Full capability
The packages draw on five practices. The lead offer is described in withdrawal-path review: scope and method. Engagements usually combine more than one, because the defects that matter live between systems rather than inside one.
Exchange & trading systems
Trading engine & API assessment
The layer most assessments skip. Order lifecycle and state machine legality, balance locking and release, partial-fill accounting, fee and rebate arithmetic, settlement rounding, and the concurrency behaviour of every endpoint that can move a balance.
Wallet & custody review
Key management and signing paths end to end — HSM and MPC configuration, quorum and policy design, key ceremony procedure, withdrawal approval flows, and the integration code around third-party custodians.
Proof of reserves
Design and verification of reserve attestation — Merkle commitment construction, inclusion proofs users can check themselves, liability completeness, and the operational controls that stop an attestation being true only on the day it is published.
Smart contract review · with a partner
Standalone contract audits are delivered by a specialist partner firm. We scope the work, introduce the partner and review how the contracts connect to your withdrawal and ledger paths.
Offensive security
Penetration testing · with a partner
General web, API and network penetration testing is delivered with a testing partner. We scope it around the withdrawal path and ledger, and review the results against your business rules.
Red team & adversary simulation · with a partner
Red-team and threat-led exercises are delivered by a partner. We can help define the objective around the signing path and take part in the debrief.
Secure code review
Manual source review of backend services and trading logic in .NET, Node, Java, Rust and Python — concurrency, state machines, money handling and trust boundaries.
Threat modelling & architecture review
Design-stage review before code exists — trust boundaries, failure modes and the invariants the system must hold. The cheapest point at which to fix an architecture.
Cloud & platform
Cloud security assessment
AWS and GCP configuration review — IAM and privilege-escalation paths, network exposure, secrets handling, logging coverage, container and workload posture.
DevSecOps & supply chain
Pipeline and dependency risk: CI/CD privilege and artefact integrity, secrets in build systems, infrastructure-as-code review, base image exposure, SBOM and signing.
Node & RPC infrastructure
Validator and node operator exposure — RPC surface and rate limiting, management interface reachability, key storage on signing hosts, and lateral movement from a compromised node into the rest of the estate.
Detect & respond
Deception & detection engineering
Honeypots, canary tokens and tripwires placed where a real intruder would step, wired into alerting you actually read. High-signal detection without another dashboard.
Post-incident investigation
Independent forensics and root-cause review once the incident is contained. Timeline reconstruction from logs and on-chain data, scope of compromise, verification that the fix closes the path, and a write-up that survives scrutiny. Live incident response is referred to a partner.
IR readiness & tabletop
Runbooks, escalation paths and decision authority agreed before you need them, then exercised against a realistic scenario. Most incidents go badly because nobody knew who could halt withdrawals.
Assurance & governance
IT audit & general controls
ITGC review across access management, change control, segregation of duties and operational monitoring — with the evidence an auditor will actually accept.
ISO 27001 & SOC 2 readiness
Control design, gap analysis and evidence preparation. We prepare you for the audit and sit with you through it. Certification and attestation are issued by accredited bodies — not by us.
vCISO & programme leadership
Fractional security leadership on retainer: roadmap, risk register, vendor and third-party review, board reporting, and ownership of the programme between audits.
Bug bounty programme design & triage
We stand up your programme and run the inbound: scope and policy drafting, safe-harbour terms, severity and reward tables, then day-to-day triage — reproducing submissions, de-duplicating, rejecting noise, and handing your engineers only what is real, with a proof of concept attached.
Not sure which of these applies?
Most engagements start with the withdrawal path or the ledger. Tell us what you run and what is prompting the review.