CertiK

CertiK is a New York-based Web3 security company founded in 2017 by Columbia and Yale professors, offering smart contract audits, penetration testing, formal verification, compliance services and the Skynet project-rating and monitoring platform. It is built for volume: its audit page reports more than 6,200 projects audited, and Skynet's "Recently Audited" feed showed ten projects completed in September 2026 alone. It fits teams that want an audit across many chains plus an ongoing public security profile on Skynet; buyers should also weigh the 2024 Kraken bug bounty dispute described below.

At a glance

Founded	2017 (about)
Headquarters / jurisdiction	New York (about)
Engagement model	private firm audit at high volume, plus a public rating/monitoring platform (Skynet) and compliance products (homepage)
Core specialties	smart contract audits, penetration testing, formal verification, proof of reserves, compliance (VARA, MiCA/DORA), bug bounty (homepage)
Ecosystems / languages	EVM chains (Ethereum, BNB Chain, Polygon and others), Solana, Aptos (Move), plus 10+ L1s per the firm (audit service)
Public report index	Skynet project pages
Open-source tooling	Verus-based formal verification work, a Slither fork (GitHub)
Published pricing	not published; quote on request

What they do

CertiK's homepage lists smart contract audits, penetration testing, formal verification, DLT security, proof-of-reserves audits, regulatory compliance services for Dubai VARA and EU MiCA/DORA, the SkyInsights AML/risk platform, the Skynet rating system and bug bounty programs (homepage). The audit service page describes manual expert review combined with AI-assisted analysis, optional formal verification, severity classification from Critical to Informational, resolution-status tracking, and public report availability (audit service).

Self-reported figures: 6,206+ projects audited, 93,145+ findings, 1,233+ formally verified projects (audit service), and 5,500 clients (homepage). The About page FAQ, read on 2026-10-14, gives different totals: more than 5,500 enterprise and institutional clients, more than 119,000 security vulnerabilities found and $600 billion in digital assets assessed (about). The firm's pages do not reconcile these numbers, and none were independently checked.

Ownership and funding: in January 2026 CEO Ronghui Gu said Binance had made a follow-on investment he described as "multi-eight figures", making Binance the firm's largest investor, and that CertiK plans an IPO (DL News, 2026-01-23). The amount was not disclosed.

Specialties and ecosystem coverage

The directory's EVM chains are consistent with Skynet: PancakeSwap's project page lists 2 security audits and deployment on BSC and opBNB (PancakeSwap on Skynet); Polygon's lists 2 audits (Polygon on Skynet); Gala Games lists 20 (Gala Games on Skynet). Skynet audit counts may include audits recorded from other firms, so they are an upper bound for CertiK's own work. Aptos lists 8 audits (Aptos on Skynet), and Orca, a Solana AMM, is in the September 2026 "Recently Audited" feed (Skynet, Orca on Skynet), which supports Move and Solana coverage.

The directory lists Cosmos; no Cosmos-specific audit was verified in this pass. A STEPN project page was not found on Skynet. The firm's GitHub shows formal verification work on Rust systems code (Verus, zkWasm, an Ethereum Foundation zkVM grant), which goes beyond smart contracts (GitHub).

Recent public work

From the "Recently Audited" feed on the Skynet homepage as displayed on 2026-09-24 (dates shown without a year; taken to be 2026). Individual audit details render client-side and were not read in full.

• PowerXone, September 23
• DataIPO, September 22
• 1win Token, September 21
• CZR, September 20
• DOMA, September 18
• Sera.cx FX Onchain, September 15
• SigMarket, September 14
• iEscrow, September 14
• Starzip, September 8
• Orca, September 7 (project page)

The feed shows only project names and dates; scope and findings require opening each project's audit detail.

Research, tooling and methodology

CertiK's GitHub organization maintains formal verification projects built on Verus (verified Rust), including zkWasm verification, work on the Asterinas OS, and a zkVM evaluation funded by an Ethereum Foundation grant, plus a CertiK fork of the Slither static analyzer (GitHub).

It publishes industry loss data: the Hack3d 2025 annual report (December 23, 2025) put 2025 Web3 losses at about $3.35B (Hack3d 2025), and a security dashboard tracks monthly incidents (dashboard). Leadership listed on the about page includes co-founders Ronghui Gu (Columbia) and Zhong Shao (Yale) (about).

Track record and incidents

• Telcoin, December 26, 2023, about $1.25M lost. CertiK's own post-mortem states it audited Telcoin's token contracts, and that the exploit hit the proxy implementation of the wallet contracts, "a different application" from what it audited (CertiK post-mortem). On that account the exploited code was out of scope. This pass did not load an independent source on the scope question.

• Kraken bug bounty dispute, June 2024. Kraken said a researcher reported a balance-inflation bug and that linked accounts then withdrew nearly $3M; Kraken's CSO called it extortion. CertiK said it was white-hat testing and that Kraken had threatened its employees (CoinDesk). Kraken's CSO later said the funds were returned minus a small amount lost to fees (Blockhead). This was a bug-bounty engagement, not an audit, but it is relevant to how the firm conducts testing on live systems.

• Huione Guarantee stablecoin audit, 2025. DL News reports that CertiK apologised in 2025 after auditing a stablecoin launched by Huione Guarantee (DL News, 2026-01-23). This pass did not load CertiK's own statement.

Only items where a source links an exploit to CertiK's audited code are listed above; no reputable post-audit incident beyond Telcoin was verified in this pass.

Who should consider them — and who might look elsewhere

The public evidence shows broad chain coverage, high audit volume and a public project profile (Skynet), which suits token launches and multi-chain projects that want a published audit and a public security page. The firm also offers compliance, proof-of-reserves and penetration testing under one vendor. Teams that want a small, named reviewer team, deep repeat engagements, or very detailed public methodology per report may find more of that evidence at smaller firms. Buyers engaging CertiK for live-system testing may want explicit written rules of engagement, given the 2024 Kraken dispute.

How to engage

The homepage offers "Request a Quote" and "Talk to an expert" routes (homepage); the audit page mentions flexible options based on code size (audit service). Prepare a repository and commit, a scope list, and decide in advance whether you want the report and Skynet profile public.

Gaps and unverified claims

• Team size is not published; the directory's 250+ could not be confirmed.
• Pricing and turnaround are not published.
• Skynet audit detail pages render client-side; audit counts were read from page metadata on 2026-09-24 and may include other firms' audits.
• The directory lists STEPN as a notable audit; no Skynet project page was found for it.
• Cosmos coverage, listed in the directory, was not verified.
• Self-reported figures (6,206+ audits on the audit page; 5,500 clients, 119,000+ vulnerabilities, $600B assessed and a $2B+ valuation on the About FAQ) are the firm's own and differ between pages.
• The size of Binance's January 2026 investment is undisclosed; "multi-eight figures" is the CEO's phrase as reported by DL News.

Sources

1. CertiK homepage, accessed 2026-09-24
2. CertiK about page, accessed 2026-09-24
3. Smart contract audit service, accessed 2026-09-24
4. Skynet homepage, accessed 2026-09-24
5. Skynet: Orca, accessed 2026-09-24
6. Skynet: PancakeSwap, accessed 2026-09-24
7. Skynet: Polygon, accessed 2026-09-24
8. Skynet: Gala Games, accessed 2026-09-24
9. Skynet: Aptos, accessed 2026-09-24
10. CertiK GitHub organization, accessed 2026-09-24
11. Hack3d: The Web3 Security Report 2025, accessed 2026-09-24
12. CertiK security dashboard, accessed 2026-09-24
13. Post Mortem: Telcoin (CertiK), accessed 2026-09-24
14. CoinDesk: Kraken says hackers turned to extortion, accessed 2026-09-24
15. Blockhead: CertiK, Kraken reach resolution, accessed 2026-09-24
16. DL News: CertiK plans IPO as firm works to regain trust (Binance investment; Huione apology), accessed 2026-10-14