Sui and security provider ChainPatrol have blocked 3,023 phishing, impersonation and other malicious threats targeting users across the blockchain’s wider ecosystem. Half of the identified threats were malicious web domains or URLs, making conventional Web2 infrastructure the largest attack surface in the campaign. Sui disclosed the latest figure through an official ecosystem update, extending a security partnership that initially reported just 842 blocked threats in November 2025.
ChainPatrol’s latest breakdown attributes another 23% of the 3,023 cases to X, 7% to Medium, 6% to Telegram and 5% to YouTube. Malicious on-chain addresses represented 3%, with other platforms accounting for the remaining reported share. The figures show that most of the threat activity sits outside Sui’s consensus layer and instead targets the places where users discover projects, follow support accounts and connect wallets.
Keeping users safe is a constant effort at Sui.
3,023 impersonation and phishing threats removed with @ChainPatrol.
See something pretending to be Sui? Send it to them. 👇 https://t.co/yumeHhvof6
— Sui (@SuiNetwork) September 30, 2026
ChainPatrol Extends Security Beyond Smart Contracts
The partnership forms part of Sui Foundation’s $10 million Ecosystem Security Expansion Initiative, a multi-year program launched in 2025 to strengthen defenses beyond conventional smart-contract audits. ChainPatrol provides monitoring for more than 30 Sui projects, scanning domains, social networks, messaging services, app stores and other digital surfaces. The program is intended to detect malicious infrastructure before users interact with it rather than waiting for an on-chain transaction to reveal an attack.
ChainPatrol says it combines AI and image recognition with human review to find lookalike domains, cloned accounts and other forms of brand impersonation. Once confirmed, malicious domains can be added to blocklists distributed through integrations with crypto wallets and major browsers, while takedown requests are sent to the platforms or hosting providers involved. Blocking and removal are separate stages: a phishing domain can be made inaccessible through security integrations before its registrar or host actually takes it offline.
That user-facing protection addresses a different security boundary from failures inside blockchain applications. Recent incidents across crypto have shown how vulnerabilities can arise from standing wallet approvals left active after users stop interacting with an application, while other breaches originate in administrative controls rather than underlying token contracts. Sui’s ChainPatrol integration focuses instead on social engineering and external impersonation, complementing rather than replacing audits and protocol-level controls.
Sui Expands a Multi-Layer Security Strategy
The $10 million program also funds audits, formal verification, bug bounties, transaction simulation and malicious-app detection. Sui Foundation said the initiative was designed after recognizing that significant ecosystem threats increasingly arise through applications, wallets, dependencies and administrative systems rather than attacks on the base protocol itself. ChainPatrol represents the external-threat layer of a broader security architecture rather than the entirety of Sui’s security program.
That broader distinction became particularly visible after Sui experienced separate mainnet halts caused by upgrade-related software bugs. Those incidents involved validator and protocol reliability, whereas ChainPatrol’s 3,023 cases concern malicious actors attempting to reach users through impersonation, phishing and fraudulent online infrastructure. Combining the two under a generic “security incidents” label would obscure fundamentally different failure modes and remediation strategies.
The growth from 842 blocked threats in November 2025 to 3,023 today also should not be interpreted automatically as evidence that phishing against Sui has tripled. Expanded monitoring, more protected projects and longer observation time can all increase the cumulative count. What the figure does demonstrate is that phishing and impersonation have become persistent enough for Sui to treat external brand protection as shared ecosystem infrastructure rather than leaving every application to defend itself independently.
That makes the security model increasingly layered: protocol safeguards protect the chain, audits and formal verification address application code, while monitoring services target the fake websites and accounts designed to bypass both. The 3,023 blocked threats are ultimately a measure of that last line of defense, where preventing a convincing fake link from reaching a wallet can matter just as much as securing the smart contract behind the real application.
Liam Foster follows crypto markets from France, with a close eye on Bitcoin, Ethereum, Layer 1 assets, derivatives, sentiment and smart money flows. His coverage looks past the daily price move to understand what is happening underneath: liquidity, leverage, positioning and the behavior of larger players.
Liam’s style is calm, sharp and deliberately anti-crystal-ball. He does not frame every market move as a breakout or collapse. Instead, he focuses on what the data can actually support, where traders may be crowded and when a signal deserves attention without becoming a prediction.