Guardian Managed Security watches your contracts, multisigs, cloud and DNS around the clock. Read the full guide, or talk to Guardian.

No Single DeFi Security Alliance

Search for a DeFi security alliance and you will find several groups, not one. Each was built for a different job. Security Alliance, DeFi Education Foundation, Crypto ISAC

In a Talking Tokens interview reported on November 3, 2026, Binance founder Changpeng Zhao (CZ) called for an industry security alliance to share practices, run cross-audits and coordinate faster freezes. The reports describe a proposal, not a formed body. TechFlow, PANews, carrying ChainCatcher's interview compilation

An earlier freeze alliance has ended. TRON DAO confirmed that T3 FCU, set up by Tether, TRON and TRM Labs in 2024, has concluded; Bloomberg's source dates the closure to late August 2026. Tether, Bloomberg, republished by Insurance Journal

A team that calls an intelligence network when it needs a war room loses time in the first hour.

Three names cause most of the confusion: SEAL, the OPSeC coalition and Crypto ISAC. SEAL helped convene OPSeC, but they have different operators.

SEAL: The Security Alliance

Security Alliance, known as SEAL, is a 501(c)(3) nonprofit that describes itself as a crypto ISAC. Its main programs are SEAL 911, SEAL Intel, SEAL Frameworks and SEAL Certifications. Security Alliance

SEAL 911 is the emergency line. SEAL describes it as a free, around-the-clock hotline for anyone facing an active or imminent incident.

Tickets go through its Telegram bot. SEAL reports 3,300+ tickets, 200+ war rooms, $180M+ rescued and 31 volunteer responders, all self-reported totals.

The responders are volunteers, admitted by invitation, with at most two per commercial organisation. Requests are handled as bandwidth allows, and SEAL 911 sells no paid services.

How to reach the bot and what to send is in our guide to SEAL 911.

Safe Harbor is the pre-incident piece. Before any exploit, a protocol adopts an onchain agreement that authorises whitehats to rescue funds while the exploit runs.

SEAL's summary terms: rescued funds return within 72 hours, for a bounty of 10% capped at $1M. It reports 33 adopters and $60B+ protected across 10+ chains.

SEAL-ISAC launched on April 18, 2024, for member threat-intelligence sharing, analyst alerts, playbooks, coordinated response through SEAL 911 and education. The launch announcement called membership free. Security Alliance Radar

At launch, SEAL said members would share observables such as wallet addresses on OpenCTI. Early participants named then included MetaMask, Uniswap Labs, Chainalysis and the Ethereum Foundation.

It is still active. SEAL's GitHub organisation lists it, and SEAL's November 11, 2026 weekly stats offer readers a direct SEAL-ISAC data feed.

SEAL Certifications is an assurance route, not a hotline. Accredited auditors assess modules such as incident response, multisig, treasury, identity and accounts, and DNS, with results recorded onchain.

How it sits next to SOC 2, CCSS and BSSC is in our security standards comparison.

The OPSeC Coalition

OPSeC, the Open Protocol Security Coalition, launched on June 23, 2026. The DeFi Education Foundation convenes it, with Asymmetric Research and SEAL as partners. DeFi Education Foundation

It is the most policy-facing group here. Its page describes a free, chain-agnostic resource hub, regular expert convenings and a bridge to policymakers.

On November 13, 2026, its page showed 31 organisations under Joined by, including Aave, Solana Labs, Wormhole, Ava Labs, Wintermute and Phantom.

OPSeC is not an emergency desk. Its public pages publish no response service, service terms or fee, so signing its pledge is not certification or incident cover.

Do not confuse it with team OpSec, the security of people and devices. Our OpSec baseline for crypto founders covers that.

Participation works through a public pledge, with commitments set by role:

Companies: align internal security resources, nominate people, disclose practices, share experiences and join trainings.
Builders: embed security in product development, join trainings and pilot OPSeC tooling.
Investors: require portfolio companies to prioritise security and encourage founders to take part.

Crypto ISAC

Crypto ISAC is a separate organisation from SEAL-ISAC, despite the similar name. It launched on May 29, 2024, as a 501(c)(6) nonprofit, and calls itself vetted and member-driven. Crypto ISAC, Security Alliance Radar

Exchanges, custodians, protocols, regulators and other stakeholders may join. Members get curated threat intelligence, alerts, resilience guidance, workshops and an expert community.

Its board includes security leaders from Coinbase, Circle, Kraken, Consensys and Trail of Bits, plus representatives from Offchain Labs and Evertas.

Its members page shows a founding and charter tier, with Phantom as the first Charter Member. No dues or fee schedule appears on its membership pages.

Its public pages also omit response-time guarantees and full confidentiality terms. Ask for them, and for pricing, before you share sensitive incident data.

Other Crypto Security Groups

These groups are not hotlines either.

The Blockchain Security Standards Council writes standards rather than handling incidents. Its catalogue covers smart contracts, the transaction lifecycle, nodes, key management, token integration and general security. Blockchain Security Standards Council

Its Transaction Lifecycle Security Standard v1 is dated October 22, 2026, and Smart Contract Security Standard v2 is dated November 2, 2026.

TRM Labs runs Beacon Network, launched on August 20, 2025. Founding participants included Coinbase, Binance, Kraken, OKX and Crypto.com, alongside payments firms and custodians. TRM Labs

Verified investigators flag crime-linked addresses, and participating exchanges or issuers get alerts when tagged funds arrive. Each platform then reviews the deposit and can hold it before withdrawal.

TRM's page, read November 13, 2026, says basic Affiliate membership, with essential alerts, is free for verified exchanges and crypto service providers. Partner access adds all tagged addresses and historical data.

After T3 FCU closed, Tether told Bloomberg it was taking part in Beacon and would keep cooperating with TRM. Bloomberg, republished by Insurance Journal

Treasury's cyber office, OCCIP, launched a digital-asset information-sharing initiative on April 9, 2026. Eligible U.S. digital-asset firms and industry groups receive its threat information at no cost; interested firms contact OCCIP-Coord@treasury.gov. U.S. Department of the Treasury

Treasury vets each applicant on identity, U.S. legal status, regulatory status, cybersecurity maturity and ability to protect non-public information. Its products cover sector threats, vulnerabilities, threat-actor profiles and live campaigns. Federal Register, U.S. Department of the Treasury, U.S. Department of the Treasury, OCCIP

JPCrypto-ISAC serves Japan's crypto industry. It was established on January 17, 2025, and announced its launch on March 7, 2025. JPCrypto-ISAC

It shares threat intelligence and incident cases, sets common practices and coordinates on standards. Its full members include bitFlyer, Coincheck and bitbank.

Its English page does not describe links with SEAL-ISAC or Crypto ISAC. Treat it as the local channel for Japanese exchanges.

Which to Join or Call

Match the group to the moment. The table sorts them by the job each one does, and what it cannot replace.

Need	Go to	Timing	Not a substitute for
Active or imminent exploit	SEAL 911	During the incident	A retained response provider
Pre-agreed whitehat rescue	SEAL Safe Harbor	Adopt before any exploit	Your own pause and freeze paths
Recurring threat intelligence	SEAL-ISAC or Crypto ISAC	Apply before an incident	Monitoring of your own systems
U.S. government threat information	Treasury OCCIP initiative	Apply before an incident	Peer ISACs or your own monitoring
Alerts when stolen funds reach a platform	TRM Beacon Network	Exchanges and issuers, before an incident	Your own freeze requests to issuers
Open resources, training, policy	OPSeC	Pledge any time	Certification or incident cover
Documented control baselines	BSSC standards or SEAL Certifications	Before diligence or a bank review	Live detection
Japanese exchange coordination	JPCrypto-ISAC	For Japan-focused firms	Global intelligence networks

Make Membership Useful

Every group above relies on your team to notice an incident and describe it fast. Membership adds people; it does not add sight.

Guardian's public MultiPositionManager report for Gamma shows the gap. Finding I-16 lists admin and configuration functions, including one contract's pause and unpause, that emit no events. Guardian

The finding was Informational and acknowledged. Still, a monitor listening for those events would miss the change, and so would anyone you call.

For roles, pause authority and contacts, use our DeFi incident response plan. Exchanges should start from the crypto exchange incident response plan.

The last step below is the job of Web3 MDR. Before you need any of these groups:

Save the SEAL 911 bot, verified against securityalliance.org, in your incident contacts. Security Alliance
Decide on Safe Harbor, and name a recovery address and a contact someone checks at any hour.
Name who joins each intelligence network and who triages what it sends.
Pick which SEAL Certifications modules match your incident response and multisig setup.
Emit events for every privileged change, so monitors and responders can see it.
Put an awake person on every Critical alert, around the clock.

Frequently Asked Questions

Does Safe Harbor guarantee legal protection for whitehats?

No public summary settles that for every jurisdiction. SEAL points participating researchers to the Security Research Legal Defense Fund, but each protocol's adoption and the agreement text set the terms. Have counsel review scope and jurisdiction before you adopt. Security Alliance

How does an organisation join SEAL-ISAC?

SEAL's latest published instruction, from October 2024, points applicants to isac.securityalliance.org/app. That post describes a SEAL-ISAC database for sharing information on suspected DPRK IT workers. The 2024 launch welcomed exchanges, blockchain projects, wallet providers, mining operators, security firms and compliance specialists. Security Alliance Radar

Does SEAL 911 trace stolen funds over the long term?

Not through SEAL 911 itself. Its repository names member firms for long-running tracing, Tracelon, Cryptoforensic Investigators and zeroShadow, which are separate commercial engagements you arrange yourself. Security Alliance

Sources

Have someone watching before you call for help

Alliances coordinate help once you know something is wrong. Guardian Managed Security watches your contracts, multisigs, signing services, cloud, CI/CD, frontends and DNS around the clock, with engineers who know your system.

Talk to Guardian Explore the service