Best Penetration Testing Firms for Crypto and Stablecoin Fintechs

The largest crypto theft on record did not break a smart contract. Bybit lost about 1.5 billion dollars in February 2025 after attackers compromised a developer's machine and planted code in Safe's web interface, and Safe said its contracts were never touched.

Stablecoin issuers and payment fintechs spend heavily on smart contract audits. Far fewer commission a test of the apps, APIs, cloud accounts and signing flows that sit around those contracts.

So this compares six security firms on that gap: whether they test the off-chain systems where most losses begin, or mainly review code.

A smart contract audit checks the code onchain. A penetration test checks everything an attacker can reach before that code ever runs, and that is where most stablecoin businesses are least tested.

Key Takeaways

Bybit's 1.5 billion dollar loss came through a web interface.
NCC Group tests custody flows, approval workflows and key management.
Halborn and Hacken pair crypto expertise with classic web pentests.
Cure53 tests wallets and cryptography, with reports published on request.
Trail of Bits and Kudelski focus on code and cryptographic review.

What Actually Differs

All six firms find vulnerabilities for crypto companies. They differ in where they look.

Some run classic penetration tests against web apps, APIs, mobile apps and cloud environments. Others specialise in reviewing code and cryptography, which is closer to an audit than to an attack.

Both matter, and they are not substitutes. Our audit firms roundup covers the onchain side, and this list covers who will attack the rest.

What to note: ask every firm for a sample scope that lists exactly which systems it will attack.

Best Penetration Testing Firms for Crypto and Stablecoin Fintechs

1. NCC Group

Does the job: a large consultancy that tests custody operations as well as code.

NCC Group offers a dedicated crypto-custody and operational security assessment, which is rare among firms on this list.

The platform supports:

Smart contract assessment with fuzzing and exploitation
Web3 application testing of dApp frontends and off-chain interactions
Testing of trading and custody flows
Review of key management systems and approval workflows
Threat modelling and mobile app testing

The page cites "dozens of successful engagements across exchanges, DeFi protocols, and custodial platforms" but names no clients. It does not mention MPC, cloud testing or pricing.

Best for regulated custodians and issuers that want operations tested, not only software.

2. Halborn

Does the job: a crypto-native firm that runs web, cloud and red team tests.

Halborn names clients including Ava Labs, Bank Frick, Coinbase Asset Management and Ripple, and claims over 5,000 assessments.

The platform supports:

Web application penetration testing
Cloud infrastructure penetration testing
Full-scope red team exercises
Wallet extension, dApp and iOS and Android pentests
Risk assessments covering technology, people and processes

One case study describes a wallet client returning three times since December 2022, with critical findings shared before the draft report. The risk assessment page gives no methodology detail and no pricing.

Best for crypto firms that want one vendor for audits, pentests and red teaming.

3. Hacken

Does the job: exchange and stablecoin platform pentests with a published methodology.

Hacken's 1Money case study pairs a Layer 1 protocol review with a grey-box pentest of a stablecoin orchestration platform.

The platform supports:

Grey-box web and API pentests covering authentication and customer isolation
Testing of session management, file handling and webhooks
Exchange testing of KYC uploads, deposits, withdrawals and trading logic
WebSocket and Swagger-documented API testing
Layer 1 and protocol reviews alongside application tests

The case study, last updated in September 2026, gives no finding counts. Hacken's methodology article says it has been applied in more than 10 exchange and wallet cases, which is a modest base.

Best for exchanges and stablecoin platforms that want application-level business logic tested.

4. Cure53

Does the job: a Berlin firm known for wallet, browser and cryptography testing.

Cure53 has run several hundred pentests since 2007, and its recent crypto work includes Gem Wallet, ERA Wallet, Tangem and Coinbase's cb-mpc library.

The platform supports:

Black-box and white-box penetration tests
Source code audits
Infrastructure and platform audits
Cryptography audits, including MPC libraries
Architecture reviews early in development

Reports are published only when the client requests it, so the public list shows chosen engagements rather than the full record. Testers are independent contractors under NDA, and no pricing is published.

Best for wallet builders and teams shipping their own cryptography.

5. Kudelski Security

Does the job: cryptographic code review from the security division of a Swiss group.

Kudelski's recent published work includes a threshold ECDSA tool review for Uniwire and an enshrined oracle code review.

The platform supports:

Blockchain security assessments of code, infrastructure and integrations
Cryptographic secure code review
Threat modelling
Secure-by-design guidance during development
Reviews of Go and Rust codebases

The blockchain page does not mention wallets, custody or pentests, although Kudelski sells penetration testing and red teaming as separate services. Its blockchain team suits teams that need threshold signing or MPC key management code checked, more than an attack on a live platform.

Best for custody technology vendors building their own signing schemes.

6. Trail of Bits

Does the job: deep code assessment across many blockchain ecosystems, with open-source tooling.

Trail of Bits builds widely used tools such as Slither, Echidna and Medusa, and names Uniswap, Aave and Arbitrum among the teams it has secured.

The platform supports:

Design and early-stage assessments
Invariant testing and fuzzing integrated into CI
Reviews of nodes, bridges, governance and off-chain infrastructure
Ethereum, Solana, Cosmos, Starknet, TON and Move ecosystems
Developer training

The blockchain page says it reviews off-chain infrastructure, but it does not mention wallets, custody or penetration testing. Treat Trail of Bits as the counterpart to a pentester, not a replacement for one.

Best for protocols that need rigorous code assurance before and after launch.

Penetration Testing Firms Compared

Firm	Classic pentest	Custody and key flows	Code and cryptography	Public reports
NCC Group	Web3 apps, mobile	Yes, dedicated assessment	Smart contracts	No named clients
Halborn	Web, cloud, red team	Not named	Audits	Case studies
Hacken	Web, API, exchange logic	Not named	Protocol reviews	Case studies
Cure53	Black-box, white-box	Wallets, MPC libraries	Yes	On client request
Kudelski Security	Separate service	Threshold signing code	Yes	Listed reports
Trail of Bits	Not named	Not named	Yes	Yes

Four of the six describe attacking live systems, though Kudelski does so outside its blockchain team. Trail of Bits and Kudelski's blockchain practice are code reviewers first, which is valuable but is a different test.

What to note: none of the six publishes prices, so get a fixed-scope quote before comparing.

Where Stablecoin Businesses Get Breached

A stablecoin issuer's contract may be audited several times. Its admin panel, cloud console, CI pipeline and the laptops of people who can mint often are not.

Bybit shows how that gap plays out. The attacker went through a developer machine and a cloud storage bucket, and the signers approved a transaction that their own screens misrepresented.

A good pentest scope follows the money from the outside in: customer apps, APIs, internal admin tools, cloud accounts, build systems and finally the signing flow. Our guide to the first hour after a theft shows why finding those paths beforehand matters.

What to note: include the mint and burn admin path in scope by name, since it is the highest-value target.

How to Choose

1. Map what you actually run

List your apps, APIs, cloud accounts, admin tools and signing systems. That list is the scope, and it shows which firms can cover it.

2. Separate audit from pentest

Use a code reviewer for contracts and cryptography, and a pentester for live systems. Some firms do both, but buy them as separate deliverables.

3. Test the custody path

Ask whether the firm will test approval workflows and key management, not only web apps. NCC Group names this explicitly.

4. Ask about red teaming

A red team exercise tests people and processes as well as software. Halborn lists it as a service.

5. Plan for retesting

Fixes need verifying, and systems change. Agree retest terms and an annual cadence in the contract.

What to note: ask who on the team will do the work, and see their past reports.

How This List Was Built

Inclusion required three things, so that the comparison means something.

A first-party page describing security testing for crypto or blockchain clients
Published reports, case studies or named engagements in the sector
A firm accepting new engagements today

Several capable firms are not here, including generalist pentest companies with little public crypto work. Firms who believe they meet the three criteria above are welcome to send documentation for consideration in the next update.

What to note: last reviewed against firm websites in November 2026.

Risks and Limitations

A pentest covers the scope agreed, and anything outside it remains untested.
Assessment counts and client lists are firm claims and not independently verified.
A clean report reflects one point in time, and new code adds new risk.
Code reviews and pentests answer different questions and do not replace each other.
No firm here publishes prices, so costs are unknown until a quote.

Conclusion

Most stablecoin businesses have audited their contracts and left the rest of their stack less tested. The biggest recent losses came through that rest.

NCC Group suits custodians that want operations tested, Halborn and Hacken suit platforms that need web, API and cloud pentests, Cure53 suits wallet builders, and Kudelski and Trail of Bits suit teams that need code and cryptography reviewed.

Commission both kinds of test. Audit the code, then pay someone to attack everything around it.

Read Next:

FAQs:

1. What is the difference between a pentest and a smart contract audit?

An audit reviews contract code for flaws. A penetration test attacks live systems such as apps, APIs, cloud accounts and signing flows to find ways in.

2. Do stablecoin issuers need penetration tests?

Yes. Many of the largest crypto losses came through off-chain systems such as web interfaces and compromised machines rather than through contract bugs.

3. What should a crypto pentest cover?

Customer apps, APIs, admin tools, cloud accounts, build pipelines and the approval and signing process for minting, burning and treasury transfers.

4. How often should a crypto fintech run a pentest?

At least yearly and after major changes, with retests to confirm fixes. Partners and auditors often expect an annual report.

5. Is a red team exercise worth it for a stablecoin company?

For firms holding significant funds, yes. A red team tests people and processes as well as software, which is how many real attacks succeed.

Disclaimer:
This content is provided for informational and educational purposes only and does not constitute financial, investment, legal, or security advice; no material herein should be interpreted as a recommendation, endorsement, or solicitation, and readers should conduct their own independent research or consult a qualified professional. Services, client names and figures are drawn from each firm's own website or news reports at the time of writing, are not independently verified here, and change frequently. No security test guarantees that all vulnerabilities will be found. Confirm current scope, terms and pricing directly with each firm before engaging one.

Best Penetration Testing Firms for Crypto and Stablecoin Fintechs