Hacken

In a Hacken smart contract audit two senior auditors review the same code in parallel, so one reviewer catches what the other misses. Automated scans look for known vulnerability patterns, the auditors then trace logic, permissions and fund flows by hand, and fuzzing and invariant tests drive the contracts into unusual states.

After the first report the client may submit fixes within two weeks, and Hacken checks that each fix closes the issue without opening a new one. The final report states the scope, the findings with their severity and the status of every fix, the same structure that any smart contract audit report needs before others can rely on it.

Crypto firms that apply for a license under the Markets in Crypto-Assets Regulation have to show supervisors that their systems withstand real attacks. For the exchange Bybit, Hacken ran a red team and blue team penetration test that covered smart contract logic, node infrastructure, wallets, APIs and the reaction of the defense team, and mapped every finding to MiCA and DORA controls.

The Austrian Financial Market Authority FMA then granted Bybit a CASP license that is valid across the European Economic Area. Hacken also prepares firms for the Digital Operational Resilience Act, ISO 27001 and the CryptoCurrency Security Standard, and its compliance team stays involved until the license or certificate is granted.

Hacken has verified the reserves of crypto exchanges since 2019. In a proof of reserves check, Hacken compares the on-chain assets of a platform with its liabilities to customers and uses Merkle trees, so every customer can confirm that the own balance is counted without seeing the balances of others.

Gate.io, Crypto.com, Bybit and Bit2Me have used these verifications, and OKX publishes reserve audits by Hacken as well. By its own count, Hacken has checked more than 430 billion US dollars in assets this way.

The European Blockchain Services Infrastructure EBSI is a blockchain of the European Commission and the European Blockchain Partnership, which all EU member states, Norway and Liechtenstein have joined. Its smart contracts keep registries such as the Trusted Issuers Registry, in which universities and other issuers of verifiable credentials are recorded.

Hacken audited these EBSI smart contracts with the tools Slither, Mythril and Echidna, data flow diagrams and a line-by-line review, and handed over a report with a security score. The European Commission later selected Hacken OÜ for the second cohort of the European Blockchain Sandbox, a dialogue program between blockchain firms and regulators.

Hacken publishes its audit reports by client, and the company counts 2,177 public security assessments with 16,861 vulnerabilities found. A reader who wants to rely on such a report first checks which repository and which code version it covers, because the result applies only to that scope.

The second check is the status of each finding after the fix round, since an unresolved critical issue weighs more than a long list of minor notes. Code deployed after the audit, upgrades and external integrations fall outside the report and need their own review.

HackenProof is the bug bounty platform of Hacken, where ethical hackers report vulnerabilities in live products and the project pays only for verified bugs. HackenProof checks reports for duplicates and scope before they reach the client, and programs run for NEAR, Sui, Aptos, MetaMask and several crypto exchanges.

After launch, the Hacken Extractor watches contracts around the clock and can pause a protocol automatically when it detects an attack in progress. Hacken also scores the risk of digital asset portfolios continuously with its CORE3 product, which institutional investors use between their due diligence cycles.

Dmytro Budorin and Yevheniia Broshevan are co-founders of Hacken, and Kostiantyn Harniuk is the chief operating officer. Andrii Matiukhin sits on the board and leads information security, and besides Tallinn the company has offices in Lisbon, where its research and development team works, and in Abu Dhabi.

In March 2026 Hacken joined the ecosystem of the Mastercard Crypto Partner Program, which connects digital asset firms with the payment network. In June 2026 Hacken became an auditing provider for the Canton Network, the blockchain that banks use for tokenized assets and settlement.