Security for exchanges, custodians & trading platforms
The contract gets audited. The withdrawal path is where the money leaves.
The largest losses of the last two years did not come from a smart-contract bug. They came through the path from ledger state to a signed withdrawal: signing workflows, hot-wallet orchestration, vendor tools and the approval back end.
We review that path, the matching engine and ledger behind it, and the cloud it runs on, as one connected surface. Fixed scope, fixed price, retest included.
Where the money actually left
In H1 2026, CertiK counted $444.5M across 33 wallet-compromise incidents and $151.6M across 204 code-vulnerability incidents, across all of Web3. Fewer incidents, about three times the money.
Amounts and causes are as stated by each company, regulator or investigator named, and may change as reviews finish (CertiK Hack3d H1 2026; NPA; Ginco; Sygnia; Bitget; Binance).
Talk to us when
Regulators are writing this into rules
Three regions, three different levels of obligation. A review of the withdrawal path produces evidence for the controls below. It does not replace what a regulator requires of you, and we do not claim approval by any regulator.
- Japan
- The FSA's final cybersecurity policy for crypto-asset exchanges (3 April 2026) lists external audit requirements, external verification of system-risk and signing-key management, and requirements for outsourced parties as items it will consider. JVCEA rules took effect on 1 July 2026.Source: FSA, 3 April 2026 (Japanese).
- European Union
- The MiCA transition period for crypto-asset service providers ended no later than 1 July 2026. DORA has applied to authorised providers since 17 January 2025. The authorisation technical standard (Delegated Regulation (EU) 2025/305, Art. 9) asks for ICT and cybersecurity audit information, including an external audit where one is available.Threat-led penetration testing is not a default requirement for these providers. What the texts say, and where a review fits.
- United Arab Emirates
- VARA's Technology and Information Rulebook (19 May 2025) requires an annual penetration test by a qualified, independent third party. The DFSA (DIFC) requires an annual independent technology audit for firms that hold client crypto tokens or run a trading platform (COB 15.8.1), filed within four months of year end.Whether a logic and invariant review counts toward a required test or audit is a question for the firm and its regulator.
Plain summaries of public texts, last checked on 11 November 2026. Not legal advice; confirm with counsel before relying on them.
Packages
Fixed scope, fixed price, retest included. Prices are starting points — you get a firm number in writing after a scoping call, before you commit.
Withdrawal-path rapid assessment
Two days of architecture walkthrough and interviews across your withdrawal, signing and approval flow. A short risk memo ranking where an attacker would go first — and whether a full review is worth it.
Withdrawal-path & signing review
End to end, from customer request or back-end command to broadcast: who can originate, approve or alter a withdrawal; whether signers see what executes; hot-wallet limits and circuit-breakers; vendor access into the path. Scope and method.
Ledger & matching-engine invariant review
Your system's guarantees — balance conservation, lock/unlock symmetry, fee and rounding direction, idempotent deposits — written down and turned into an executable test harness you keep and run on every release.
Penetration test — web, API & admin
Delivered with a testing partner. We scope it around your withdrawal path and ledger, and review the results against your business rules.
Cloud security scan & fix sprint
AWS, GCP or Azure. Automated posture and IAM-path scanning, triaged by a human, then the fixes delivered as reviewed Terraform or pull requests — and verified by a rescan. Not a PDF of 400 findings.
Regulatory & audit readiness
Japan FSA crypto-asset self-assessment and contractor oversight, EU MiCA and DORA evidence, UAE independent-testing expectations, ISO 27001 or SOC 2: gap analysis, control design and the technical evidence, prepared by someone who knows the systems behind the controls.
Continuous coverage retainer
Re-review of the withdrawal path and cloud after every significant change, bug bounty triage, honeypot and canary alert review, and a named security lead on call. From $2,000 / month.
Writing
Method and failure classes, published openly. If the analysis is wrong you should be able to tell before you hire us.
- 14 Nov 2026
- Which review do you need?A withdrawal-path and ledger-invariant review, a general penetration test and a smart-contract audit answer different questions. What each covers, what each misses, and when to choose which. Sources linked.
- 14 Nov 2026
- How we use AI in our workWhat AI is used for, what it is never used for, where client material goes, and what a named person always does. No AI on your engagement, on request.
- 12 Nov 2026
- Four withdrawal-path incidents, five questions the public record leaves openDMM Bitcoin, WazirX, Bybit and Bitget compared: what the approvers saw, what checked the transaction, where the compromise sat, what changed afterwards, and why limits did not stop the outflow. Built only from our four source-by-source notes.
- 12 Nov 2026
- Vendor and contractor access checklistThirty-one yes / no / unknown questions about every third party that can read, queue, change or sign a withdrawal. Page and PDF, no sign-up. Not an audit or certification.
- 12 Nov 2026
- Exchange invariant catalogueTwenty business rules an exchange ledger, matching engine and withdrawal path must hold, and how each one breaks. Patterns, not a list of defects at any named company.
- 12 Nov 2026
- Withdrawal-path self-assessment checklistForty-six yes / no / unknown questions for your own team on how a withdrawal is requested, approved, signed and broadcast. Page and PDF, no sign-up. Not an audit or certification.
- 12 Nov 2026
- Bybit, February 2025: what the public record says about the withdrawal pathThe sources agree on the outline of the event: a transfer from a cold wallet through a third party’s web interface that was altered. They differ on how far they go, and only one of those we read states what Bybit’s signers saw.
- 12 Nov 2026
- WazirX, July 2024: what the public record says about the withdrawal pathThe two parties closest to the wallet each publish an account, and the accounts place the compromise in different locations. Neither published account includes the forensic report behind it.
- 12 Nov 2026
- Bitget, September 2026: what the public record says about the withdrawal pathBitget and the two forensic firms it engaged describe the same incident in different terms, and the two firms label their accounts preliminary or in progress. This note sets out what each says, with dates, and what none of them says.
- 11 Nov 2026
- DMM Bitcoin, May 2024: what the public record saysA source-by-source reading of the theft: what Japan's police, the FSA and the companies involved state, where they differ, what is not said, and the questions a withdrawal-path review asks.
- 20 Sep 2026
- Where custody actually failsTen custody failure classes — signing-service confused deputy, quorum, policy-engine bypass, MPC implementation, key rotation, custodian integration, recovery material — and how to review them.
- 19 Sep 2026
- Where trading platforms actually lose moneyTen failure classes in exchange accounting and order handling — refund asymmetry, balance races, rounding direction, self-trade economics, finality and cliff boundaries — and how to test for them.
Full capability
The packages above draw on five practices: exchange and trading systems, offensive security, cloud and platform, detection and response, and assurance and governance. Engagements usually combine more than one, because the defects that matter live between systems rather than inside one.
Where we're different
We build exchanges. That's why we look where the money moves.
The highest-severity defects in trading systems are rarely injection or memory safety. They are broken invariants in code that reviews cleanly: a cancel path that refunds the original locked amount instead of the remaining one, a balance check that two concurrent orders both pass, a maker rebate that exceeds the taker fee, a cliff boundary off by one second.
A contract audit will not find those, because they are not in the contract. A generalist penetration test will not find them either, because finding them requires knowing how matching engines, order lifecycles, settlement and custody are actually implemented.
That is the layer this practice exists to cover — and we assess it together with the contract, the custody path and the cloud, because an attacker does not respect the boundary between them.
Sector experience: centralised and decentralised exchanges, brokerage and copy-trading platforms, high-frequency trading infrastructure, token sales and tokenisation, payments and ERP.
Who you're working with
Prasanta Sahoo
Principal · LinkedIn
Builds and operates the systems this practice assesses. Work spans exchange and trading infrastructure — matching engines, order management, ledger and settlement — and the security and compliance programmes around them.
Engineering work spans centralised exchange infrastructure — matching engine, order management, ledger and settlement — across a large microservice estate; institutional FX market-making systems in Rust, including FIX and ITCH protocol handling and colocated execution; custody integration over MPC and HSM-backed signing with major third-party providers; token issuance and vesting contracts; and brokerage and copy-trading platforms.
The businesses are not named.
How an engagement runs
- Scope and rules of engagementWritten scope, testing windows, escalation contacts and data-handling terms agreed before anything is touched. Nothing outside the agreed boundary is tested.
- Threat modelWe write down what your system claims to guarantee. Those claims become the invariants we try to break — the assessment is driven by your design, not a generic checklist.
- TestingManual, hypothesis-led work supported by fuzzing and automation. Critical findings are reported the moment they are confirmed, not held back for the report.
- ReportingEvery finding carries reproduction steps, a proof of concept, impact in your terms and a concrete fix. Written to be handed straight to the engineer who owns the code.
- RetestWe verify the fixes and confirm they are complete rather than mitigating. Included, and repeated until the finding is closed.
Engagement models
Security is not an event. A single point-in-time test does not fit a platform shipping to production every week, so continuous coverage is the default and a one-off assessment is the exception.
- retainer
- Continuous review across releases, with agreed response times and an allocation of days each month.The default for teams shipping regularly. Covers release review, bounty triage and fractional leadership.
- fixed scope
- A defined assessment with a report and retest.Trading and API assessment, custody review, proof of reserves, contract review, cloud assessment, audit readiness.
- post-incident review
- Engaged after containment.We verify that the fix closes the path and write a root-cause account that survives scrutiny. Live incident response is referred to a partner.
- advisory
- Design review and threat modelling before code is written.The cheapest point at which to fix an architecture.
What we commit to
- lead time
- Scoping within a week, and a start date in writing.Capacity is limited so the work stays with one person.
- named delivery
- The person who scopes the work does the work.No handover to an unnamed researcher pool after you sign.
- retest
- Included, and repeated until the finding is closed.Not billed as a second engagement.
- after the report
- We stay reachable.Fixes and follow-up questions are part of the engagement, not a new one.
Frameworks we work to
Assessments map to recognised methodology, so findings are defensible to your auditors, your board and your customers.
OWASP ASVSOWASP WSTG OWASP API Top 10PTES NIST CSFNIST SP 800-115 CIS BenchmarksMITRE ATT&CK CCSSSCSVS
We deliver readiness, control design and evidence for ISO 27001 and SOC 2. Certification and attestation are issued by accredited bodies and auditors, not by us.
Questions we get
What does an engagement cost?
See packages for starting prices — from $3,500 for a two-day rapid assessment to $27,000+ for a full invariant review. Price follows scope, not headcount or days. After a scoping call you get a fixed number in writing before you commit.
Do you use AI?
Yes — for breadth. Agents and fuzzers run against the invariants we write for your system, so far more paths get exercised than manual testing alone allows. Every finding is reproduced and signed off by a person. Your code and data are not sent to a third-party model API unless you agree to it in writing; by default analysis runs on models we host.
How quickly can you start?
Scoping starts within a week. After the scoping call you get a written scope, rules of engagement and a start date. Capacity is limited on purpose, so each engagement stays with one named person instead of a queue or a researcher pool.
Do you sign an NDA?
Yes. A mutual NDA is signed before you share code, configuration or findings, and before scoping if you ask. Client names are never published and we don't reference an engagement publicly without written permission. An encrypted channel is agreed before anything sensitive is exchanged.
Who actually does the work?
The person who scopes it. There is no handover to an unnamed researcher pool after you sign — another deliberate difference from the network-staffed model.
Is a retest included?
Yes, and it's repeated until the finding is closed — not billed as a second engagement. We stay reachable for fixes and follow-up questions after the report.
Do you work outside Japan?
Yes. Engagements run remotely in English or Japanese, against staging or a fork, under written authorisation and agreed scope. Contracting is through eMoment Japan KK. If your regulator or auditor expects specific credentials or a local contracting party, say so at scoping and we will tell you plainly whether we fit.
Do you work remotely / across time zones?
Yes. Engagements are delivered remotely against staging or a fork, under written authorisation and agreed scope. We do not test systems a client does not own or control.
Can you issue our ISO 27001 or SOC 2 certificate?
No — certification and attestation are issued by accredited bodies and auditors. We do the readiness, control design and evidence work that gets you through their audit.
Find the bug before someone else prices it.
A short scoping call, a fixed number, and a start date in writing. Tell us what you run and what's prompting the review.
Contact
- enquiries
- research@deebug.io
- +81 90 6658 2838For a first contact and scheduling a scoping call. Not for findings, credentials or client material.
- disclosure
- security@deebug.ioReporting a vulnerability in our own systems — see security.txt.
- sensitive material
- An encrypted channel is arranged before anything sensitive is exchanged.Agreed at scoping, alongside the NDA. Do not email or message findings or credentials in the clear.
- nda
- Signed before you share any material, and before scoping on request.
- data handling
- Client data is held only as long as an engagement requires, then destroyed on request.Findings and evidence are encrypted at rest and never shared with third parties.
Testing is carried out only under written authorisation, within agreed scope. We do not accept work against systems a client does not own or control.