Audit reports

All Case Studies

Case Studies

About

Careers

Brand Assets

Invest

Company

Audits 

Services

Mitigate weaknesses in your smart contract and improve its functionality with a double line-to-line code analysis and a separate review by a lead auditor.

Secure the entire architecture and implementation layers of your blockchain protocol with professional security audits and testing.

Proactively detect vulnerabilities in your Web3 project by subjecting your systems to a simulated cyberattack in a secure and controlled environment.

Identify vulnerabilities in applications interacting with blockchain networks with secure code review and static security analysis.

Code review & static security analysis for crypto wallet apps.

Code review & security analysis for cross-chain crypto bridges.

Receive only relevant bug reports or undergo crowdsourced penetration testing with the help of thousands of ethical hackers curated by HackenProof.

Enhance transparency in crypto exchanges with independent on-chain proof of assets’ true collateralization.

Assess and strengthen your security practices, identify vulnerabilities, and safeguard valuable digital assets in the ever-evolving cryptocurrency landscape.

Ensure your token model robustness and efficiency and convey trust to investors and community with our thorough, independent audit of protocol economic security.

Solutions

Featured ecosystems

By Languages

Blog

Company 

Discover

Insights

Industry news

Network

Hacken news

Resources

Smart Contract Audit

Blockchain Protocol Audit 

Blockchain Penetration Testing

dApp Audit

Cross-Chain Bridge Audit

Crypto Wallet Audit

Bug Bounty

Proof of Reserves Audit

Solidity

Rust

Move

Solana

Near

Polkadot 

Cosmos 

Optimism

Ethereum (EVM) 

Avalanche

Fantom

Polygon

Aptos

zkSync

Arbitrum

Radix

Linea

MetaMask

Smart Contract Audit Solutions

Terms and Conditions 

Privacy Policy

<h2>DHS warns against using Chinese hardware and digital services</h2>



The DHS (US Department of Homeland Security) has published a "business advisory" warning US companies against using hardware equipment and digital services created or linked to Chinese companies.



These Chinese products could contain backdoors, bug doors, or hidden data collection mechanisms that could be used by Chinese authorities to collect data from foreign companies and forward the information to local competitors to further China's economic goals to the detriment of other countries.



<a href="https://www.zdnet.com/article/dhs-warns-against-using-chinese-hardware-and-digital-services/" target="_blank" rel="noreferrer noopener nofollow">Read more</a>



<h2>Zero-Click Apple Zero-Day Uncovered in Pegasus Spy Attack</h2>



Four nation-states advanced persistent threats (APTs) hacked Al Jazeera producers, journalists, executives, and anchors, with a zero-day exploit for Apple iPhone.



The firm said that the perpetrators could belong to up to four APTs, including potentially those linked to Saudi Arabia and the United Arab Emirates. All of the operators used the NSO Group’s infamous Pegasus spyware.



Pegasus is a mobile phone solution that enables customers to exploit and monitor devices remotely.



<a href="https://threatpost.com/zero-click-apple-zero-day-pegasus-spy-attack/162515/" target="_blank" rel="noreferrer noopener nofollow">Read more</a>



<h2>FBI &amp; Interpol disrupt Joker's Stash, the internet's largest carding marketplace</h2>



Officials from the US FBI and Interpol have seized a small number of servers used by Joker's Stash, the internet's largest marketplace for buying &amp; selling stolen cards, temporarily disrupting the site's activity.



Interpol described the server seizures as an ongoing "coordinated police operational activity" but declined to elaborate further.



These are websites that use top-level domains (TLDs) managed by Emercoin, a blockchain company. Records for these domains are stored inside a blockchain and cannot be transferred to anyone else without the domain owner's cryptographic signature.



<a href="https://www.zdnet.com/article/fbi-interpol-disrupt-jokers-stash-the-internets-largest-carding-marketplace/" target="_blank" rel="noreferrer noopener nofollow">Read more</a>



<h2>Hacker Dumps Crypto Wallet Customer Data; Active Attacks Follow</h2>



From a June attack against cryptocurrency wallet firm Ledger, customer data is now public and actively being used in attacks.



This Monday, hackers dumped sensitive data stolen earlier this year from the Ledger cryptocurrency wallet’s website.&nbsp; This information includes such data: Email addresses, Names, Phone numbers, Physical addresses. And in a twist that surprised no one, the data is now actively being exploited in phishing campaigns.



According to the report, the first includes email addresses of 1,075,382 people who subscribed to the Ledger newsletter.



<a href="https://threatpost.com/ledger-dump-active-attacks-follow/162477/" target="_blank" rel="noreferrer noopener nofollow">Read more</a>



<h2>Swedish university fined $66,000 for GDPR violations</h2>



A Swedish university has been fined SEK550,000 ($66,000) for storing sensitive personal information in the cloud without sufficiently protecting the data.



Umeå University violated the General Data Protection Regulation (GDPR) by failing to properly secure data related to a research study on male sexual health, the Swedish Data Protection Authority has ruled.



The reports contained information on suspicion of a crime, name, personal identity number, contact details, and sensitive data about sexual life and overall health.



It was also faulted for failing to report the data breach under GDPR laws, which came into effect in May 2018.



<a href="https://portswigger.net/daily-swig/swedish-university-fined-66-000-for-gdpr-violations" target="_blank" rel="noreferrer noopener nofollow">Read more</a>

Weekly Digest #15

<h2>1.Cybersecurity Firm FireEye Got Hacked; Red-Team Pentest Tools Stolen</h2>



We advise our clients to make penetration tests and bug bounties regularly. Instead, often hear from our future clients the same answer&nbsp; - "Yes, you know what a robust IT department we have, no one will ever hack us! "&nbsp;



No one can ever be 100% sure, and here is an example of how this happens. Today we will talk about how the cybersecurity company FireEye was hacked. The clients of this company are mainly government agencies and the country's critical infrastructure.&nbsp;



As a result of the leak, the world saw FireEye's tools to simulate an attack on this infrastructure. The article is dedicated to all those who believe that their firewall and IT department are the coolest in the world, and no hacker will ever hack them.



<a href="https://thehackernews.com/2020/12/cybersecurity-firm-fireeye-got-hacked.html" target="_blank" rel="noreferrer noopener nofollow">Read more</a>



<h2>2. Critical Flaws in Millions of IoT Devices May Never Get Fixed</h2>



IoT products may contain vulnerabilities that potentially expose millions or even billions of devices. New research from the IoT security firm highlights 33 flaws in open-source internet protocol bundles that potentially expose millions or even billions of embedded devices to attacks like information interception, denial of service, or full takeover.&nbsp;



The affected devices are smart home sensors and lights, enterprise network equipment, industrial control equipment, barcode readers, and even building automation systems. They're difficult, to patch—and introduce real risk that attackers could exploit these flaws as the first step into a vast array of networks.



<a href="https://www.wired.com/story/amnesia33-iot-vulnerabilitiesmay-never-get-fixed/" target="_blank" rel="noreferrer noopener nofollow">Read more</a>



<h2>3.Microsoft exposes Adrozek, malware that hijacks Chrome, Edge, and Firefox</h2>



Latest security notification from Microsoft today about a new malware strain that infects users' devices and then proceeds to modify browsers and their settings to inject ads into search results pages.



The malware called Adrozek has been active since at least May 2020 and reached its absolute peak in August this year when it controlled more than 30,000 browsers each day.



Users are typically redirected from legitimate sites to shady domains where they are tricked into installing malicious software. The boobytrapped software installs the Androzek malware, which then proceeds to obtain reboot persistence with a registry key.



Once persistence is assured, the malware will look for locally installed browsers such as Google Chrome, Microsoft Edge,&nbsp; Yandex Browser, or Mozilla Firefox. When one of these browsers are found on infected hosts, the malware will attempt to force-install an extension by modifying the browser's AppData folders.



<a href="https://www.zdnet.com/article/microsoft-exposes-adrozek-malware-that-hijacks-chrome-edge-and-firefox/" target="_blank" rel="noreferrer noopener nofollow">Read more</a>



<h2>4. Credit card stealer discovered in social media buttons</h2>



Hackers have created a new type of web malware that hides inside images used for social media sharing buttons to steal credit card details entered in payment forms on online stores.



Such types of malware, known as a web skimmer, or Magecart script, was spotted on online stores in June and September this year.This particular script uses a technique known as steganography. Steganography refers to hiding information inside another format (i.e.,&nbsp; images inside videos, text inside images, etc.).



In the modern world of malware attacks, steganography is typically employed as a way to sneak malicious code past security scanners by placing the wrong code inside seemingly innocent files. This type of code is usually invisible to users and extremely hard to detect, even for professionals.



<a href="https://www.zdnet.com/article/credit-card-stealer-discovered-in-social-media-buttons/" target="_blank" rel="noreferrer noopener nofollow">Read more</a>



<h2>5.BTC-e founder sentenced to five years in prison for laundering ransomware funds</h2>



Today, a French judge has sentenced the founder of the now-defunct BTC-e cryptocurrency exchange to five years in prison. Vinnik also must pay a fine of €100,000 for laundering funds for cybercriminals, including ransomware gangs.



The BTC-e founder currently remains under arrest, and both the US and Russia have filed new extradition requests with France, still hoping to get Vinnik to face charges in their respective jurisdictions.



While Russian authorities are investigating Vinnik in a case of $11,000 in fraud, US authorities said that Vinnik's BTC-e platform helped criminals launder more than $4 billion of illegal funds.



<a href="https://www.zdnet.com/article/btc-e-founder-sentenced-to-five-years-in-prison-for-laundering-ransomware-funds/" target="_blank" rel="noreferrer noopener nofollow">Read more</a>



<h2>6. Android phones from China got caught hiding nasty malware</h2>



Another Chinese company has been spotted spying on a user. For this, a unique malware was developed, which fulfilled all the assigned tasks for them.



Tecno W2 smartphones are low-cost Android phones made in China that, at least in Africa, have been giving established mobile players like Samsung a run for their money.



Android phones made by a Chinese manufacturer and sold for years in Africa came with pre-installed malware that stole users’ data and money. The culprit was found to be Triada, a malware variant that “acts as a software backdoor and malware downloader.”



That’s according to a new report from a mobile security firm, which found that tens of thousands of Android phones were sold in Africa.



<a href="https://bgr.com/2020/08/27/android-phones-malware-found-in-africa-on-devices-from-china/#:~:text=Android%20phones%20made%20by%20a,phones%20were%20sold%20in%20Africa" target="_blank" rel="noreferrer noopener nofollow">Read more</a>



<h2>7.Pfizer-BioNTech data stolen in cyberattack on European Medicines Agency</h2>



On Wednesday, The European Medicines Agency reported a cyberattack's focus involving some of the data around the first COVID-19 vaccine distributed in Europe.



Pfizer and its German partner BioNTech said the cyberattack centered around some documents relating to the EMA's regulatory submission for a COVID-19 vaccine candidate from the two companies. The corporate release said the information was stored on an EMA server and had been unlawfully accessed.



It was not the first attempt to breach COVID-19 vaccine research. Just last week, IBM released that hackers had targeted the cold storage supply chain for COVID-19 distribution.



<a href="https://www.scmagazine.com/home/security-news/data-breach/pfizer-biontech-data-stolen-in-cyberattack-on-european-medicines-agency/" target="_blank" rel="noreferrer noopener nofollow">Read more</a>

Weekly Digest #13

Company name: &nbsp;OneLedger



Company description: OneLedger’s mission is to simplify businesses’ adoption of blockchain technology and its integration into their specific business applications and products. The company believes that the applications of the future will maintain individual data sovereignty and operate across interconnected blockchain networks enabling seamless independent user interactions. OneLedger specializes in providing solutions catering to the Supply Chain (specifically Blockchain EDI) and the Real Estate industry.



Service: Hacken performed a blockchain security review of the OneLedger protocol, analyzed blockchain implementation and tested the potential attacker endpoints, reviewed the architecture and made a smart-contract audit.&nbsp;



<h2>Problems faced by OneLedger&nbsp;</h2>



OneLedger requested a third-party security audit to help identify potential weaknesses and blind spots across the entire infrastructure. This included checking potential entry points that hackers may utilize to compromise the network, smart contract, RPC, etc.&nbsp;



Hacken Service Summary



Hacken performed the blockchain security testing for OneLedger. The project scope was:



1. Architecture Analysis and Threat Modelling&nbsp;



2. Manual and Automated Code Review



3. Smart Contract Audit



4. Manual Validators testing



During the project, consultants found some security issues and the Hacken engineers made recommendations on how to fix them.&nbsp;



Security engineers performed threats analysis, architecture review and prepared a security testing plan covering all the potential security issues.



The smart contract within the scope was manually reviewed and analyzed with static analysis tools. Security engineers found some issues during the initial smart contract audit.



The customer redesigned the smart contract and fixed all found issues. However, low to medium issues were found during the secondary smart contract audit. The customer has already begun working on fixing the medium to high priority issues as recommended by our team.



<h2>Summing Up</h2>



According to the review, the Hacken auditors recommend the OneLedger Protocol to fix security issues to achieve a secure state. The original code of OneLedger was noted to be of very good quality. The OneLedger team has already started working on the bug fixes, and after the fixes are made, the Hacken team will perform a review of fixes and re-test critical components of the protocol.



To learn more about OneLedger, visit <a href="https://www.oneledger.io/" target="_blank" rel="noreferrer noopener nofollow">https://www.oneledger.io/</a>

Security analysis of OneLedger

<a href="https://www.oneledger.io" target="_blank" rel="noreferrer noopener nofollow">OneLedger</a>, a Blockchain as a Service (BaaS) company, that uses its own Blockchain technology to support its customer’s blockchain needs, has appointed Hacken as a security auditor to complement the security strategy and provide the highest level of the security for their customers. 



Under the agreement, Hacken will perform an advanced security code review of the OneLedger protocol, analysis of blockchain implementation and testing of the potential attacker endpoints, architecture review and threat modeling and a smart-contract audit. Under the Wallet &amp; SDK Testing, Hacken will perform advanced black-box testing, source code analysis, holistic testing and quality assurance of the OneLedger’s product. 



“We are focusing on a code review and research of the potential issues for the blockchain. At Hacken, we believe we could improve the security of OneLedger and bring value to the team and product” - said Pavlo Radchuck, a lead blockchain security engineer at Hacken. 



“We stumbled upon many security auditing companies, but once we found Hacken, we were impressed by the value they could bring on to the table. Hacken has a very professional team and we will definitely explore furthering our partnership into other avenues ” - said Pavan Kappara, a Software Architect at OneLedger. 



This work is the beginning of the close security cooperation between OneLedger and Hacken. We will also share a case study after the work is completed.&nbsp; 



<h4>About OneLedger</h4>



OneLedger’s mission is to simplify businesses’ adoption of blockchain technology and its integration into their specific business applications and products. The company believes that the applications of the future will maintain individual data sovereignty and operate across interconnected blockchain networks enabling seamless independent user interactions.



To find out more information about our products and solutions, <a href="https://www.oneledger.io/business" target="_blank" rel="noreferrer noopener nofollow">click here</a>.



Connect with us on <a href="https://www.linkedin.com/company/oneledgertech/" target="_blank" rel="noreferrer noopener nofollow">LinkedIn</a> and<a href="https://twitter.com/OneLedgerTech" target="_blank" rel="noreferrer noopener nofollow"> Twitter</a>.



About Hacken



Hacken is a global cybersecurity consultancy company with an essential focus on blockchain security. Hacken has secured more than 200 blockchain companies and products for the last two years and has become a trusted blockchain security industry leader. It provides a wide range of cybersecurity services such as security assessment, deep-dive penetration testing, bug bounty as a service, and secure code review. Hacken is utilizing its wide network of white hat hackers to provide an exceptional quality of service to its clients.

Get our latest updates and expert insights on Web3 security