Before the signing lifecycle changes
A new signer set, custody vendor, or automation path changes who can move funds.
We review signing, approval, and recovery paths for exchanges, custodians, wallets, and stablecoin operators.
When this fits
A new signer set, custody vendor, or automation path changes who can move funds.
New assets, chains, and flows widen the surface faster than the controls around them.
Rehearse recovery with the people who would run it during an incident.
Reconstruct what nearly worked, and what would have stopped it one step earlier.
Where it breaks
We trace funds from deposit to payout, including accounting, signing, approval, and recovery.
Reorgs, wrong-chain deposits, double credits, and the accounting that trusts them.
Float sizing, key access, signing services, and what an attacker gets from one host.
Quorum, allowlists, velocity limits, break-glass, and who can change any of them.
Share custody, ceremony witnesses, and whether recovery has been executed end to end.
Your engagement team
The team brings operating experience in exchange security, funding, and custody, including at Kraken.
Specialist Advisor
Security specialist with 60+ Web3 reviews across DeFi, L1s, bridges, oracles, and other critical infrastructure. At Kraken, worked on the security of funding services, custody, APIs, and on-chain systems.
Principal Advisor
Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.
Founder & Partner
Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.
Services
Start here. This is the review that follows a key from generation to recovery and challenges every gate on the way.
Explore serviceUse this when the question is what an attacker reaches from the outside, or from one compromised employee.
Explore serviceUse this to rehearse recovery and break-glass with the people who would actually run them.
Explore serviceDescribe your signing model, approval flow, and main concern. We will help define the scope.
Discuss your scope