Security for crypto exchanges
Crypto exchanges hold large, concentrated balances, which makes them the main target of state-sponsored groups like Lazarus. HYDN secures exchanges across every layer attackers use: penetration testing of apps, APIs, wallet infrastructure and cloud; red team exercises against staff and signing processes; and smart contract audits for on-chain components.
What we cover
- Crypto exchange penetration testing of web and mobile apps, trading and withdrawal APIs, wallet infrastructure and internal networks.
- Wallet and signing security, including hot and cold wallet procedures and multisig approval paths.
- Red team engagements built around how Lazarus and similar groups operate, including social engineering and assumed breach.
- Cloud testing for the infrastructure behind it all.
- DORA testing for exchanges authorised under MiCA.
Experience
HYDN’s clients include Bittrex Global, and our team has over 40 years of combined experience countering advanced persistent threat groups, including Lazarus Group, Kasablanka and MuddyWater.
Frequently asked questions
What is the biggest risk to an exchange?
A compromise of the people and systems that control withdrawals. The largest exchange thefts, including Bybit's, came through signing processes and infrastructure rather than through exchange code.
Does DORA apply to exchanges?
Crypto-asset service providers authorised under MiCA are covered by DORA and need a resilience testing programme that includes penetration testing.
Published Updated