Knight Security

Independent security research practice. We test the security of cryptocurrency exchanges, digital wallets, payment platforms, and fintech infrastructure — then report what we find under coordinated disclosure.

About the practice

Knight Security is an independent research practice focused exclusively on cryptocurrency and financial technology platforms. Since 2024, we have assessed over 200 platforms across 30+ countries — from early-stage startups to exchanges serving millions of users.

Our work is manual, methodical, and thorough. We don't run automated scanners and hand over the output. Every engagement involves deep analysis of authentication flows, API architecture, mobile applications, and business logic. Every finding comes with a working proof of concept, reproduction steps, and a CVSS severity rating.

We operate under coordinated disclosure principles aligned with ISO/IEC 29147. We report vulnerabilities directly to the affected organization, provide a standard 90-day remediation window, and never retain or share user data.

Typical findings across engagements

  • Full account takeover chains through OTP brute-force, authentication bypass, and session manipulation
  • Server-side request forgery reaching internal services, AWS metadata, and cloud infrastructure
  • SQL and NoSQL injection with confirmed data extraction
  • Exposed admin panels, debug endpoints, and development environments in production
  • Hardcoded API keys, encryption secrets, and signing keys in client-side code and mobile apps
  • Broken access control on financial endpoints — withdrawals, transfers, balance manipulation
  • Source code disclosure through public source maps and misconfigured storage buckets
  • Payment logic flaws — invoice forgery, amount manipulation, signature bypass

Track record

200+platforms assessed
2,500+vulnerabilities reported
400+critical-severity findings

Across cryptocurrency exchanges, payment processors, digital banking platforms, card issuers, and DeFi protocols in 30+ countries.

Services

Contact