Independent security research for the institutions that move money — cryptocurrency exchanges, wallets, payment platforms and the fintech infrastructure behind them. Five years of manual, methodical, evidence-first testing.
In practice since 2021 — a statement of record.
Independent, methodical, and allergic to noise. Every finding goes through responsible disclosure: written up properly, reported to the people who can fix it, and to no one else.
Authentication flows, business logic and session integrity — the full surface.
REST, GraphQL and WebSocket surface analysis. Trust that was never earned.
Android and iOS application review — static and dynamic.
Custody, key handling and withdrawal paths.
Identity, access control and token lifecycle. The locks everyone assumes are locked.
Metadata exposure, IAM and storage misconfiguration.
authorization first, always
Written authorization, explicit boundaries and a fixed timeline — agreed before a single packet is sent.
deliverable — signed scope & rules of engagementMethodical review of the attack surface. Scanners are a floor, not the work — they assist, they do not decide.
deliverable — surface map & candidate weaknessesCandidate issues are proven end to end. What gets reported is a working proof of concept, never a theoretical flag.
deliverable — reproducible poc + cvss 3.1 ratingFindings go directly to the affected organization on a standard 90-day window, then get re-tested after the fix. User data is never retained or shared.
deliverable — full report, remediation guidance, re-testPOST /api/v3/withdraw HTTP/2 Host: wallet.exchange.tld Authorization: Bearer eyJhbGciOiJIUzI1NiIs… Content-Type: application/json { "account_id": "a71f…d19", "asset": "USDT", "amount": "48250.00", "destination": "0x9f…c4" } // account_id above belongs to a victim — not the caller → 200 OK · server never verifies account ownership
Public and private programs on the platforms below. Reports go through platform triage, on program terms — no side channels, no extortion, ever.
A scoped, time-boxed engagement against your own infrastructure. Written authorization first; a full report with reproducible findings and a re-test at the end.
Ongoing coverage for teams that ship fast: recurring passes over new releases, plus a direct line for a second opinion before something goes live.
Authorization before testing. No target is touched without written permission or a published program scope.
No data exfiltration. Proof of impact is demonstrated with the minimum data necessary, then destroyed. Nothing is retained or shared.
No disruption. No denial of service, no destructive payloads, no testing against production data belonging to real users where avoidable.
Coordinated disclosure only. ISO/IEC 29147, 90-day standard window, extended on request while a fix is genuinely in flight.
No brokers, no leverage. Findings are never sold, auctioned, or used as pressure. One report, one recipient: the people who can fix it.
Encrypted by default. Reports over PGP on request; fingerprint verified out of band before anything sensitive moves.
The work lives where the programs live. Reports, when disclosed, speak for themselves.
reports under nda · 90-day coordinated window
pgp key fingerprint on request · no intermediaries