Building on Avalanche? Ava Labs can cover up to 75% of your audit, and we take 10% off our quote. Avalanche audits: up to 75% covered. See how

Review how customer funds move.

Discuss your scope

We review signing, approval, and recovery paths for exchanges, custodians, wallets, and stablecoin operators.

When this fits

When to review your operations

Before the signing lifecycle changes

A new signer set, custody vendor, or automation path changes who can move funds.

Before a new product or listing goes live

New assets, chains, and flows widen the surface faster than the controls around them.

When recovery has never been rehearsed

Rehearse recovery with the people who would run it during an incident.

After a near miss

Reconstruct what nearly worked, and what would have stopped it one step earlier.

Where it breaks

Where customer funds can be exposed

We trace funds from deposit to payout, including accounting, signing, approval, and recovery.

An example fund flow showing deposit, treasury, signing, approval, and payout.
01

Deposit & crediting

Reorgs, wrong-chain deposits, double credits, and the accounting that trusts them.

02

Hot wallet & automated signing

Float sizing, key access, signing services, and what an attacker gets from one host.

03

Withdrawal approval

Quorum, allowlists, velocity limits, break-glass, and who can change any of them.

04

Recovery & key ceremony

Share custody, ceremony witnesses, and whether recovery has been executed end to end.

Your engagement team

Meet the specialists

The team brings operating experience in exchange security, funding, and custody, including at Kraken.

Michal Bajor portrait

Michal Bajor

Specialist Advisor

Security specialist with 60+ Web3 reviews across DeFi, L1s, bridges, oracles, and other critical infrastructure. At Kraken, worked on the security of funding services, custody, APIs, and on-chain systems.

Michal Bajor portrait

Michal Bajor

Specialist Advisor

Michal is a security expert with a Master's in ICT, three published research papers, and active academic research in blockchain technology. He has reviewed 60+ Web3 projects across DeFi, L1 systems, bridges, oracles, and other critical ecosystem components. At Kraken, he was responsible for security across crypto and fiat funding services and custody, B2B APIs, on-chain monitoring, smart-contract risk, and architectural and compliance reviews. Earlier at EY, he conducted web application penetration tests, participated in red-team activities, and worked across defensive security responsibilities; at Cisco, he supported Security Advisory penetration-testing work and internal cybersecurity training.
LinkedIn
Piotr Cielas portrait

Piotr Cielas

Principal Advisor

Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.

Piotr Cielas portrait

Piotr Cielas

Principal Advisor

Piotr is Head of Security at Agora, where he oversees information security, data protection, and corporate IT risk management. He brings both industry and consulting experience, having led information security advisory engagements and security program development for global financial institutions and large organizations. Earlier in his career, Piotr was a Senior Cybersecurity Consultant at Ernst & Young (EY), leading security assessments across financial services, healthcare, and government. He holds CEH, OSCP, and OSWE certifications, has contributed to the CVE program, and is the inventor of multiple U.S. patents related to information security and blockchain technology.
LinkedIn
Timur Güvenkaya portrait

Timur Güvenkaya

Founder & Partner

Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.

Timur Güvenkaya portrait

Timur Güvenkaya

Founder & Partner

Timur founded Guvenkaya after seeing teams reduce security to code review while their real risk spans architecture, infrastructure, operations, custody, and launch decisions. Before Guvenkaya, he established and led a security engineering practice for complex blockchain systems, specializing in Rust-based and non-EVM ecosystems including Substrate and NEAR. Earlier at Invicti, he helped build enterprise vulnerability-scanning and security detection engines used by Fortune 50 companies and public-sector organizations. He holds the CISSP certification.
LinkedIn
Meet the full team

Discuss your custody and signing workflows.

Describe your signing model, approval flow, and main concern. We will help define the scope.

Discuss your scope