Crypto wallet penetration testing
A wallet is where one mistake moves everything at once. HYDN's wallet penetration testing covers key generation and storage, seed phrase handling, transaction construction and signing prompts, multisig and custody configuration, browser extension and mobile app security, and the backend services a wallet depends on.
What we test
- Keys. Entropy in key and seed generation, how keys are stored and encrypted, and whether they can leak through memory, logs, backups or crash reports.
- Signing. Whether the transaction a user signs is the one they were shown, and whether a malicious dApp or compromised front end can change it.
- Signing prompts. Whether approvals, permits and contract calls are explained clearly enough for a user to spot a malicious one.
- Extensions. Permissions, messaging between the extension and web pages, and injection into dApp pages.
- Mobile apps. Secure storage, biometric unlock and tampering. See mobile app testing.
- Multisig and custody. Thresholds, signer machines, proposal and verification workflows, and policy engines.
- Backends. Balance, pricing and notification services that the wallet trusts.
The lesson from Bybit
In February 2025 the signers of Bybit’s multisig cold wallet approved what appeared to be a routine transfer. A compromised wallet interface had swapped in a malicious transaction, and about $1.5 billion was taken. Testing the signing path end to end, including what each signer sees, is now a core part of our wallet work. Read our post-mortem.
Frequently asked questions
Do you test custodial and self-custody wallets?
Both. Self-custody testing focuses on the app and how it protects keys on the user's device. Custodial testing adds the infrastructure, people and approval processes that control the keys.
Can you test our multisig setup?
Yes. We review signer configuration, thresholds, how transactions are proposed and verified, and the machines signers use. The Bybit theft showed what happens when signers approve a transaction that is not what it appears to be.
Published Updated