Crypto exchange penetration testing
Centralised exchanges hold large, concentrated balances, which makes them the main target of groups like Lazarus. HYDN tests exchanges as complete systems: web and mobile apps, trading and withdrawal APIs, hot and cold wallet infrastructure, signing and approval workflows, internal networks and cloud, and the people who operate them.
What we test
- Customer-facing apps. Account takeover, withdrawal address changes, 2FA bypass and session security on web and mobile.
- Trading and withdrawal APIs. Authorisation, rate limits, order and balance manipulation, and race conditions in withdrawals.
- Wallet infrastructure. Hot wallet services, signing servers, HSMs, cold wallet procedures and the policies that decide what gets signed.
- Approval workflows. How large withdrawals are proposed, verified and approved, and whether one compromised person or machine can push one through.
- Internal networks and cloud. Paths from a compromised staff laptop to wallet infrastructure. See network and cloud testing.
- People. Phishing and pretexting against staff with access, if in scope. See social engineering.
The threat is specific
According to HYDN’s analysis, four of Lazarus Group’s five most recent major hacks targeted centralised virtual asset service providers. Their usual route is through people and infrastructure, not code. An exchange test should be designed around that. Read the Lazarus Group threat profile.
Frequently asked questions
Have you worked with exchanges?
Yes. HYDN's clients include Bittrex Global, and our team has spent decades countering the threat groups that target exchanges, including Lazarus Group.
Should an exchange do a red team as well as a pen test?
For a mature exchange, yes. A penetration test finds what is broken in a defined scope. A red team tests whether your people and monitoring would catch an attacker who is already inside, which is how most large exchange thefts have played out.
Published Updated