Blockchain security expert Zhou Yajin talks about encryption asset security

Host: Alex, Research Partner at Mint Ventures

Guest: Zhou Yajin, CEO of the blockchain security company BlockSec

Recording time: 2025.3.28

The service scope and target customers of BlockSec

Alex: Today we have invited Zhou Yajin from the blockchain security company BlockSec to talk with us about the topic of encryption security. Please say hello to us, Teacher Zhou.

Zhou Yajin: Hello everyone, I am Zhou Yajin, currently serving as the CEO of BlockSec, and also a researcher in cybersecurity at Zhejiang University. It's great to meet everyone.

Alex: Could you please introduce BlockSec to us first, and what services do you provide? What kind of individuals and institutions would become your clients?

Zhou Yajin: BlockSec is a Web3 security company founded in 2021. Our business can be divided into three main sectors:

1. Security for on-chain protocols. We provide security audit services and security monitoring products for smart contracts.

2. Asset security. We help users protect the asset security of assets stored in contract wallets or invested in on-chain protocols.

3. Compliance and regulation. We assist regulatory agencies in overseeing players in the Crypto industry and also help traditional financial institutions comply with regulatory requirements when entering the Crypto industry.

Our clients mainly include:

1. Project parties and developers deploying smart contracts on the Blockchain. We provide them with security auditing and monitoring services.

2. High-net-worth clients with a large amount of encryption assets. We help them monitor the security of the protocols they invest in.

3. Regulatory agencies and law enforcement. We provide them with tools and platforms to investigate digital currency crimes.

Three suggestions regarding encryption security

Alex: If you have a friend who has just entered the encryption investment field, what three pieces of advice would you give him about asset security?

Zhou Yajin: I will provide the following three suggestions:

1. Protect your private key. Write down the mnemonic phrase of your private key and store it in a safe. Do not move it often. Use trusted dedicated devices such as hardware wallets or mobile phones to store and manage your private key.

2. Always maintain security awareness during on-chain transactions. Remember that there are no free lunches, and be vigilant against various phishing attacks.

3. Understand the basic knowledge of encryption assets, especially regarding the authorization mechanism. Be especially cautious when signing wallet signatures to avoid mistakenly authorizing transactions.

Experience social engineering attacks

Alex: Can you explain what a "social engineering attack" is?

Zhou Yajin: Social engineering attacks are fully referred to as social engineering attacks, which utilize your work habits, interpersonal relationships, job responsibilities, etc., to design attack methods, rather than technical means. I can share a case of social engineering attack that I personally experienced:

Someone contacted me through the company email, claiming to be from an investment institution, wanting to discuss investment opportunities. After some preliminary background checks, I scheduled a video conference with the other party. However, at the start of the meeting, the other party requested that I download a specific software and continuously urged me through email. This software actually contains malicious programs aimed at stealing the private keys stored on my computer.

The attacker exploited my identity and duties as the CEO, as well as the tension prior to the meeting, to launch the attack. This is a typical social engineering attack method.

Security principles when interacting with the Blockchain protocol ###

Alex: What security principles do we need to adhere to when interacting with DeFi protocols or other protocols?

Zhou Yajin: For ordinary users, I suggest:

1. Conduct background checks on the project team. Understand the identity of the founders and their technical capabilities, and check if they have been audited by leading security firms.

2. Use a progressive investment approach, and do not invest a large amount of funds at once.

3. Use professional security tools, such as attack monitoring platforms, to grasp the security risks of the invested agreements.

4. Prevent phishing risks. Do not trust promotions that seem too good to be true; ensure that you are interacting with the official website and not a counterfeit site.

5. Regularly check and revoke unused authorizations, especially for those authorizations related to protocols that are no longer maintained.

The current state and potential of the Blockchain security industry

Alex: What is the current scale, development status, and profit level of the blockchain security industry?

Zhou Yajing: According to some reports and estimates, the annual scale of the Blockchain security industry is about 3 billion dollars, which still has a significant gap compared to the traditional cybersecurity industry with a scale of 100 billion dollars. This is related to the fact that the entire Blockchain industry is still in its early stages.

Currently, the industry is facing some bottlenecks, with TVL decreasing from a peak of 177 billion dollars to around 99 billion dollars now. But we also see new potential:

1. Traditional financial institutions are entering this industry, such as banks issuing on-chain stablecoins and payment giants supporting encryption payments.

2. More and more merchants with real scenario needs are starting to adopt Blockchain technology.

3. The industry is moving towards greater compliance.

Overall, the Blockchain security industry is still in its early stages, but with the entry of traditional financial institutions and the advancement of industry compliance, there is great potential for future growth.

The moat of a head security company

Alex: What do you think are the main moats of leading security companies?

Zhou Yajing: I think there are mainly the following points:

1. Brand and trust. Security audits require a high level of brand recognition, and leading companies often have a strong brand effect.

2. Security innovation technology. In addition to auditing, a security solution that covers the entire lifecycle of smart contracts is also needed.

3. Compliance, regulation, and geopolitical influences. Understand the regulatory policies and compliance requirements of the industry, and be able to productize them. At the same time, certain regions may have geopolitical considerations when selecting vendors.

4. Comprehensive service capabilities. Companies like BlockSec that can provide both smart contract auditing and attack monitoring are more competitive.

In summary, establishing a strong brand image, continuous technological innovation, a deep understanding of regulatory requirements, and maintaining an advantage in geopolitics are all important moats for Blockchain security companies.