Pentest for Crypto, Blockchain and Web3
Offensive security in exchanges, custodians, smart contracts, DeFi, NFT and blockchain infrastructure.
Why now
The real pain
Crypto is real money in unrevertable smart contracts. Contract bugs cost billions in recent hacks. A compromised exchange burns customers. CVM has regulated — there are now fines and civil liability for technical failures.
Applicable regulation
/attack-surface
Vectors we test in crypto & blockchain
Every engagement is designed for your environment. The points below are part of our standard playbook for this sector — final scope is adapted to your stack and contract.
Smart contract
Solidity, Rust, Move. Reentrancy, integer overflow, access control, frontrunning.
Exchange and custodian
Hot wallet, cold wallet, MPC, HSM, withdrawal process.
Bridge and cross-chain
Message validation, replay, validator failure.
DeFi and DEX
AMM, oracle manipulation, flashloan, sandwich attack.
Compliance and Travel Rule
KYC/AML, bureau integration, transaction monitoring.
/methodology
Genuinely manual pentest
Automated scanners find what's documented. Real attackers find what isn't. 90% of the work is manual — performed by specialists holding OSCP, CISSP, CRTO and GPEN.
01 · Reconnaissance
Target mapping, OSINT, footprint, sector-specific threat modeling.
02 · Discovery
Deep enumeration, complementary scanning, manual exposure identification.
03 · Exploitation
Manual validation with controlled PoC, finding chaining, escalation.
04 · Report
Executive + technical, step-by-step replication, mapped to applicable regulation.
/why-trust
Who has trusted our work
Engagements in regulated crypto markets.
Technical assessment recognized in highly regulated, mission-critical environments — the pentest that finds what nobody had found before.
Douglas Lopes
Founder · CEO · intrus.io
/faq
FAQ — Crypto & Blockchain
Do you audit smart contracts?
Yes. Solidity, Rust, Move. Static, dynamic and manual code review.
Do you serve exchanges in BACEN/CVM licensing phase?
Yes. The pentest can compose the technical dossier for VASP licensing.
/contact
Ready for a serious pentest in crypto & blockchain?
Schedule a confidential meeting. Within 48h we'll send a proposal with scope, timeline and pricing.