Hacken

Hacken is a blockchain security and compliance firm founded in 2017 by Ukrainian security researchers. It sells smart contract audits alongside exchange Proof of Reserves, penetration testing, red teaming and regulatory-readiness work (MiCA, DORA, VARA, ISO 27001, CCSS), and runs the HackenProof bug bounty platform. It fits exchanges, custodians and token projects that want code audits, reserves attestations and compliance evidence from one vendor. The strongest evidence-backed signal is volume: its public portfolio lists 2,158 assessments across 1,180 companies, and recurring PoR work for exchanges such as OKX, MEXC and KuCoin was published as recently as September 2026.

At a glance

Founded	2017 (About)
Headquarters / jurisdiction	The About page, read 2026-10-14, lists five "headquarters": New York, Lisbon, Abu Dhabi, Tallinn and Kyiv (its origin) (About); the GitHub org is verified as Hacken OÜ, an Estonian entity (GitHub). A single legal seat is not stated.
Engagement model	Private firm audit and assurance, plus crowdsourced add-ons (DualDefense, HackenProof)
Core specialties	Smart contract audits, Proof of Reserves, pentest/red team, compliance readiness
Ecosystems / languages	EVM (Solidity) dominant; Rust, Circom/ZK, TypeScript/Python appear in the portfolio (portfolio)
Public report index	hacken.io/audits
Open-source tooling	Small: wasmcov, a Uniswap v4 hooks checker, CTFs (GitHub)
Published pricing	not published

What they do

The homepage groups services into three stages:

• Build secure: smart contract audits "built to MiCA standards", full-stack pentests, red teaming and blockchain infrastructure reviews.
• Prove compliance: MiCA, DORA, VARA, ISO 27001 and CCSS readiness, and Proof of Reserves.
• Operate: Extractor (24/7 on-chain threat detection with auto-pause), A3 portfolio risk scoring, DualDefense (crowdsourced audits) and HackenProof bug bounties.

The navigation also lists AI system security audits, wallet and MetaMask Snap audits, tokenomics audits, retainer services and vCISO.

The smart contract audit page describes automated scanning, manual review and dynamic testing (fuzzing, invariants). Clients can submit unlimited in-scope fixes within two weeks for re-checking. The page claims "60+ certified security engineers", ISO 27001 certification and SOC 2 Type II compliance.

The published smart contracts methodology has four phases: onboarding, testing, reporting and remediation check. It notes that "auditors perform manual line-by-line review simultaneously to ensure double coverage", requires a PoC for High and Critical findings, and gives 10 business days for fixes (the service page says two weeks). The methodologies index lists 19 published methodologies, including separate EVM and Solana deployment audits, Proof of Reserves, AI red teaming and EEA EthTrust.

Specialties and ecosystem coverage

The portfolio breaks audits down by platform: Ethereum 855 (41.22%), BNB Chain 449 (21.65%), Other 349, Polygon 257 and Arbitrum 164 (as displayed 2026-09-24). Recent rows include Solidity, Rust, Circom, Python and TypeScript work, plus PoR engagements spanning "Ethereum +14" chains.

Directory tags confirmed by the firm's own pages: smart contracts, pentesting, Proof of Reserves, compliance and AI security (AI system audits and AI red teaming). EVM chains in the directory are consistent with the portfolio. The site has chain-specific service pages for Solana, Optimism and others (homepage), but this pass did not count Solana or Base reports in the portfolio. They fall under "Other" and were not broken out.

Recent public work

From the portfolio's Audits view, sorted by audit date, accessed 2026-09-24 (the list spans 141 pages):

1. EverValue Coin — smart contract (locker/staking), Solidity, 7 findings, 17 Sep 2026.
2. Beldex — white-box wallet pentest, TypeScript, 12 findings, 16 Sep 2026.
3. MEXC — Proof of Reserves (solvency proof), 13 Sep 2026.
4. OKX — recurring Proof of Reserves with ZK component, Rust, 13 Sep 2026.
5. Zilliqa — ZK ownership proof, Circom, 20 findings, 8 Sep 2026.
6. KuCoin — Proof of Reserves (solvency proof), 8 Sep 2026.
7. Europeum — white-box API pentest, 20 findings, 8 Sep 2026.
8. WhiteBIT — black-box iOS pentest, 10 findings, 3 Sep 2026.

Older client pages confirm directory notables: for example, the Binance page lists a PoR code audit dated 13 Feb 2023. The homepage features case studies for Base, Bybit (MiCAR licensing evidence), OKX PoR, EBSI and Mina, and announces Hacken as an auditing provider for Canton Network (June 2026) (homepage).

Research, tooling and methodology

• Severity scheme. Hacken publishes a "Severity Formula Standard". It scores likelihood (1–5), impact (1–5), exploitability (0–2) and complexity (0–2) into Critical (>4.5), High, Medium, Low and Informational bands (methodology).
• Portfolio statistics (firm-reported): 16,501 findings, of which 488 Critical, 1,495 High, 2,895 Medium, 4,632 Low and 6,992 Observations (portfolio).
• Tooling. The hknio GitHub org has 22 public repositories (count on org page, 2026-09-24), including wasmcov (WASM coverage analysis) and a Uniswap v4 hooks checker. Its commercial tools (Extractor, A3) are not open source.
• Team. The About page stated "~80 experts across five continents" when re-read on 2026-10-14 (its September 2026 wording was "130+") and lists individual staff. On 2026-06-19 Hacken announced a restructuring: co-founder Dmytro (Dyma) Budorin became Group CEO, outgoing CEO and co-founder Yevheniia Broshevan joined the board, AI security became a product line, and the group said it is advancing toward a public listing (Hacken restructures for its next phase). The About page says Broshevan sits on the CCSS Steering Committee. It lists staff certifications including CREST and OffSec.

Track record and incidents

• Merlin Labs (26 May 2021, about $680K). rekt.news reported that Merlin Labs "was audited by Hacken on May 15th, just 11 days before this exploit" (rekt.news mirror). The article does not establish whether the exploited code was in the audited scope, and no Hacken response was found in this pass.
• Hacken's own HAI token (20 June 2025, about $170K drained). A bridge private key left on a decommissioned server let an attacker mint 900M HAI. This was an operational key-management failure at Hacken, not an audited-code issue. rekt.news quotes Hacken calling it "human error during architectural changes" (rekt.news).

An exploit after an audit is not by itself proof of a missed finding.

Who should consider them — and who might look elsewhere

The strongest public evidence is in centralised-exchange assurance (recurring PoR for major exchanges), EVM token and DeFi audits at high volume, and offchain pentests. The firm also emphasises MiCA/DORA/VARA compliance support. Teams that need audit, PoR and regulatory evidence packaged together fit the published service set. Protocol teams with complex non-EVM or novel DeFi mechanisms should ask for comparable reports first, since the portfolio is weighted towards Ethereum and BNB Chain and many entries are token-level audits. The HAI incident is a reasonable prompt to ask any vendor about its own key management.

How to engage

Use "Request an audit" on the smart contract audit page or "Request a quote" on the portfolio. The methodology's onboarding phase asks for functional requirements, technical documentation, a reproducible environment and test cases (methodology). Plan remediation within the stated fix window.

Gaps and unverified claims

• No single legal seat is stated; the About page lists five offices and the GitHub verification names Hacken OÜ.
• Audit pricing is not published. The service page's FAQ lists a cost question, but no figure was visible.
• Directory notables: Binance, Bybit, OKX, Crypto.com and 1inch have client pages. VeChain and MetaMask client pages returned 404 at the obvious URLs. The About page does list MetaMask among trusted-by names.
• Firm figures differ across pages: $430B+ PoR assets on the homepage, $174.76B "secured market cap" on the portfolio, $180B+ on the audit page. These are firm-reported and measure different things.
• The directory's turnaround (2–6 weeks) is not published by the firm. Its team size (~80) matches the About page as read on 2026-10-14; the earlier "130+" figure is no longer on the page.

Sources

1. Hacken homepage — accessed 2026-09-24
2. About Hacken — accessed 2026-09-24
3. Audit portfolio — accessed 2026-09-24
4. Binance client page — accessed 2026-09-24
5. Smart contract audit service page — accessed 2026-09-24
6. Methodologies index — accessed 2026-09-24
7. Smart contracts methodology — accessed 2026-09-24
8. hknio GitHub org — accessed 2026-09-24
9. rekt.news: Hacken (HAI) — accessed 2026-09-24
10. rekt.news (mirror): Merlin Labs — accessed 2026-09-24
11. Hacken news: Hacken restructures for its next phase (2026-06-19) — accessed 2026-10-14