Hypernative

Hypernative is an enterprise-grade proactive security platform for onchain infrastructure. Founded in 2022 by Gal Sagie (CEO) and Dan Caspi (CTO) — whose combined backgrounds span machine learning, cloud infrastructure, and security engineering at companies including IBM, Google, and Microsoft — the platform is built on the premise that blockchain security must detect and stop threats before funds are at risk, not after.

Rather than auditing code once at deployment and hoping for the best, Hypernative treats security as a continuous operational discipline. The company serves more than 350 organizations including financial institutions, DeFi protocols, custodians, exchanges, wallet providers, and payment processors. Notable clients include Uniswap, Chainlink, Circle, Balancer, and Robinhood Chain.

How It Works

The platform operates across five stages of the transaction lifecycle:

Pre-transaction: Hypernative screens addresses for sanctions compliance, evaluates counterparty risk, and can block interaction with flagged wallets before a transaction is submitted.

Execution: The Transaction Guard product simulates transactions in a sandboxed environment to verify intent — confirming that what a transaction will actually do matches what the user or protocol expects. This layer can enforce custom policy rules for custodians and institutions using multisig or MPC signing infrastructure.

Post-transaction and continuous monitoring: Hypernative ingests onchain and offchain data streams in real time across 75+ blockchains, running those feeds through machine learning models, graph analysis, heuristics, and simulation engines. The system tracks more than 300 distinct risk types: smart contract exploits, governance attacks, bridge security events, market manipulation, price oracle manipulation, private key compromise, frontend phishing, and mempool anomalies, among others.

Automated response: When a threat is detected, Hypernative can trigger pre-authorized actions without waiting for human approval. Typical automated responses include pausing smart contracts, transferring funds to safe addresses, unwinding DeFi positions, or invoking custom logic via webhooks. This autonomous capability is what distinguishes Hypernative from alert-only monitoring services — the false positive rate is below 0.001%, which makes automated execution practical without generating disruptive noise.

Wallet protection and user-level security: Beyond protocol monitoring, Hypernative offers a consumer-facing Wallet Protect product that extends phishing detection and scam-blocking to retail and institutional wallet users.

Key Features and Products

The core Hypernative Platform ships with 300+ pre-built detection templates covering the most common attack patterns. Users can extend coverage through a no-code Agent Builder — a visual interface for constructing custom monitoring logic — or through a Python SDK for teams that prefer programmatic configuration.

Alerts route to wherever security teams already work: Slack, Telegram, Discord, PagerDuty, OpsGenie, email, webhooks, and REST API endpoints. For protocols using Safe multisigs or Fireblocks custody infrastructure, Hypernative integrates directly into the signing flow.

In 2026, Hypernative introduced ION, an AI orchestrator that maps a protocol's onchain risk surface, deploys appropriate detections automatically, and adapts the configuration as the protocol evolves. ION draws on patterns learned across Hypernative's entire customer base. Human approval is required for each action ION proposes, keeping teams in control while reducing the configuration burden for new customers.

Track Record and Metrics

Hypernative reports that its platform has saved more than $3 billion in funds that would otherwise have been lost to exploits and fraud. The platform's stated detection rate for hacks is 99.8%, with a false positive rate below 0.001%. In 2024 alone, the system detected attacks across over $2.2 billion in potential losses — a 22% increase over the prior year as exploit activity grew industrywide. Total assets under monitoring exceed $100 billion.

A real-world example from Balancer illustrates the operational model: Hypernative continuously monitors Balancer's contracts and has permission to automatically pause pools if anomalous activity is detected mid-exploit. Liquidity providers retain the ability to withdraw even when pools are paused, so the protective action does not trap funds.

Funding

Hypernative closed a $16 million Series A in September 2024. In June 2025, the company raised a $40 million Series B co-led by Ten Eleven Ventures and Ballistic Ventures. The Series B funds are directed toward expanding fraud prevention capabilities and extending the wallet-level protection product to individual users.

No Native Token

Hypernative does not have a native token. It is a B2B security infrastructure business that sells platform access to protocols, institutions, and enterprise customers.

Solana Ecosystem Fit

Solana's architecture — high throughput, low-latency block times, and a large DeFi and liquid staking ecosystem — creates a demanding environment for security monitoring. Hypernative extended its coverage to Solana alongside other major networks, providing monitoring for Solana-native infrastructure including bridges, multisig wallets, treasury accounts, and token allocations.

For Solana-based protocols the monitoring surfaces are broadly similar to other chains: governance parameter changes that could introduce risk, large token movements that deviate from normal patterns, wallet behavior associated with phishing campaigns, and smart contract states that indicate exploitation attempts. Hypernative's cross-chain architecture means a Solana protocol can be monitored from the same dashboard used for any EVM or other non-EVM network, with consistent alert logic and response tooling across the full stack.

The platform's relevance within Solana's ecosystem sits at the infrastructure layer: it is not a retail product or a consumer application, but a security operations tool for teams building or managing assets on Solana who need continuous threat visibility rather than point-in-time code audits.