When a protocol gets exploited, the loss does not end at the moment funds leave the contract. A second clock starts immediately, measured by how fast stolen assets can be moved, bridged, mixed, and placed beyond recovery. zeroShadow operates inside that window. In a recent conversation on The Security Table, co-founder Colin Graham walked through how his team turns raw on-chain activity into intelligence that response teams can act on, why the laundering playbook has barely changed in years, and where the industry still falls short.

The episode is a useful counterpart to the prevention-side work most of this audience focuses on. Stopping an exploit before deployment and tracking funds after one are different disciplines, but they share a common lesson. Tooling matters, and tooling alone does not finish the job.

Speed and Trust Are the Hard Part

Graham frames threat intelligence as a neutral distribution layer, something that can feed many tools and teams rather than living inside a single product. The raw material is familiar to anyone who works in security: wallet clusters, attacker infrastructure, and exploit patterns. The challenge is not collecting that data. The challenge is delivering it to the teams that need it, in a timely manner, from a source they trust.

Speed and accuracy have traditionally pulled against each other. Getting verified intelligence from a trusted source, quickly, has proven difficult across the largest hacks. Plenty of people can produce the data after the fact. Far fewer can produce it fast enough to matter. zeroShadow's response was to build a threat intelligence platform designed to move at the speed of the blockchain itself, which in many cases is very fast.

What the Data Actually Looks Like in the Wild

The intelligence comes from direct involvement in live incidents. When a hack happens, affected teams tend to reach zeroShadow quickly. War rooms get established, the team enters, and the work begins: figuring out what happened, stopping the loss, and putting a plan in place to interrupt the laundering of stolen assets.

In practice that means using analytics tools to map asset flows across the chain, identifying where funds are heading, and coordinating with the teams that hold custodial access in order to stop those assets from moving. The bottleneck Graham points to is distribution. Pushing this information through Telegram and email channels is inefficient, especially for small teams that lack a deep compliance function, and worse for teams without 24-7 staffing on those channels.

The fix he describes is programmatic rails for intelligence, paired with pre-agreed response procedures. When a signal arrives showing illicit flows, a team that has already decided how it handles that signal can take proactive steps to stop laundering rather than scrambling to interpret an alert in the moment.

The Laundering Playbook Has Not Changed Since Ronin

Graham entered the space in 2022, with the Ronin bridge hack as his introduction. The detail he finds most striking is how little has changed since. The way North Korea and established organized crime groups launder assets plays out in roughly the same shape it did then. The logic is simple. When a method keeps working, there is no reason to abandon it. Bridges, mixers, and the other obfuscation tools that make flows hard to track are still in heavy use because they continue to deliver results.

What is missing, in his view, is a shared knowledge base and a clearer connection with decentralized services. Many services lack visibility into how their infrastructure is being used during these events, and into whether they have a role to play in responding. He points to the recurring pattern on crypto social media where a team celebrates a token taking off while people in the security space already understand what is driving the activity. Forewarning and visibility would let those teams make different choices, but only if the right questions can reach them in the first place.

The laundering does iterate at the edges. Attackers tweak protocols, swap one decentralized service for another, and move between platforms, often in response to a service taking action that frustrates them. From a high level the pattern looks the same. The practical requirement for defenders is to match that pace, so that when attackers adopt a new service, the response moves quickly enough to close that path.

Tooling Is Necessary, and Not Sufficient

The most transferable point in the conversation is about the limits of automation. Threat intelligence is reactive by nature, built on attacker behavior already observed in the wild. Making it useful requires early dialogue, communication between teams, and trust.

Graham is direct about a common failure mode. It is possible to hand a team software that monitors everything and tell them to sign up. That does not answer the harder question of what happens when an alert fires. Seeing a signal and knowing what to do with it are different capabilities. The industry has a tendency to assume technology will solve the whole problem, when the reality is a combination of strong tooling and human judgment. zeroShadow builds its intelligence with a human in the loop and a 24-7 team, and Graham's advice to teams serious about their defenses is to find a partner that covers the human side, not only the technical side.

That maps cleanly onto how layered security works on the prevention side as well. Automated analysis catches a large class of issues early and continuously, and human expertise carries the cases that judgment alone can resolve. Neither half stands on its own.

The Gap That Remains Is Data Sharing

Asked for his hot take on what security still gets wrong, Graham landed on collaboration. The field does not share intelligence openly and willingly often enough. He is careful to credit the work already done by law enforcement, private investigators, and compliance teams. His point is that combating large incidents as a genuine partnership requires shared platforms and a willingness to open up data, whether through public-private partnerships or private investigation teams working side by side.

He also raises the friction created by frameworks like GDPR, and argues for looking past them where the safety and security of others is at stake. Without better data sharing, the same outcomes repeat: victims are exploited, assets move, and defenders lose the chance to intervene and help with recovery.

Where This Connects to Pre-Deployment Security

zeroShadow works downstream of the work Olympix focuses on. One discipline tries to keep exploitable code from reaching production. The other tracks funds and supports recovery once an exploit has already happened. The through-line across both is that effective security is layered and continuous, and that tooling earns its value as part of a larger system rather than as a replacement for one. Audits are necessary but not sufficient. Monitoring is necessary but not sufficient. The same holds for threat intelligence. What closes the gap is fast, trusted information feeding teams that already know how to act on it.

When a protocol gets exploited, the loss does not end at the moment funds leave the contract. A second clock starts immediately, measured by how fast stolen assets can be moved, bridged, mixed, and placed beyond recovery. zeroShadow operates inside that window. In a recent conversation on The Security Table, co-founder Colin Graham walked through how his team turns raw on-chain activity into intelligence that response teams can act on, why the laundering playbook has barely changed in years, and where the industry still falls short.

The episode is a useful counterpart to the prevention-side work most of this audience focuses on. Stopping an exploit before deployment and tracking funds after one are different disciplines, but they share a common lesson. Tooling matters, and tooling alone does not finish the job.

Speed and trust are the hard part

Graham frames threat intelligence as a neutral distribution layer, something that can feed many tools and teams rather than living inside a single product. The raw material is familiar to anyone who works in security: wallet clusters, attacker infrastructure, and exploit patterns. The challenge is not collecting that data. The challenge is delivering it to the teams that need it, in a timely manner, from a source they trust.

Speed and accuracy have traditionally pulled against each other. Getting verified intelligence from a trusted source, quickly, has proven difficult across the largest hacks. Plenty of people can produce the data after the fact. Far fewer can produce it fast enough to matter. zeroShadow's response was to build a threat intelligence platform designed to move at the speed of the blockchain itself, which in many cases is very fast.

What the data actually looks like in the wild

The intelligence comes from direct involvement in live incidents. When a hack happens, affected teams tend to reach zeroShadow quickly. War rooms get established, the team enters, and the work begins: figuring out what happened, stopping the loss, and putting a plan in place to interrupt the laundering of stolen assets.

In practice that means using analytics tools to map asset flows across the chain, identifying where funds are heading, and coordinating with the teams that hold custodial access in order to stop those assets from moving. The bottleneck Graham points to is distribution. Pushing this information through Telegram and email channels is inefficient, especially for small teams that lack a deep compliance function, and worse for teams without 24-7 staffing on those channels.

The fix he describes is programmatic rails for intelligence, paired with pre-agreed response procedures. When a signal arrives showing illicit flows, a team that has already decided how it handles that signal can take proactive steps to stop laundering rather than scrambling to interpret an alert in the moment.

The laundering playbook has not changed since Ronin

Graham entered the space in 2022, with the Ronin bridge hack as his introduction. The detail he finds most striking is how little has changed since. The way North Korea and established organized crime groups launder assets plays out in roughly the same shape it did then. The logic is simple. When a method keeps working, there is no reason to abandon it. Bridges, mixers, and the other obfuscation tools that make flows hard to track are still in heavy use because they continue to deliver results.

What is missing, in his view, is a shared knowledge base and a clearer connection with decentralized services. Many services lack visibility into how their infrastructure is being used during these events, and into whether they have a role to play in responding. He points to the recurring pattern on crypto social media where a team celebrates a token taking off while people in the security space already understand what is driving the activity. Forewarning and visibility would let those teams make different choices, but only if the right questions can reach them in the first place.

The laundering does iterate at the edges. Attackers tweak protocols, swap one decentralized service for another, and move between platforms, often in response to a service taking action that frustrates them. From a high level the pattern looks the same. The practical requirement for defenders is to match that pace, so that when attackers adopt a new service, the response moves quickly enough to close that path.

Tooling is necessary, and not sufficient

The most transferable point in the conversation is about the limits of automation. Threat intelligence is reactive by nature, built on attacker behavior already observed in the wild. Making it useful requires early dialogue, communication between teams, and trust.

Graham is direct about a common failure mode. It is possible to hand a team software that monitors everything and tell them to sign up. That does not answer the harder question of what happens when an alert fires. Seeing a signal and knowing what to do with it are different capabilities. The industry has a tendency to assume technology will solve the whole problem, when the reality is a combination of strong tooling and human judgment. zeroShadow builds its intelligence with a human in the loop and a 24-7 team, and Graham's advice to teams serious about their defenses is to find a partner that covers the human side, not only the technical side.

That maps cleanly onto how layered security works on the prevention side as well. Automated analysis catches a large class of issues early and continuously, and human expertise carries the cases that judgment alone can resolve. Neither half stands on its own.

The gap that remains is data sharing

Asked for his hot take on what security still gets wrong, Graham landed on collaboration. The field does not share intelligence openly and willingly often enough. He is careful to credit the work already done by law enforcement, private investigators, and compliance teams. His point is that combating large incidents as a genuine partnership requires shared platforms and a willingness to open up data, whether through public-private partnerships or private investigation teams working side by side.

He also raises the friction created by frameworks like GDPR, and argues for looking past them where the safety and security of others is at stake. Without better data sharing, the same outcomes repeat: victims are exploited, assets move, and defenders lose the chance to intervene and help with recovery.

Where This Connects to Pre-Deployment Security

zeroShadow works downstream of the work Olympix focuses on. One discipline tries to keep exploitable code from reaching production. The other tracks funds and supports recovery once an exploit has already happened. The through-line across both is that effective security is layered and continuous, and that tooling earns its value as part of a larger system rather than as a replacement for one. Audits are necessary but not sufficient. Monitoring is necessary but not sufficient. The same holds for threat intelligence. What closes the gap is fast, trusted information feeding teams that already know how to act on it.

Most exploits trace back to code that should never have shipped. Olympix embeds security testing directly into the development lifecycle, catching exploitable bugs before deployment so fewer incidents ever reach the response stage. Book a free demo.