Halborn

Halborn is a blockchain security firm founded by Rob Behnke and Steve Walbroehl and now led by CEO Jacques Boschung. It sells smart contract and Layer 1 assessments alongside web, cloud and red-team testing, AI security testing, and advisory work for banks and custodians. It fits teams that want contract review and offchain or infrastructure testing from one vendor, and institutions building on permissioned or non-EVM ledgers. The strongest evidence-backed signal is its public report index: about 140 audited companies, with recent reports on XRPL amendments for Ripple, Casper, Hedera-based SaucerSwap and LI.FI, as well as red-team engagements.

At a glance

Founded	not stated on the firm's pages; founders named on Who we are
Headquarters / jurisdiction	not published; the firm describes itself as "fully remote" (Who we are)
Engagement model	Private firm audit and advisory
Core specialties	Smart contract and L1 assessments, pentest/red team, custody and key-management review, AI red teaming
Ecosystems / languages	EVM, XRPL (C++ rippled), Casper, Hedera, Solana and others; the homepage claims "22 platforms and languages assessed" (homepage)
Public report index	halborn.com/audits
Open-source tooling	none found (the GitHub org shows one archived Slither fork)
Published pricing	not published

What they do

The homepage splits services into two groups. Advisory covers AI advisory, risk assessment, blockchain architecture, compliance readiness, custody and key management, technical due diligence and training. Assurance covers AI security assessment, AI red teaming, smart contract assessment, Layer 1 assessment, code security audit, web app and cloud pentests, and red team exercises. Firm-stated figures on the homepage: "4,000+ assessments", "100+ security practitioners", "800+ happy clients", "5 publicly disclosed zero days".

Recent case studies lean towards institutional work: Canton Network projects (IntellectEU, Alpend, Tradecraft), Bank Frick custody, SBI's cross-border digital bond repo, a CBDC pilot, several unnamed banks and custodians, and Ripple XRPL amendment hardening.

Reports state their methodology and a CVSS-inspired risk model. Exploitability and impact metrics plus reversibility and scope coefficients produce a 0–10 score. The Ripple MPT DEX report (indexed April 2026) also describes manual C++ review, differential analysis, custom fuzzing utilities and reproduction on a private XRPL testnet.

Specialties and ecosystem coverage

The audit index paginates 12 companies per page over 12 pages. Walking all pages on 2026-09-24 gave about 141 company entries. The index appears to hold recent clients rather than Halborn's full history. Entries span:

• XRPL / C++: Ripple Batch, Lending Protocol and MPT DEX reports (Ripple page).
• Casper: nine reports including CSPR<>EVM bridge (Sept 2026) and Casper 2.0 (Casper page).
• Hedera: SaucerSwap Labs (page).
• EVM and others: index entries include Chainlink Labs, Matter Labs (zkSync), Taiko, Moonwell, 0x, Securitize, Story Protocol and VeChain ecosystem. Solana-related clients such as MagicBlock, Solayer and SOL Strategies also appear (audit index).

The directory's listed chains (Ethereum, Polygon, Arbitrum, Optimism, Base, BNB Chain, Avalanche, Solana) are plausible given the client mix but were not individually mapped to reports. Non-EVM ledgers (XRPL, Casper, Hedera, Canton) are evidenced but not in the directory's list. Its "penetration-testing" and "incident-response" tags are partly supported: pentests and red teams are clearly offered, but no standalone incident-response service is listed on the current homepage.

Recent public work

From the audit index and company pages, newest first, accessed 2026-09-24. Dates are those shown on the index, which may be publication dates rather than engagement dates:

1. Makachain — Red Team Exercise and MakaWallet red team, 21 Sep 2026 (page).
2. LI.FI — Smart Contract Assessment, 16 Sep 2026 (page).
3. Ripple — Batch (re-audit), 8 Sep 2026 (page).
4. Casper Association — CSPR<>EVM Bridge, 5 Sep 2026 (page).
5. SaucerSwap Labs — Smart Contract Assessment, 10 Aug 2026 (page).
6. Ripple — Lending Protocol (re-audit), 23 Jun 2026 (page).
7. Ripple — MPT DEX, listed 10 Apr 2026; engagement ran 21 Jul–5 Aug 2025, commit 03e46cd, 5 findings (2 High, 1 Medium, 2 Informational), with the report stating all findings addressed (report).
8. Ripple — Lending Protocol, 9 Jan 2026 (page).

Research, tooling and methodology

• Methodology and severity. Reports use a CVSS-inspired 0–10 score with Critical/High/Medium/Low/Informational bands and remediation statuses (Solved, Risk Accepted, Not Applicable) (MPT DEX report).
• Disclosures. The site has a Disclosures section described as "All the latest vulnerabilities discovered by Halborn", and the homepage claims five publicly disclosed zero-days. The list did not render for automated retrieval, so individual disclosures were not verified.
• Open source. The GitHub org shows a single archived Slither fork (last updated May 2024). No maintained public tooling was found.
• Team. Who we are names CEO Jacques Boschung, co-founder and Executive Chairman Robert Behnke, co-founder and CTO Steven Walbroehl, and an executive team across the US and Europe.

Track record and incidents

• Seneca (28 Feb 2024, over $6.4M). rekt.news reports that Seneca launched relying on a Halborn audit of its Chamber contract. It says some Halborn findings were approval-related but "this exact issue was not highlighted" (rekt.news). The article does not settle whether the exploited path was within Halborn's scope and commit. No Halborn response was found in this pass.
• ZeroLend (23 Feb 2025, about $371K). rekt.news lists Halborn among ZeroLend's auditors but states "Halborn's reports cover the ONEZ token contracts, not lending markets". The exploited LBTC market was outside Halborn's scope (rekt.news).

An exploit after an audit is not by itself proof of a missed finding.

Who should consider them — and who might look elsewhere

The strongest current public evidence is institutional and non-EVM ledger work: XRPL amendments, Casper, Hedera, Canton Network projects, custody and banking infrastructure. Halborn also covers red-team and pentest work on wallets and apps. Teams that want one vendor for contracts, cloud/web pentests and custody/key-management review fit the published service set. Teams that value open-source tooling, or a long, fully public report history for DeFi primitives, will find less public evidence here than the firm's stated 4,000+ assessments suggest. The current index lists about 141 companies, and older headline clients are not in it.

How to engage

Use the contact form. It asks for organisation, website and the services you want (advisory or assurance), and asks you to "provide details about your project". Reports record the assessed commit and engagement window, so arrive with a frozen commit, scope list and documentation.

Gaps and unverified claims

• The firm's pages do not state a founding year or headquarters. The directory's 2019 is unverified here.
• The directory's notable audits (Sushi, ApeCoin, Pangolin, BlockFi, Phantom) do not appear in the current public audit index (all ~141 entries were checked on 2026-09-24). Company pages at the obvious URLs redirected to the homepage. These engagements may predate the current index.
• The directory's GitHub link (github.com/halborn) resolves, but holds only an archived fork.
• Team size: the directory's "100+" matches the homepage's "100+ security practitioners". The directory's turnaround (3–8 weeks) is not published. The MPT DEX engagement was about two weeks with one engineer.
• Disclosures and zero-day claims could not be checked item by item.
• Index dates can differ from engagement dates. The MPT DEX report is listed as 04.10.2026 but the engagement was July–August 2025.

Sources

1. Halborn homepage — accessed 2026-09-24
2. Audit index — accessed 2026-09-24
3. Ripple reports page — accessed 2026-09-24
4. Ripple MPT DEX report — accessed 2026-09-24
5. LI.FI reports page — accessed 2026-09-24
6. Casper Association reports page — accessed 2026-09-24
7. SaucerSwap Labs reports page — accessed 2026-09-24
8. Makachain reports page — accessed 2026-09-24
9. Who we are — accessed 2026-09-24
10. Case studies — accessed 2026-09-24
11. Disclosures — accessed 2026-09-24
12. Contact — accessed 2026-09-24
13. Halborn GitHub org — accessed 2026-09-24
14. rekt.news: Seneca Protocol — accessed 2026-09-24
15. rekt.news: ZeroLend — accessed 2026-09-24