Hexens

Hexens is a London-headquartered blockchain security firm, founded in 2021. It runs private smart contract and protocol audits alongside offensive security work: L1/L2 reviews, exchange and wallet assessments, and penetration testing. It suits teams building EVM DeFi, bridges, zk and L1 infrastructure that want a firm with an offensive-research profile, and it is one of the few firms in this set that publishes a price range. The strongest evidence-backed signal is its disclosed vulnerability research. In 2026 this included a Solidity compiler storage-corruption bug fixed in solc 0.8.34 and an Aptos Move VM type-confusion flaw that CoinDesk covered. It also keeps a public index of about 120 audit reports.

At a glance

Founded	2021 (about page)
Headquarters / jurisdiction	Covent Garden, London, United Kingdom (about page)
Engagement model	private firm audit and offensive security consultancy; also sells the commercial Glider platform
Core specialties	smart contract and DeFi audits, L1/L2 and bridge reviews, zk/cryptography, CEX and wallet security, TEE reviews, penetration testing
Ecosystems / languages	EVM (Solidity), Solana (Rust), Move (Aptos research), Sway (Fuel), zkVM/Rust (RISC Zero), Kaspa EVM; Vyper and Cairo listed on the services page
Public report index	hexens.io/audit-reports and GitHub reports repo
Open-source tooling	piller (PIL static analysis, early-stage), glider-skills, awesome-fhe-attacks (GitHub org)
Published pricing	"$30,000 for targeted smart contract work to $1,000,000+ for platform-wide assessments" (services page)

What they do

Hexens' blockchain security services page lists seven service areas:

• smart contract audits (Solidity, Rust, Move, Vyper, Cairo)
• L1/L2 reviews (consensus, validators, bridges, sequencers)
• centralized exchange security
• hardware and software wallet audits
• DeFi protocol reviews
• bridge and cross-chain security
• TEE application reviews (SGX, SEV, TrustZone)

The homepage also lists zk-circuit and FHE audits, AI/agentic security audits, full-stack penetration testing and DevSecOps consultancy.

On process, the services page says "two senior security teams run against the same target in parallel, pairing manual review with frontier AI". It quotes 2–4 weeks for focused smart contract reviews and says the firm does not run parallel engagements. The published report pages list pre- and post-remediation commits and state that fixes were verified by Hexens. See, for example, the 1inch Aqua / Swap-VM report.

Hexens also sells Glider, a commercial platform for querying and tagging deployed contract logic across 32+ chains, with token-risk and monitoring products (Glider page).

Specialties and ecosystem coverage

The published reports confirm most of the directory's listed specialties:

• Bridges and cross-chain: Socket, LayerSwap and Polygon Aave/DAI bridge integrations appear in the audit index.
• L2 / zk: Polygon zkEVM (Feb 2023), RISC Zero zkVM and Boundless PoVW. ZKsync's own docs list a Hexens "ZKsync Airbender" audit from August 2025 (ZKsync audits page).
• Solana: Everclear (Dec 2025), Valigator Holdfast (Jun 2026), and 1inch Fusion Solana reports in the index.
• EVM chains: Ethereum, BNB Chain (PancakeSwap), Polygon, Mantle, Celo and Kaspa (ZealousSwap).
• Move: the public evidence is research, not reports, namely the Aptos Move VM disclosure.

This pass did not specifically evidence Arbitrum, Optimism or Base engagements from report titles. The "infrastructure" and "penetration-testing" specialties are listed on the site, but few public reports cover them. One is the Holdfast TypeScript RPC-proxy review.

Recent public work

Selected from the audit reports index, which listed 121 report links when counted from the page HTML on 2026-09-24.

1. Royco: tranche refactoring, Jul 2026 — 6 Low, 1 Info (report page)
2. Valigator Holdfast: Solana stake manager / RPC proxy (TypeScript), Jun 2026 (report page)
3. 1inch: Aqua and Swap-VM protocol, Jan 2026 — 4 Low, 5 Info (report page)
4. Everclear: Solana contracts, Dec 2025 — 1 Critical, 5 Medium (report page)
5. Usual: sUSD0 yield-bearing vault, Oct 2025 (report page)
6. ZKsync: Airbender, Aug 2025 (listed on ZKsync docs)
7. RISC Zero: Boundless Proof of Verifiable Work, Jul 2025 — 2 High (report page)
8. ZealousSwap: Kaspa AMM DEX, May 2025 (report page)
9. PancakeSwap: Infinity core contracts, Apr 2025 — 1 Critical, 1 High across three reviews (report page)

The index also lists 2026 reports for LEDiG, ROWA, Flipper, Kerne, IRIS, LayerCover, Obsidian and others (index). Full PDFs are hosted in the GitHub reports repo.

Research, tooling and methodology

Disclosed vulnerabilities (2026):

• TSTORE Poison. A Solidity via-IR code-generation bug in solc 0.8.28–0.8.33 that could emit sstore instead of tstore on delete. Hexens reported it on 2026-02-11, it was coordinated through SEAL 911, and solc 0.8.34 fixed it on 2026-02-18 (write-up). No CVE is cited.
• Aptos Move VM struct hijack. A stale type-tag cache enabling storage-level type confusion. It was disclosed to Aptos on 2026-02-25 and a public patch followed 2026-02-27 (write-up). CoinDesk reported it went through Aptos's bug bounty and that no funds were lost. A PoC repo is on the GitHub org.
• Polygon Plasma bridge proof forgery. Reported July 2024, patched, and published 2026-03-04 (write-up).

Other research: Cryptography posts on FHE, threshold schemes and Reed–Solomon codes appear on the research page. The org maintains the curated awesome-fhe-attacks list.

Tooling:

• piller is an AGPL-3.0 static-analysis framework for zkEVM PIL. Its README lists TODOs and disabled checkers, which suggests it is early-stage.
• glider-skills (AI-assistant skills for Solidity analysis) and a public CTF (GitHub org).
• Glider itself is commercial.

Severity scheme: Report pages use Critical / High / Medium / Low / Informational (for example PancakeSwap).

Team credentials: The firm publishes staff certifications (OSCP, OSCE3, OSWE, OSEP, CRTL, CISSP, ISO 27001 LA and others) and names its co-founders, Sipan Vardanyan (CEO) and Vahe Karapetyan (CTO) (about page).

Track record and incidents

This pass found no reputable post-audit incident report naming Hexens as the auditor of exploited code. The firm itself claims "zero post-audit exploits across 300+ engagements" (services page). This profile has not independently verified that claim.

Who should consider them — and who might look elsewhere

The strongest public evidence is in EVM DeFi, bridges, zk/L2 infrastructure (Polygon zkEVM, RISC Zero, ZKsync Airbender) and Solana. It is backed by low-level vulnerability research at the compiler and VM level. Teams with that profile, or with exchange, wallet or TEE components alongside contracts, fit what Hexens advertises. Buyers should note the published $30,000 floor, which may not suit small token or NFT projects. Buyers needing Move audit reports (as opposed to research), Cairo/Starknet or Scroll work found little public evidence in this pass and should ask for sample reports.

How to engage

The homepage has a "Request a quote" button and lists a general contact email. A dedicated /contact page returned 404 on 2026-09-24. Before contacting them, have the frozen commit, scope list, architecture docs and a target date ready. For larger engagements, note that the firm prices by scope and complexity within its published range (services page).

Gaps and unverified claims

• Team size: not published by the firm. The directory's "40+" is not verified.
• Firm-published figures not verified independently: "zero post-audit exploits", "300+ engagements", "$120B+ protected" and "91% client retention" (services page).
• Notable audits: no Hexens public report was found for Scroll or Starknet, both of which the directory lists. zkSync (via ZKsync docs), Lido (Lido v2 upgrade, Feb 2023, in the index) and 1inch are confirmed.
• Report count: the index contained 121 report links counted from page HTML on 2026-09-24. The GitHub repo's exact PDF count was not verified.
• Contact page: hexens.io/contact returned 404.

Sources

1. Hexens homepage — accessed 2026-09-24
2. Hexens about page — accessed 2026-09-24
3. Blockchain security services — accessed 2026-09-24
4. Audit reports index — accessed 2026-09-24
5. Report: 1inch Aqua & Swap-VM, Jan 2026 — accessed 2026-09-24
6. Report: Valigator Holdfast, Jun 2026 — accessed 2026-09-24
7. Report: RISC Zero Boundless PoVW, Jul 2025 — accessed 2026-09-24
8. Report: Royco tranche refactoring, Jul 2026 — accessed 2026-09-24
9. Report: Usual sUSD0, Oct 2025 — accessed 2026-09-24
10. Report: PancakeSwap Infinity core, Apr 2025 — accessed 2026-09-24
11. Report: Everclear Solana, Dec 2025 — accessed 2026-09-24
12. Report: ZealousSwap Kaspa, May 2025 — accessed 2026-09-24
13. GitHub: public reports repo — accessed 2026-09-24
14. GitHub: Hexens org — accessed 2026-09-24
15. GitHub: piller — accessed 2026-09-24
16. Research index — accessed 2026-09-24
17. Research: TSTORE Poison — accessed 2026-09-24
18. Research: Aptos struct hijack — accessed 2026-09-24
19. Research: Polygon bridge proof forgery — accessed 2026-09-24
20. Glider product page — accessed 2026-09-24
21. ZKsync docs: audits — accessed 2026-09-24
22. CoinDesk: Aptos flaw found by Hexens (2026-07-04) — accessed 2026-09-24
23. hexens.io/contact (404) — accessed 2026-09-24