SlowMist

• Name: SlowMist
• URL: https://www.slowmist.com/
• Category: blockchain security company / threat-intelligence and AML workflow operator / audit-and-incident-response platform
• Summary: SlowMist belongs in companies/, not only projects/, because the useful question is not just which audit report, KYT screen, or hacked-incident page exists. The practical authority sits with the named organization that runs MistTrack, KYT, threat monitoring, incident investigation, report publication, and the broader security-operations shell other teams may start treating as workflow truth. That company boundary matters more than any isolated tool or report archive.
• What it does:
  • Performs security services for exchanges, wallets, blockchain infrastructure, smart contracts, red teaming, consulting, and defense deployment
  • Operates security and intelligence products including MistTrack, SlowMist KYT, MistEye, fake-deposit scanning, and a public hacked-incident dataset
  • Publishes unusually detailed smart-contract audit criteria across token, DeFi, RWA, Move, Solana, and EOS environments
  • Maintains a public GitHub footprint spanning vulnerability advisories, threat-intelligence tooling, security-practice guides, auditor-learning material, malicious-address work, and knowledge-base content
  • Participates in investigation, disclosure, and post-incident response work rather than only preventative review
• Key claims:
  • The homepage and about page describe SlowMist as a blockchain-security and threat-intelligence firm founded in 2018, which is already a company-shaped framing rather than a protocol or neutral standard
  • Official materials say the product and service surface spans auditing, blockchain threat intelligence, defense deployment, AML tracking and analytics through MistTrack, institutional compliance through SlowMist KYT, threat monitoring through MistEye, and a hacked-incident database, which makes the operator boundary analytically stronger than any one audit service line
  • The smart-contract-audit service page exposes granular review taxonomies across multiple ecosystems, showing that SlowMist is publishing methodology and assurance framing in addition to selling engagements
  • The public Web3 Project Security Practice Requirements and auditor-learning repositories make SlowMist’s security process part of the reusable ecosystem workflow, not only internal company know-how
  • The blockchain-threat-intelligence repository describes tooling that simulates blockchain-node RPC interfaces to monitor attacks across the network, which is a strong clue that SlowMist operates live intelligence infrastructure rather than a static report archive
  • Official materials also emphasize investigation work cited by international organizations and government bodies; even where those are vendor claims, they show SlowMist wants to be read as an operational intelligence and incident-response boundary, not just an auditor
• Whitepaper: No classic SlowMist company whitepaper is the important artifact here. The strongest primary materials are the official site and service pages plus the public GitHub organization, research advisories, threat-intelligence tooling, and open security-guidance repositories; the earlier source capture in ../whitepapers/slowmist-primary-sources-2026-04-30.md remains the compact bundle.
• Sources:
  • https://www.slowmist.com/
  • https://www.slowmist.com/about-us.html
  • https://www.slowmist.com/service-smart-contract-security-audit.html
  • https://github.com/slowmist
  • https://raw.githubusercontent.com/slowmist/Web3-Project-Security-Practice-Requirements/main/README.md
  • https://raw.githubusercontent.com/slowmist/SlowMist-Learning-Roadmap-for-Becoming-a-Smart-Contract-Auditor/main/README.md
  • https://raw.githubusercontent.com/slowmist/papers/master/README.md
  • https://raw.githubusercontent.com/slowmist/blockchain-threat-intelligence/master/README.md
  • https://api.github.com/orgs/slowmist/repos?per_page=20
  • https://api.github.com/repos/slowmist/papers
  • https://api.github.com/repos/slowmist/blockchain-threat-intelligence
  • ../whitepapers/slowmist-primary-sources-2026-04-30.md

Internal linkages

• Project-layer alias: slowmist.
• Strong adjacent company comparisons: blocksec, chainalysis, trm-labs, and trail-of-bits.
• Useful methodology contrast where a narrower review stack matters more than a broad intelligence platform: certora.

Protocol / company boundary

• projects/slowmist is now only an alias because SlowMist is not most usefully analyzed as a standalone protocol or neutral primitive.
• The product surfaces still matter: audits, threat intelligence, KYT, monitoring, hacked-incident publication, and security-practice guidance are real interfaces downstream teams consume.
• But the cleaner analytical question is organizational: who decides screening logic, intelligence coverage, monitoring defaults, report publication, incident-response workflow, and how those verdicts or datasets get packaged for other operators?
• That is why this note belongs in companies/: the durable choke point is the organization operating and publishing the security-intelligence stack, not an independent SlowMist protocol.

Control surface

• Practical leverage sits in threat-labeling and screening methodology, investigation coverage, public-report framing, audit criteria, monitoring defaults, malicious-address or incident dataset freshness, and whichever downstream exchanges, wallets, or compliance teams embed SlowMist outputs into policy.

• Even when artifacts are public, the company still shapes what gets published, how quickly it is updated, which attack patterns are emphasized, and which downstream actors start treating that interpretation as authoritative.

• Read SlowMist first as a company-run security and intelligence workflow boundary, not as a neutral protocol primitive or only an audit vendor.

• Last reviewed: 2026-08-10 UTC