Six Cybersecurity Firms Compared for Crypto Off-Chain Risks

A review of NCC Group, Halborn, Hacken, Cure53, Kudelski Security and Trail of Bits compares their work on crypto companies’ off-chain systems. These systems include websites, application programming interfaces, cloud accounts, administrative tools and signing workflows.

The comparison follows the theft of about $1.5 billion from Bybit in February 2025. Attackers compromised a developer’s machine and inserted code into Safe’s web interface. Safe reported that its smart contracts were not affected. The incident involved a web interface, a cloud storage bucket and a signing process, rather than a flaw in the underlying contracts.

A smart-contract audit reviews code deployed on a blockchain. A penetration test attacks systems that can be reached before a blockchain transaction is approved. For stablecoin issuers, that scope can include the systems used to mint, burn and transfer tokens.

NCC Group offers a crypto-custody and operational-security assessment. Its services include smart-contract testing, decentralized-application testing, trading and custody-flow reviews, key-management assessments, approval-workflow testing, threat modeling and mobile-application testing. Its published material cites dozens of engagements but does not name clients or list prices.

Halborn provides web-application and cloud penetration tests, red-team exercises, wallet and decentralized-application testing, and iOS and Android assessments. Its listed clients include Ava Labs, Bank Frick, Coinbase Asset Management and Ripple. The firm claims to have completed more than 5,000 assessments. One case study describes a wallet client that returned for testing three times since December 2022.

Hacken offers grey-box testing of websites and application programming interfaces, exchange testing, WebSocket and Swagger-documented API reviews, and checks of authentication, customer isolation, session management, file handling and webhooks. A case study involving 1Money paired a Layer 1 protocol review with a penetration test of a stablecoin orchestration platform. The case study was last updated in September 2026.

Cure53, a Berlin-based security firm, has tested wallets, browser-related products and cryptographic systems. Its published crypto engagements include Gem Wallet, ERA Wallet, Tangem and Coinbase’s cb-mpc library. Its work covers black-box and white-box penetration tests, source-code and infrastructure reviews, and cryptography assessments, including reviews of multiparty-computation libraries. The firm publishes reports when clients request disclosure.

Kudelski Security’s blockchain practice focuses on code and cryptography. Its published engagements include a threshold ECDSA tool review for Uniwire and a review of an enshrined oracle. The firm assesses blockchain code, infrastructure and integrations, and reviews Go and Rust codebases. Its blockchain materials do not describe wallet, custody or live-platform penetration tests. The company offers penetration testing and red-team services through separate practices.

Trail of Bits focuses on blockchain code assurance and cryptographic testing. It develops tools including Slither, Echidna and Medusa, and lists Uniswap, Aave and Arbitrum among organizations it has worked with. Its services cover design reviews, fuzzing, invariant testing, blockchain nodes, bridges, governance and some off-chain infrastructure across Ethereum, Solana, Cosmos, Starknet, TON and Move.

Four of the six firms describe testing live systems. Kudelski Security’s blockchain practice and Trail of Bits primarily describe code-review services. A code audit and a penetration test address different systems and risks.

The review recommends defining the scope before hiring a firm. The scope should name customer applications, APIs, cloud accounts, administrative tools, build systems and the full signing process. Stablecoin companies should identify minting, burning and treasury-transfer paths, agree on retesting after fixes and set a recurring testing schedule.

None of the six firms publishes standard prices. Client lists, assessment numbers and other claims come from company materials and were not independently verified. The firms’ websites were last reviewed in November 2026. A clean report covers only the systems and period included in the agreed assessment.