Known-threat-actor cluster has touched protocol
A threat intelligence & recon factor in the v1.7.0 rubric. Measured per protocol on a rt cadence.
Methodology how we score #
**What this measures** This real-time signal fires when an address from a curator-maintained threat-actor cluster — comprising past exploiters, labeled attacker families, and sanctioned addresses — has interacted with the monitored protocol within the trailing 30 days. The threat-actor cluster is drawn from Chainalysis TRM labels, OFAC SDN list entries, curator-maintained attacker address lists derived from post-mortem analysis, and known DPRK/Lazarus wallet sets. Category 11 context: attacker-side reconnaissance precedes the majority of DeFi exploits; a known threat actor interacting with a protocol is the highest-confidence forward-looking threat intelligence signal available.
**Why it matters** The T-01 synthesis documents approximately eight in-sample hack precedents where known-threat-actor addresses were interacting with target protocols before the exploit. Radiant Capital II ($53M, 2024) included a failed exploit attempt six days before the successful attack — if the attacker address were labeled from the failed attempt, a second interaction would have triggered this signal. Post-mortem analysis consistently identifies attacker addresses that were active in earlier hacks — attacker address reuse across protocols is documented. The signal is P0 because a labeled threat actor probing a protocol is the most actionable pre-exploit intelligence available, regardless of the absence of on-chain vulnerability evidence.
**Green / Yellow / Red** Green is the baseline when no known-threat-actor cluster addresses have interacted with the protocol in the trailing 30 days per the current cluster feed. Yellow fires when a medium-confidence threat-actor address (curator-labeled but not OFAC-sanctioned) interacts with the protocol — elevated but potentially a coincidental interaction. Red fires when a high-confidence labeled threat-actor address (OFAC SDN, Chainalysis-confirmed exploiter, or prior DPRK-attributed address) interacts with the protocol within the trailing 30 days.
**Common gray cases** Gray applies when the cluster feed has not been updated within 30 days (stale data) or when the protocol operates on a chain where cluster coverage is materially incomplete, making the absence of hits unreliable as a green signal.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Detect whether an address from the curator-maintained threat-actor cluster (past exploiters, labeled attacker families) interacted with this protocol in the last 30 days.