VEYRNOX · Learn · Threat Intelligence Platform (TIP)
Threat Intelligence Platform (TIP)
A Threat Intelligence Platform (TIP) is a backend service that aggregates, curates, and distributes real-time threat signals — phishing domains, drainer contracts, sanctioned addresses, suspicious dApps — to consuming clients. In crypto wallets, the TIP feeds transaction-time defences.
How it works
The TIP ingests signals from community reports, brand-monitoring services, on-chain analytics, sanctions lists, and honeypot contracts. Each signal is scored, deduplicated, and expiry-tagged. Wallet clients query the TIP at transaction time — dApp connect, contract approval, outgoing transfer — and receive a per-signal verdict: allow, warn, block. Because the TIP is centralised, a new drainer detected against one user immediately protects every other user, without a wallet update.
Why it matters
On-device rule sets go stale within hours in a live attacker environment. A TIP moves detection to a server that can update in seconds and distribute globally. The trade-off is trust and privacy: the wallet must query the TIP without leaking user data, which requires careful protocol design (bloom filters, prefix hashing, or private set intersection).
Related concepts
- Drainer Contract — A drainer contract is a malicious smart contract that, once approved by a victim, transfers assets out of the victim’s wallet to attacker-controlled addresses.
- Phishing Site Detection — Phishing site detection is the wallet-level defence that blocks connections to fraudulent domains impersonating legitimate dApps, exchanges, or bridges.
- Address Poisoning — Address poisoning is a wallet-address confusion attack in which an attacker sends a zero-value or dust transaction from an address that visually resembles one of the victim’s frequent contacts.
- Transaction Simulation — Transaction simulation is a pre-signing check that runs a proposed transaction against a forked node state and reports the expected net asset change to the user before they sign.
Frequently asked questions
Is a TIP the same as an AI security system?
No. A TIP distributes signals; the classification of a signal as good or bad is rule-based, not ML-based, in Veyrnox.
Does the TIP see my transactions?
It sees the hashes and addresses needed for a check — not your balance, not your history, not your identity.
What happens if the TIP is offline?
The wallet falls back to on-device rules and warns the user that live threat intelligence is unavailable.
In Veyrnox
Veyrnox’s AI Security Protection tier is powered by an edge-hosted TIP. Ten transaction-time features — phishing check, drainer check, sanctioned-address check, transaction simulation — are driven by feed queries. Rule-based classification produces the verdict.