PolySwarm

About PolySwarm (NCT)

What Is PolySwarm (NCT)?

PolySwarm is a threat intelligence marketplace. Files, URLs and other artifacts are submitted to it, dozens of independent malware detection engines analyze them in parallel, and the platform combines their verdicts into a single score. The engines do not all come from one vendor, which is the point: the design assumes no single antivirus product catches everything, and it pays the engines that are right more than the ones that are wrong.

NCT, named Nectar, is the ERC-20 token that settles the supply side of that marketplace. Engine operators fund a wallet with NCT, stake it on the verdicts they assert, and are paid from it when their assertions match the ground truth established later.

Official sources:

• PolySwarm
• PolySwarm Documentation
• PolySwarm Whitepaper
• Nectar token on Etherscan
• PolySwarm on GitHub

Who Founded PolySwarm? (History)

PolySwarm is operated by Swarm Technologies, Inc. The founding group came out of the security research firm Narf Industries and included Steve Bassi as chief executive and Paul Makowski as chief technology officer, alongside Ben Schmidt, Maxwell Koo and Nick Davis. The team's background is offensive and defensive security research rather than consumer crypto, and that shows in the product.

The Nectar public token sale ran from February 20 to March 22, 2018 and raised approximately 25.94 million dollars. In the years since, the company has moved from a purely token-native pitch toward a commercial threat intelligence product with subscription plans, enterprise integrations and a public API, while keeping NCT as the settlement layer for the engines that supply detections. Development is ongoing: the polyswarm-api and polyswarm-cli repositories were both updated in September 2026.

How PolySwarm Works

1. An artifact is submitted A customer, historically called an ambassador, submits a file or URL. The submission creates a bounty that the marketplace's engines can respond to.

2. Engines assert and bid Each participating engine, historically called a microengine, returns an assertion of malicious or benign and attaches an NCT bid. The bid is the engine's own money placed behind its opinion. A larger bid signals more confidence and earns more when correct.

3. Ground truth is established Arbiters, a set of high-reputation participants, determine the true nature of the artifact after the fact. The bounty contract feeds that verdict back into settlement.

4. Settlement redistributes NCT Engines that asserted correctly are paid from the bounty and from the stakes of engines that asserted incorrectly. Arbiters take a fee. Because arbitration happens after the fact, rewards can arrive weeks after a bid was placed, which is why operators are told to keep a working balance rather than run a wallet to zero.

5. Results reach the customer as one score On the customer side the raw assertions are aggregated into PolyScore, a performance-weighted consensus verdict, so the buyer sees a single actionable answer instead of dozens of conflicting ones.

Settlement contracts run on a sidechain operated by the company rather than on Ethereum mainnet, and NCT is relayed between mainnet and that sidechain. This is a throughput decision, and it is also a trust assumption worth naming: the sidechain is not independently validated the way Ethereum is.

Key Ecosystem Components

• Scan, the multi-engine file and URL analysis product
• Search, which looks up artifacts by hash, metadata and indicators of compromise
• Hunt, YARA-based threat hunting across live and historical data
• Sandbox, dynamic detonation for behavioral analysis
• The engine marketplace and the arbiter set that scores it
• The NCT bounty and assertion contracts on the PolySwarm sidechain
• Integrations into existing security stacks, including a Splunk integration published in 2025

NCT Token Utility

NCT is used to:

• Fund an engine operator's wallet, from which bids are deducted
• Bid on assertions, which is effectively staking a verdict
• Pay bounty rewards to engines whose assertions matched ground truth
• Pay the arbiter fee taken by the bounty contract
• Reward contributors of useful detection capability to the marketplace

The token contract deserves a direct look. A live read of 0x9e46a38f5daabe8683e10793b06749eef7d733d1 in September 2026 returned the name Nectar, the symbol NCT and 18 decimals, with a total just under 1.886 billion tokens. Two contract-level facts matter. First, the deployed bytecode contains a mint entrypoint and a finishMinting switch, and mintingFinished still returns false, so the contract owner retains the ability to create additional NCT. Second, the bytecode contains no burn function at all, so NCT cannot be destroyed on Ethereum, and the balance held at the conventional dead address is zero. Any description of NCT as a permanently fixed supply should be treated with care.

The Polygon deployment at 0x4985e0b13554fb521840e893574d3848c10fcc6f reports the name Nectar (PoS). It is a Polygon PoS bridge representation backed by tokens locked on Ethereum, not a second issuance, so the two deployments should not be added together.

What Makes PolySwarm Unique?

Most threat intelligence is sold as a verdict from one vendor. PolySwarm sells a verdict from many vendors that were each financially exposed to being wrong. That changes the incentive structure of detection: an engine that guesses malicious on everything to look safe loses money, and an engine with a narrow but genuine specialty can profit from a niche that a general-purpose scanner misses.

It is also one of the few crypto projects whose commercial product is bought by security teams rather than by token holders, which gives it a revenue line that does not depend on trading activity.

How PolySwarm Differs from Similar Projects

• Compared with traditional multi-scanner services, engine participation is permissionless and the scoring is weighted by historical accuracy rather than treated as an unweighted vote
• Compared with oracle networks such as Chainlink, the reported fact is a security judgment that a human arbiter can dispute, not a numeric feed
• Compared with most token projects, the paying customer never touches the token: subscriptions are priced conventionally, and NCT circulates on the supply side
• Compared with on-chain security scanners, the subject is conventional malware and threat intelligence rather than smart contract risk

Use Cases of PolySwarm

• Security operations teams triaging suspicious files and URLs
• Threat hunters running YARA rules across historical corpora
• Incident responders detonating samples in a sandbox
• Vendors and researchers monetizing a detection engine they already maintain
• Enrichment inside existing SIEM and SOAR pipelines

How PolySwarm Is Secured

• Engines are economically bonded to their own assertions, so wrong answers cost money
• Arbiter status is earned through demonstrated performance and maintained by contract in a sliding window
• Scoring weights reputation, so a newly added engine cannot immediately move a verdict
• The customer-facing platform is a conventional hosted service with standard access controls
• The NCT contract on Ethereum is a long-lived, widely held ERC-20, though it retains an owner with minting authority

Risks and Considerations

• Token value is only loosely coupled to product revenue, because customers pay subscriptions while NCT circulates among suppliers
• The contract owner can still mint additional NCT, and there is no on-chain burn to offset that
• Settlement runs on a company-operated sidechain rather than on a public, independently validated chain
• Arbiter concentration is a governance risk, since arbiters define the ground truth that pays everyone
• Enterprise security is dominated by large incumbents with long procurement cycles
• Reward delays of weeks impose working capital requirements on small engine operators

Why PolySwarm Matters

The core idea, that detection quality improves when detectors are paid for being right and penalized for being wrong, is one of the cleaner applications of crypto incentives to a real industry problem. PolySwarm has kept that idea running through multiple market cycles while shipping a product security teams actually buy, which is unusual for a token launched in the 2018 cohort.

Where Can You Buy PolySwarm (NCT)?

NCT trades on centralized exchanges and on decentralized venues on Ethereum and Polygon. Availability and pairs vary by jurisdiction. Choose the Ethereum token or the Polygon PoS representation deliberately, since the two are not interchangeable without bridging.

Major Centralized Exchanges (CEX)

NCT has been available on venues including:

• Binance
• KuCoin
• Gate
• MEXC

Storage Options After Purchase

• Any Ethereum wallet that supports ERC-20 tokens, using the contract address above
• A Polygon wallet for the bridged Nectar (PoS) token
• Hardware wallet custody through compatible wallet software
• An engine operator wallet inside the PolySwarm platform, if you intend to bid rather than hold

Always verify the contract address rather than searching by ticker, because short tickers are frequently reused by unrelated projects.

Related Coins

• Chainlink
• The Graph
• GoPlus Security
• Quant
• Polygon Ecosystem Token