Crypto security enforcers face off in ‘popularity contest’ for white hats

Crypto security nonprofit Security Alliance, known as SEAL, is holding the 2025 Safe Harbor Champion Awards, where nominated companies and organizations will face off to see who used its white hat protection framework best.

According to a Wednesday X post announcing the contest, the awards will include 29 nominees, split into two categories: adopters and advocates. Voting has already opened on X, with the public encouraged to support nominees by interacting with campaign posts through likes, reposts, or replies.

SEAL co-leads Dickson Wu and Robert MacWha said the initiative stems from the Safe Harbor Agreement, first introduced in 2024, to protect white hats who intervene during active exploits on blockchain networks. 

4/ Find your favorite nominees’ post & start voting now! You can vote on as many posts as you want.#SafeHarborChampion2025 pic.twitter.com/m5lzzLqimd

— Security Alliance (@_SEAL_Org) October 1, 2025

As seen in the SEAL Safe Harbor forum, the framework is a set of rules for both hackers and projects, which shield those who seize stolen funds for safekeeping from criminal liability.

SEAL opens voting on awards through social media

The non-profit Web3 security platform has dubbed the campaign “a public popularity contest.” SEAL stated that every social interaction counts as a vote, with no limits on the number of nominees a user can support.

“This is about creating visibility and social pressure,” the group posted on X. “When competitors are recognized, others will want to implement Safe Harbor too.”

The organization believes that adopting its Safe Harbor framework is imperative for the safety of the entire crypto industry. According to SEAL, when white hats act without fear of legal retaliation, exploits are “stopped faster” and “fewer users lose funds.”

“Every organization that implements Safe Harbor makes the entire ecosystem more secure. This is how we get there,” SEAL wrote.

Companies nominated in the Adopters category feature decentralized finance platforms and protocols that have formally adopted the SEAL Whitehat Safe Harbor, including Alchemix, Balancer, Cantina, ENS Domains, Ensuro, Immunefi, Inverse Finance, Origin Protocol, PancakeSwap, Pareto Credit, Pendle, Polymarket, Sandclock, Silo Finance, Singularity, Uniswap Foundation, and zkSync.

In the Advocates category, SEAL nominated venture capital firms such as a16z Crypto, Paradigm, and Dragonfly; law firms Cooley LLP and Debevoise; advocacy groups like LeXpunK Army and PowerhouseDAO.

Other nominees in the latter category include the Filecoin Foundation and cybersecurity company Osec. SEAL has lauded these groups for promoting Safe Harbor and sparking more conversations about white-hat protection, while encouraging more firms to onboard the “ethical hackers.”

White hat hackers recover billions from crypto network exploits

SEAL currently counts 79 volunteer white hat hackers able to respond to active threats in the crypto ecosystem. As of October 1, 14 decentralized finance protocols holding roughly $20 billion in total value had adopted the Safe Harbor framework, according to data from DefiLlama. 

The adopters include several of the sector’s largest platforms, such as Pendle, a yield derivatives protocol managing $10 billion, and Uniswap, the top-most decentralized exchange by volume in the last month, with close to $6 billion in locked deposits.

One of the well-known white hats on social media is the pseudonymous hacker c0ffeebabe.eth, who intervened in the April 2024 Morpho App exploit. c0ffeebabe.eth used a Maximal Extractable Value (MEV) bot to front-run a malicious transaction and intercept $2.6 million stolen from Morpho. 

A year earlier, the hacker returned $5.4 million worth of Ether to Curve Finance users after a breach, and 300 ETH from a smart contract exploit targeting SushiSwap.

In August 2024, good-faith hackers withdrew and returned $12 million worth of Ether and USDC during the Ronin bridge incident. 

More recently, SEAL coordinated a response to the NPM supply chain attack in the first half of 2025, which compromised JavaScript software libraries. Cryptopolitan reported that a JSCEAL malware campaign had mimicked over 50 crypto platforms to harvest data from users who downloaded the spoofed apps. 

As a result of the malware NPM supply chain attack, some tokens, including BRETT, DORKY, VISTA, and GONDOLA, were scooped by hackers. However, SEALs mounted a collective defense that limited total losses to under $500. 

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.