Halborn

Halborn sorts its services into two groups, assurance and advisory. On the assurance side, the smart contract assessment is a manual review of code in Solidity, Rust, CosmWasm and other languages that looks for logic errors and hidden vulnerabilities. The same group covers code audits of Layer 1 blockchains, penetration tests of web applications and cloud infrastructure, and red team exercises that simulate a full-scope attack on a company.

The advisory group covers risk assessments, architecture reviews of blockchain systems, technical due diligence and training for client teams. The custody and key management assessment checks multi-signature and MPC schemes, the lifecycle of private keys and the risks of cold, warm and hot wallets. A compliance readiness service prepares digital asset firms for the European MiCA regulation, the US GENIUS Act, the VARA rules in Dubai and the resilience rules of DORA.

Halborn names the Swiss Sygnum Bank on its client list, together with AMINA Bank from Switzerland, the Italian Banca Sella and Bank Frick from Liechtenstein. For Bank Frick, which holds about $1 billion in crypto assets in custody, Halborn reviewed and attested a key ceremony. The team wrote runbooks for the key lifecycle, defined access controls with separation of duties and observed the live offline generation of the keys.

Halborn also worked for a global systemically important bank on its digital asset custody platform, with source code reviews, penetration tests and architecture assessments that found several implementation risks before launch. Under Project Guardian of the Monetary Authority of Singapore, SBI, UBS and DBS ran the first cross-border repo with a natively issued digital bond on a public blockchain, and Halborn audited its smart contracts. In a national CBDC pilot, a red team exercise against the Hyperledger Besu validator nodes of a financial institution found 16 vulnerabilities, four of them critical.

Halborn passed a SOC 2 Type 2 examination by Schellman & Company for the period from 1 December 2023 to 31 May 2024, covering the security controls of its blockchain security services. In January 2026 the firm added an ISO/IEC 27001 certification and an attested alignment with the NIST Cybersecurity Framework 2.0. Halborn argues that regulated institutions need such external validation before they rely on the security claims of a supplier.

Gabi Urrutia, Vice President of Security at Halborn, was appointed in April 2024 as project leader for the revision of the blockchain terminology and architecture standard in the technical committee ISO/TC 307. Gabi Urrutia also works on the Secure Smart Contracts project of Joint Working Group 4 and sits on the board of INATBA, the International Association for Trusted Blockchain Applications.

Halborn publishes its audit reports in an online library that held 266 reports in October 2026, searchable by assessment type, ecosystem and programming language. A report for tZERO Group covers ERC-20 contracts for tokenized real-world assets with whitelist, freeze and forced-transfer controls and lists 19 findings, none of them critical or high and all marked as solved.

A Halborn audit reviews one version of the code at a fixed commit within a set time, so the report describes that code and nothing added later. The tZERO report names one engineer and 12 days of work, excludes economic attacks and third-party dependencies, and recommends a new assessment within six months or after major code changes. A smart contract audit lowers the risk of an exploit, but no audit can rule out every flaw in the code.

Steven Walbroehl and Rob Behnke founded Halborn, and in August 2022 the firm raised a Series A of $90 million led by Summit Partners. Castle Island, Digital Currency Group and Brevan Howard also took part in the round, which paid for more offensive security engineers and the Halborn Labs software unit. Jacques Boschung, who held leadership roles at Kudelski Security and Dell Technologies, became chief executive officer in September 2024.

Halborn tests AI applications in two services, an AI security assessment and AI red teaming. The red team checks models, inputs, integrations and staff for prompt injection, model and data poisoning, malicious chatbots and social engineering driven by AI. Prompt injection is one of the attacks that banks have to test before they connect AI agents to payment or customer systems.