Crypto & Web3 Penetration Testing

The trading UI, account area, admin console and any internal dashboards get tested as authenticated, multi-role applications. We look at session handling, password and email-change flows, and the small logic gaps that let one account act on another.

Exchanges are API-first, so this is where a lot of value hides. We test REST and, where present, WebSocket and GraphQL endpoints for authorization gaps, replay of signed requests, and abuse of API keys.

Hot-wallet signing services, HSM integrations, MPC or multisig orchestration and the segregation between hot and cold storage are the crown jewels. We test the services and access paths around them: who can reach the signer, what a compromised app server can ask it to do, and whether an approval can be forged.

Digital-asset platforms live on AWS, Azure or GCP, and a single over-permissive IAM role or an exposed secret can undo every application control. We review identity, network segmentation, key storage and the CI/CD pipeline that ships your signing code.

Smart-contract review as an add-on

To be straight with you: our core work is application, API and infrastructure pentesting. On-chain contract review is a distinct discipline, and we can bring it into scope on request or pair it with a specialist so a single engagement covers both the off-chain platform and the contracts your users interact with.

We start by enumerating the attack surface: subdomains, staging environments, exposed APIs and any forgotten admin hosts. nmap and ffuf map hosts and hidden paths, and we build a picture of every place value or credentials might live before touching a single input.

With test accounts across roles, we drive the platform through Burp Suite, intercepting and manipulating requests. This is where access-control flaws, IDOR and withdrawal-logic weaknesses surface, because we compare what one role can do against what the API will actually let it do.

A single medium-severity bug is a note. Two of them chained into an account takeover that reaches a withdrawal endpoint is a critical finding, and we will demonstrate that chain end to end so the risk is undeniable. We stop short of moving real funds and prove the capability in a controlled way.

You get an executive summary written for non-technical stakeholders and a technical report with every finding, its CVSS score, reproduction steps and a specific fix. After you remediate, we retest the affected areas at no extra cost to confirm the holes are closed.

Withdrawal whitelists that can be edited without re-authentication, cooldown timers enforced only in the browser, and approval steps that a crafted API call skips entirely. These are business-logic flaws no scanner will catch, and they are the fastest route to lost funds.

Keys issued as “read only” that still reach trading endpoints, secrets committed to a repository, and signing services that trust any internal caller. If a leaked key can move value, we will show it.

Insecure direct object references that expose another customer’s balance, order history or KYC documents, and privilege escalation from a standard user to an operator role. Mapped to OWASP ASVS access-control requirements, these are among the highest-impact findings we report.

SSRF in a metadata-fetching or image-processing feature that reaches the cloud metadata endpoint and hands over IAM credentials. From there an attacker can pivot toward the very secrets that protect your hot wallet.

Weak session invalidation, 2FA that is only checked at login and not at withdrawal, and password-reset flows that leak or accept predictable tokens. Account takeover is the common thread in most real exchange incidents.

Under the Digital Operational Resilience Act, financial entities and their ICT providers face structured testing expectations. Our reports are written to feed into that resilience testing and to evidence a serious security programme.

Testing supports ISO 27001 control A.12.6 on technical vulnerability management and gives SOC 2 auditors the independent-testing evidence they ask for. GDPR obligations around protecting customer and KYC data run through the same findings.