GoPlus Security

GoPlus Security is a decentralized security infrastructure layer for Web3, designed to protect users, developers, and blockchains from scams, phishing attacks, malicious tokens, and exploit-laden transactions before they execute. Rather than operating as a centralized scanner, GoPlus functions as an open, permissionless network where security intelligence is contributed and validated across a distributed set of operators and data providers, making it resistant to single points of failure or censorship.

How It Works

GoPlus is organized around three technical layers that work together to intercept and evaluate risk at every stage of an on-chain interaction.

The Security Data Layer aggregates threat intelligence from multiple sources: user-reported data, independent security researchers, third-party organizations, and on-chain forensics. This includes databases of malicious wallet addresses, phishing domains, exploit histories, and known-bad token contracts. Contributors are incentivized to submit accurate data through the network's tokenomics.

The Security Compute Layer processes requests against this data using a distributed network of Actively Validated Service (AVS) Operators — nodes that execute threat detection queries, run transaction simulations, and score risk in real time. Operators stake to participate, aligning their economic incentives with honest computation.

The SecWare Protocol is a developer framework that lets third-party builders deploy their own security modules — anti-scam tools, anti-phishing filters, MEV protection — as Docker containers on the GoPlus network. This allows the security layer to grow modularly without requiring central coordination.

Sitting atop these layers is the GoPlus Security Module (GSM), a unified RPC gateway that intercepts transactions at the sequencer, RPC, or pre-RPC level. Based on a risk assessment, it can approve, block, or route a transaction for user confirmation before anything hits the chain.

Security APIs

GoPlus exposes its threat intelligence through a suite of APIs that developers can integrate directly into wallets, DEX aggregators, block explorers, and dApps. The core offerings include:

• Token Security API: Analyzes token contracts for honeypot traps, hidden mint authority, ownership concentration, trading restrictions, and other risk vectors.
• Malicious Address API: Cross-references wallet addresses against a continuously updated database of flagged actors.
• NFT Security API: Identifies scam NFT contracts and suspicious metadata.
• Approval Security API: Evaluates the risk profile of token approval requests before a user signs.
• dApp Security API: Aggregates risk signals for decentralized applications.
• Signature Data Decode API: Parses raw ABI signatures to surface irregularities in what a user is actually signing.
• Phishing Site Detection API: Blocks known-malicious web domains from initiating transactions.
• Transaction Simulation: Pre-executes a transaction in a sandboxed environment to show the user exactly what will change — balances, approvals, ownership — before they confirm.

As of 2025, GoPlus reports handling over 34.3 million API calls per day across more than 40 blockchains.

Solana Integration

GoPlus expanded onto Solana in September 2024, announcing two purpose-built APIs at the Solana Breakpoint conference.

The Solana Token Security API delivers risk analysis specifically optimized for Solana's token standards — both the original SPL Token standard and the newer SPL-2022 Extension Token standard. It surfaces contract-level security checks, permission and authority analysis, DEX liquidity data, and other signals relevant to the Mint contract model that Solana uses rather than the bytecode-level analysis applied to EVM chains.

The Solana Transaction Simulation API pre-executes transactions before they are broadcast, tracking changes to SOL balances, SPL token holdings, NFT ownership, and token authorization limits. It is specifically engineered to detect and block bypass attempts from sophisticated wallet-drainer tools — a threat category that became prominent on Solana as the ecosystem's transaction volume grew. GoPlus CEO Mike Lee stated at Breakpoint that the goal was to bring the firm's proven multi-chain security expertise to Solana's rapidly expanding developer and user base.

Both APIs were available for immediate developer integration at launch, with documentation at docs.gopluslabs.io. Solscan, the primary Solana block explorer, is among the platforms that have integrated GoPlus security data.

Products and Ecosystem Presence

Beyond APIs, GoPlus offers several end-user and developer-facing products:

GoPlus App is a browser extension and mobile hub that provides wallet scanning, real-time transaction alerts, and access to the SecWare marketplace. As of late 2025 the app reports approximately 125,000 daily active users, protecting roughly 21 million transactions per day worth an estimated $356 million.

DeepScan is an AI-powered smart contract audit product that generates a professional security report in approximately ten minutes, targeting teams that need a fast first-pass assessment before a full manual audit.

SafeToken Protocol provides secure token issuance templates (SafeToken Factory) and a liquidity locker (SafeToken Locker) with configurable lock-up schedules, including price-based unlocking mechanisms. The locker held approximately $52.5 million in TVL as of October 2025.

GoPlus integrations span major ecosystem platforms including MetaMask, Trust Wallet, Backpack, SushiSwap, DexScreener, DEXTools, Etherscan, and Solscan, as well as institutional partners such as Binance and OKX.

Team and Funding

GoPlus Security was founded in 2021 by Mike Lee (CEO), Eskil Xu, and Allen Zhang. Allen Zhang serves as Co-Founder and CTO, overseeing the platform's technical architecture. The project has raised over $14 million across multiple funding rounds from investors including Binance Labs, OKX Ventures, HashKey Capital, Animoca Brands, and Fenbushi Capital.

GPS Token

GoPlus launched its native token, $GPS, in January 2025. The token has a total supply of 10 billion and serves as the network's utility and governance asset: it is used to pay for premium security services, stake to participate as a data contributor or AVS Operator, and vote on protocol governance decisions.

The allocation is weighted toward community and ecosystem growth (approximately 40.7%), with 20% reserved for the team subject to a six-month lockup and two-year vesting schedule, and roughly 19.3% for early backers on similar terms. $GPS launched on Binance and more than 20 other centralized exchanges, accumulating over $5 billion in spot trading volume and $10 billion in derivatives volume through its first year. In mid-2025, GoPlus announced a $500 million GPS Security Fund earmarked to reward community members who identify and report Web3 exploits.

Security and Audit Activity

GoPlus released a public AI Auditing Benchmark in 2025 — a curated dataset of 22 real-world smart contract exploits covering the period from May 2025 through April 2026 — intended as an open evaluation tool for the broader security research community. The network's decentralized operator model, in which AVS nodes stake GPS to validate computations, is designed to make result manipulation economically prohibitive. GoPlus does not publicly list third-party audits of its own smart contracts on its main documentation pages.

Position in the Solana Ecosystem

GoPlus addresses one of the persistent friction points in Solana adoption: the difficulty non-technical users face in evaluating whether a token contract, transaction request, or approval is safe. By exposing Solana-specific threat detection through open APIs, GoPlus allows wallets, explorers, and dApps to surface risk signals directly in the user interface at the moment of decision — without requiring users to manually audit contracts or cross-reference addresses. The platform's integration with Backpack and Solscan brings this capability to two of Solana's most widely used tools.