MoveBit (BitsLab)

MoveBit is the Move-ecosystem audit brand of BitsLab, a security group whose 2024 launch announcement was datelined Singapore. It audits Sui and Aptos smart contracts, dApps and chain code, and maintains Move developer tooling. It suits teams building in Move on Sui, Aptos, Movement or IOTA that want a Move-specialist reviewer. The strongest evidence-backed signal is its public report feed. On 2026-09-24 it held 39 MoveBit reports from 2024 to July 2026, 22 of them on Sui. MoveBit also maintains the open-source Sui and Aptos Move Analyzer IDE plugins.

At a glance

Founded	not verified (the GitHub org was created 2022-08-22 per the GitHub API; that is not a founding date)
Headquarters / jurisdiction	BitsLab's January 2024 launch release is datelined Singapore (Chainwire release); MoveBit's own site states no HQ; the Hong Kong Science and Technology Parks directory lists the legal entity MoveBit Limited at Hong Kong Science Park, Pak Shek Kok (HKSTP)
Engagement model	private firm audit (one brand of BitsLab, alongside ScaleBit and TonBit)
Core specialties	Move smart contract, dApp and blockchain audits; formal verification; Move developer tooling
Ecosystems / languages	Move on Sui, Aptos, Movement and IOTA; also some older Polygon and Starcoin reports (sampled reports)
Public report index	movebit.xyz/ListReports (loaded via the site's report API) and GitHub Sampled-Audit-Reports
Open-source tooling	sui-move-analyzer, aptos-move-analyzer, movefmt
Published pricing	not published (homepage)

What they do

The homepage lists three services:

• Move Smart Contract Security Audit, using formal verification and expert review
• Move DApp Security Audit
• Move Blockchain Security Audit, covering architecture and the application layer

It describes a seven-stage process: contact, evaluation and quotation, audit, report delivery, issue fixing, report update, and ongoing monitoring. The homepage also lists products: Sui and Aptos Move Analyzers, an Aptos Move formatter, a Move web IDE, a Move scanner and a Sui contract source verifier, plus a verification page for checking report authenticity.

The parent BitsLab now markets an AI contract scanner ("BitslabAI") alongside expert auditing and formal verification (BitsLab site).

Specialties and ecosystem coverage

The directory's Aptos and Sui chains and its Move specialty are well evidenced. Of the 39 MoveBit reports in the site's report feed on 2026-09-24, 22 are Sui, 8 Aptos, 6 Movement, 1 IOTA and 2 "Others" (report API). The older Sampled-Audit-Reports repo lists Sui and Aptos reports plus a few on Polygon and Starcoin.

The directory lists formal verification as a specialty. The public evidence for it is the Pontem Liquidswap "Formal Verification Audit Report", listed in the sampled reports README. The homepage's description of audits also mentions formal verification. The directory's notable audit "Liquidswap" is confirmed. This pass did not find a report attributed to the "Aptos Foundation".

Recent public work

These are from MoveBit's report feed (report API, which the ListReports page calls), sorted by completion date. Three of the PDF links were spot-checked and returned PDFs.

1. Cetus (Sui, DEX): completed 2026-07-23 — PDF
2. PIVY (Sui, payments): 2026-07-03
3. Pebble (Sui, DeFi, FLP): 2026-03-20 — PDF
4. Umi (Sui, wallet): 2026-02-27
5. Yeap Finance (Aptos, DeFi): 2026-02-03
6. Tokenlabs (IOTA, DeFi): 2026-01-14
7. Haedal Protocol (Sui, DeFi): 2025-12-11 — PDF
8. Navi Protocol (Sui, DCA): 2025-12-05
9. Scallop (Sui, DeFi): 2025-11-24

How the count was made: by year, the feed held 6 reports completed in 2024, 22 in 2025 and 11 in 2026. Called without the MoveBit filter, the same API returned 136 reports across BitsLab brands, including EVM token audits hosted on scalebit.xyz. That total is not MoveBit-only.

Research, tooling and methodology

• Tooling: The GitHub org (61 public repos) maintains sui-move-analyzer, aptos-move-analyzer and movefmt. The GitHub API shows aptos-move-analyzer was last pushed 2026-08-16. New analyzer versions (aptos v1.1.4, sui v1.3.1) were announced in August 2025 (release post). The org also hosts Move CTF challenge repos.
• Research: Recent blog posts include analysis of Aptos function values and reentrancy (Aug 2026), a Pyth core upgrade and Sui oracle trust roots (Aug 2026), and an XRPL–Coreum bridge vulnerability analysis (Aug 2026).
• Credentials: The homepage claims 20+ published security papers and 10+ years of team security experience. No names or papers are listed there.
• Disclosures: No CVEs attributed to MoveBit were found in this pass.

Track record and incidents

Cetus (May 2025, Sui). Cetus's concentrated-liquidity AMM lost about $223 million on 22 May 2025 (rekt.news). The root cause was a flawed overflow check in checked_shlw in the integer-mate math library (The Block, citing Cetus's incident report). Dedaub's analysis states that "audits to this version of the AMM by Ottersec and MoveBit do not find this issue". It adds that library code for numerical calculations may have been out of scope, which it presents as a possibility rather than a confirmed fact (Dedaub). rekt.news quotes Zellic, which audited Cetus later, saying integer-mate was outside its own scope. It does not state MoveBit's scope.

Scope and response. Whether integer-mate was in MoveBit's audited scope was not confirmed in this pass. The shared library was also used by other Sui DEXs (rekt.news). No MoveBit statement on the incident was found. MoveBit's report feed lists a new Cetus audit completed in July 2026 (PDF).

Who should consider them — and who might look elsewhere

The strongest public evidence is in Sui and Aptos Move DeFi (DEXs, lending, liquid staking, DCA and vaults), with some Movement and IOTA work. The firm also maintains Move IDE tooling, which indicates language-level familiarity. Teams outside the Move ecosystem should look at BitsLab's other brands or at other firms, since MoveBit's public reports are nearly all Move. Buyers should confirm in writing whether shared math libraries and dependencies are in scope. The Cetus incident shows why that matters for any auditor.

How to engage

The homepage routes audit requests through a contact section and lists Telegram, X (@MoveBit_) and WeChat. The GitHub org profile lists a contact email. Prepare the Move package at a fixed commit, the target chain and framework version, and a list of dependencies. Explicitly state whether vendored libraries are in scope.

Gaps and unverified claims

• Founding year: the directory's 2022 is not stated on MoveBit or BitsLab pages; only the GitHub org date (2022-08-22) was found.
• Team size: the directory's "30+" is not published.
• Directory links: the directory's publicReports index is movebit.xyz/ListReports, which renders client-side and showed "No Data" to a plain fetch; the older movebit.xyz/audits path returns 404.
• Firm-published claims not independently verified: "over 400 projects", "no big vulnerability attack after their audits" and "over 80% of projects in the Move ecosystem" (Chainwire release, Jan 2024). The Cetus incident above should be read against the "no big vulnerability attack" claim, noting the unresolved scope question. On 2026-10-14 the homepage showed different self-reported figures: "100+ Selected Audit Projects", "20+ papers" and "10+ years". On 2026-10-14 the homepage showed different self-reported figures: "100+ Selected Audit Projects", "20+ papers" and "10+ years".
• Notable audits: no report attributed to the "Aptos Foundation" was found. Older blog URLs about Aptos Framework formal verification returned 404.

Sources

1. MoveBit homepage — accessed 2026-09-24
2. MoveBit report index page — accessed 2026-09-24
3. MoveBit report API (MoveBit filter) — accessed 2026-09-24
4. Report PDF: Cetus, Jul 2026 — accessed 2026-09-24
5. Report PDF: Pebble FLP, Mar 2026 — accessed 2026-09-24
6. Report PDF: Haedal Protocol, Dec 2025 — accessed 2026-09-24
7. GitHub: Sampled-Audit-Reports — accessed 2026-09-24
8. Sampled-Audit-Reports README (raw) — accessed 2026-09-24
9. GitHub: movebit org — accessed 2026-09-24
10. GitHub API: movebit org — accessed 2026-09-24
11. GitHub API: aptos-move-analyzer — accessed 2026-09-24
12. Blog index — accessed 2026-09-24
13. Blog: Move Analyzer releases (Aug 2025) — accessed 2026-09-24
14. BitsLab site — accessed 2026-09-24
15. Chainwire: BitsLab launch release (Jan 2024) — accessed 2026-09-24
16. Dedaub: The Cetus AMM $200M hack — accessed 2026-09-24
17. rekt.news: Cetus — accessed 2026-09-24
18. The Block: Cetus post-mortem coverage — accessed 2026-09-24
19. Blog post URL on Aptos Framework formal verification (404) — accessed 2026-09-24
20. HKSTP directory: MoveBit Limited — accessed 2026-10-14