zeroShadow
zeroShadow is a Web3 security and incident response firm founded in 2024 by ex-Chainalysis cybercrime investigators, serving 120+ crypto exchanges, DeFi protocols, and VASPs with preventative security (TORCH), 24/7 investigations, threat intelligence (zS TIP), and GRC consulting.
- Company typePrivate
- Founded2024
- HeadquartersMiami, United States
- Headcount11–50
- GTM typeB2B
- OfferingServices
What zeroShadow does
zeroShadow is a privately held Web3 security and incident response company founded in Spring 2024 by four former Chainalysis cybercrime investigators (Casey — CEO, Julia — Investigations, Colin — Threat Intelligence, Jarno — Operations & Finance). The company provides end-to-end security across the full lifecycle — Prevent, Prepare, Respond, Recover — for cryptocurrency exchanges, DeFi protocols, VASPs, and Web3 enterprises. Its service portfolio is organized into four pillars: TORCH (a preventative security bundle including a virtual Security Operations Center, Customer Care Program, and Financial Services Support); Investigations (global 24/7 incident response with 70+ years of combined team experience covering malware disassembly, blockchain forensics, expert testimony, and law enforcement liaison); Security Consulting & Implementation (GRC as a Service covering SOC 2, ISO 27001, and CCSS, plus VIP Protection and Virtual CISO services); and the zeroShadow Threat Intel Platform (zS TIP), a real-time threat intelligence distribution network that onboarded 25+ VASPs within two months of its April 2026 launch.
zeroShadow's core technology centers on a blockchain forensics and threat intelligence stack. The proprietary zS TIP functions as a neutral distribution layer delivering high-fidelity, evidence-backed threat signals (address screening in under 10 seconds) to virtual asset service providers without vendor lock-in. The company has built integrations and partnerships across 15+ technology providers (Hypernative for 40+ blockchain coverage, Tenderly for L2 rollup monitoring, Innerworks for device fingerprinting and AI threat intel, Quantstamp and Trail of Bits for smart contract audits, Hexagate for blockchain intelligence, and Range for blockchain tooling). The team operates as an extension of clients' security functions with 24/7 global coverage and participates in industry coalitions including SIRN, SEAL911, and the Crypto Defenders Alliance.
zeroShadow generates revenue through three primary streams: professional services for incident response and fund recovery (often inbound from hack/scam victims via SEAL911 on Telegram or website contact), managed security and consulting retainers (TORCH packages, GRC as a Service, VIP Protection, vCISO), and subscription-based products (TORCH and zS TIP, billed annually with quote-based pricing). Go-to-market is hybrid: enterprise field sales for protocol/exchange clients, community-led partnerships for coalition reach, and self-serve early access for zS TIP. The company has served over 120 clients including 1inch, Babylon, Starkware, Berachain, Ripple, Scroll, Coinbase, Chainalysis, and Abracadabra, and has handled the industry's largest recent exploits including Bybit ($1.4B+), Kelp ($292M), and Drift Protocol ($285M). The company is privately held with no disclosed funding rounds, parent company, or institutional investors, and operates globally with a team of approximately 40 experts.
zeroShadow firmographics
Firmographics- Name
- zeroShadow
- Legal name
- zeroShadow
- Website
- https://zeroshadow.io
- Company type
- Private
- Founded year
- 2024
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- zeroShadow is a Web3 security and incident response firm founded in 2024 by ex-Chainalysis cybercrime investigators, serving 120+ crypto exchanges, DeFi protocols, and VASPs with preventative security (TORCH), 24/7 investigations, threat intelligence (zS TIP), and GRC consulting.
- Ownership category
- akta.pro rank
zeroShadow industry classification
Industry- Product category
- Web3 Security Services
- NAICS
- Security Systems Services (56162)
- SIC
- Security Brokers, Dealers & Flotation Companies (6211)
- akta.pro primary industry
- Governance, Controls & Policy Automation (GRC for Web3) (FSAPAJAG)
- akta.pro secondary industry
- Security Architecture & Engineering Advisory (Zero Trust, IAM, Network) (BPAKADAF)
Keywords
Where zeroShadow is headquartered
LocationHeadquarters
- HQ city
- Miami
- HQ country
- United States
- HQ region
- North America
Markets served
zeroShadow business model
Business model- GTM type
- B2B
- Offering type
- Services
- Cost components
- Personnel, Technology or R&D, Operations, Marketing or Sales, Infrastructure
Revenue model
- Professional Services - Incident Response: Emergency response services for hacks, scams, and security incidents. Includes blockchain tracing, fund recovery support, and law enforcement liaison.
- Security Consulting: Ongoing security consulting engagements including GRC as a Service, VIP Protection, and Virtual CISO services provided on retainer or contract basis.
- TORCH Security Packages: Enterprise-level preventative security packages including vSOC, Customer Care Program, and Financial Services Support. Billed as customizable packages at fraction of cost of hiring in-house.
- Threat Intelligence Platform (zS TIP): Subscription-based threat intelligence distribution platform providing real-time threat signals to exchanges and service providers. Adopted by over 25 VASPs in two months.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Annual | Custom enterprise security packages |
| Subscription | Annual | Threat Intel Platform (zS TIP) subscription |
Go-to-market motion3 records
Distribution channels3 records
Marketing channels5 records
zeroShadow product offering
Product offeringCore offering
zeroShadow provides end-to-end Web3 security services across the full security lifecycle (Prepare, Prevent, Respond, Recover). Its portfolio includes TORCH (managed vSOC and preventative security), Investigations (global incident response and blockchain forensics), the proprietary zS TIP real-time threat intelligence platform, and Security Consulting & Implementation covering GRC, VIP Protection, and Virtual CISO offerings for Web3 enterprises, DeFi protocols, and crypto exchanges.
Product overview
zeroShadow is a Web3 security and crisis response company offering an end-to-end security solution across the full security lifecycle. The portfolio consists of four core service pillars: TORCH (preventative security with vSOC, Customer Care Program, and Financial Services Support), Investigations (global incident response and blockchain forensics), the zeroShadow Threat Intel Platform (zS TIP, a real-time threat intelligence distribution network), and Security Consulting & Implementation (GRC as a Service, VIP Protection, and vCISO). The company was founded in Spring 2024 by four former Chainalysis Cybercrime investigators and operates as a managed security service provider with over 25 experts serving over 120 clients across the ecosystem.
Differentiator
Problem solved
Functional benefit
Brands
- zS TIP (zeroShadow Threat Intel Platform): A neutral distribution layer that delivers high-fidelity threat signals to services instantly, without locking teams into a single vendor or feed.
- TORCH
Products and services
- TORCH Preventative security service providing a whole-team's worth of security through four pillars: Prevent, Prepare, Respond, and Recover. Includes vSOC (virtual Security Operations Center), Customer Care Program, and Financial Services Support packages, delivered as customizable enterprise packages.
- Investigations Global investigative and incident response services powered by a 24/7 team with over 70 years of combined experience. Covers research, malware and phishing disassembly, blockchain forensics and fund tracing, incident response, and expert testimony for litigation support, serving victims of hacks, scams, and phishing attacks.
- zeroShadow Threat Intel Platform (zS TIP) Real-time threat intelligence distribution platform that delivers high-fidelity threat signals to services instantly without locking teams into a single vendor or feed. Provides address screening with evidence-backed data in under 10 seconds, connecting threat intelligence creators with service providers such as VASPs and exchanges.
- Security Consulting & Implementation Tailored protection covering GRC as a Service (SOC 2, ISO 27001, CCSS compliance), VIP Protection (threat assessment, disappearing consultation, travel advisories), and Virtual CISO services with dedicated weekly meetings, staff training, and 24/7 support for organizations.
Quantifiable outcome
- zS TIP platform adopted by over 25 VASPs in two months
- +3 more outcomes
Companies that use zeroShadow
Customer profileNamed customers17 records
Segments4 records
Ideal customer profiles3 records
zeroShadow technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- No
- API docs
- API detail
Core technology
AI maturity
App detail
Integration1 record
Feature4 records
zeroShadow partnerships and signals
Strategic signalPartnerships
Eight partnerships are on record, tiered core and minor.
- SIRN (Solana Incident Response Network)coreCoalition of five security firms (OtterSec, Neodyme, Squads, Zeroshadow) coordinated by Solana Foundation for real-time crisis coordination across the Solana ecosystem following the $286M Drift Protocol hack.
- BitcoinVNcoreLong-running Bitcoin exchange and security partner since April 2026, using zeroShadow's TIPzs threat intelligence platform for live transaction-level screening and compliance.
- PharosminorzeroShadow announced as security partner for Pharos alongside Alibaba Cloud and AWS ahead of mainnet launch, providing blockchain audits, penetration testing, and real-time monitoring.
- InnerworkscorePartnership combining device fingerprinting, AI threat intel, and incident response to trace, freeze, and recover stolen crypto. Uses advanced detection and screening technologies including device fingerprinting to identify DPRK-affiliated wallets.
- HypernativecorePartnership to deliver comprehensive Web3 security solution combining real-time threat monitoring with expert incident response. Enhances protection across 40+ blockchains with proactive detection, rapid recovery, and 24/7 defense.
- TenderlycoreBlockchain monitoring partnership for L2 rollup security. zeroShadow and Tenderly provide real-time monitoring, simulation, and automated responses across critical L2 risk areas including oracle health, sequencer consensus, and economic security.
- Security AlliancecoreNon-profit for crypto security providing SEAL911 emergency response service. zeroShadow participates in this industry coalition for real-time crisis coordination.
- 1inchcorePartnership providing AML screening tools for Web3 security. 1inch and zeroShadow also partnered to uncover the APT-Q-27 malware campaign targeting Web3 customer support teams.
Scale indicators6 records
Recent moves6 records
Expansion highlights6 records
zeroShadow competitors and assessment
Company assessmentEmerging players
- Blowfish: Web3 transaction security and scam-detection API for wallets and dApps. Comparable as a real-time threat intelligence and address screening layer for VASPs and protocols — a competing approach to zeroShadow's zS TIP distribution model.
- Trail of Bits: Cybersecurity research and consulting firm with a strong Web3 audit practice. Minor integration partner for zeroShadow's auditing services but adjacent competitor for protocol security consulting and GRC engagements.
- Quantstamp: Smart contract auditing and security services firm. A minor integration partner of zeroShadow (auditing relationship) but adjacent competitor for protocol security budgets and ongoing monitoring engagements.
- Innerworks: Device fingerprinting and AI-driven threat intelligence for Web3 crime attribution. Strategic co-development partner (March 2025) addressing DPRK wallet identification — overlapping with zeroShadow's threat intelligence and fund recovery services.
Direct peers
- CertiK: Leading Web3 security firm offering smart contract auditing, formal verification, and ongoing monitoring. Comparable because they serve the same protocol customer base and increasingly overlap with zeroShadow on post-deployment threat detection.
- Hypernative: Web3 real-time threat detection and prevention platform covering 40+ blockchains. Strategic partner to zeroShadow (announced 2024-08-08) but also a direct competitor in monitoring, automated response, and exploit prevention for the same protocol customers.
- Hexagate: Blockchain-native security platform focused on real-time threat detection, transaction monitoring, and exploit prevention for protocols and exchanges. A minor integration partner of zeroShadow but directly competes on monitoring and incident response.
- TRM Labs: Blockchain intelligence and crypto compliance firm offering transaction monitoring, threat intelligence, and incident response to financial institutions, exchanges, and law enforcement — closely overlapping with zeroShadow's VASPs and law enforcement liaison offerings.
- Blockaid: Web3 security platform providing transaction screening, phishing detection, and smart-contract attack prevention to wallets and dApps. Competes with zeroShadow on threat intelligence distribution and serves overlapping customer segments such as exchanges and protocols.
Broad incumbents
- Chainalysis: The leading blockchain intelligence platform. Directly comparable because zeroShadow's four co-founders all came from Chainalysis's cybercrime and incident response teams, and Chainalysis itself offers investigations, compliance, and threat intelligence services to overlapping customers.
Market position
Strengths5 records
Weaknesses5 records
Competitive moat5 records
Key risks6 records
Key highlights7 records
Customer concentration
zeroShadow social profiles
Digital presencezeroShadow compliance and trust
Trust signalCompliance1 record
zeroShadow financial estimates
Financial estimateRevenue estimate
Valuation estimate
zeroShadow leadership team
Management profileNumber of profiles
Profiles4 records
zeroShadow funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
zeroShadow M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about zeroShadow
What does zeroShadow do?
zeroShadow provides end-to-end Web3 security services across the full security lifecycle (Prepare, Prevent, Respond, Recover). Its portfolio includes TORCH (managed vSOC and preventative security), Investigations (global incident response and blockchain forensics), the proprietary zS TIP real-time threat intelligence platform, and Security Consulting & Implementation covering GRC, VIP Protection, and Virtual CISO offerings for Web3 enterprises, DeFi protocols, and crypto exchanges.
Is zeroShadow a public or private company?
zeroShadow is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was zeroShadow founded?
zeroShadow was founded in 2024. It employs 11 to 50 people.
Where is zeroShadow based?
zeroShadow is headquartered in Miami, United States, in the North America region.
How does zeroShadow make money?
Four revenue lines are on record. Professional Services - Incident Response is the primary driver. The others are security Consulting, TORCH Security Packages and threat Intelligence Platform (zS TIP).
Who are zeroShadow's main competitors?
Emerging players on record are Blowfish, Trail of Bits, Quantstamp and Innerworks. Direct peers are CertiK, Hypernative, Hexagate, TRM Labs and Blockaid. Chainalysis is listed as a broad incumbent.
Does zeroShadow have an API?
No public API is recorded for zeroShadow.
What industry is zeroShadow in?
zeroShadow's product category is Web3 Security Services. Its primary akta.pro industry code is FSAPAJAG, Governance, Controls & Policy Automation (GRC for Web3), with a secondary code of BPAKADAF, Security Architecture & Engineering Advisory (Zero Trust, IAM, Network). Its NAICS code is 56162 and its SIC code is 6211.