NCC Group

NCC Group is a large, long-established cybersecurity consultancy whose web3 work sits in two places: a Blockchain Security service line and a specialist Cryptography Services practice. It fits teams that need cryptographic protocol and implementation review (threshold signatures, zk-SNARK circuits, consensus, key management) or broader enterprise assurance such as pentesting, custody and infrastructure, alongside or instead of a DeFi-focused audit shop. The strongest evidence-backed signal is the Cryptography Services public report list, which includes blockchain reviews for Zcash, the Ethereum Foundation, Protocol Labs/Filecoin, the Solana Foundation, Aleo, Penumbra and DFINITY, published from 2019 to 2026.

At a glance

Founded	1999, tracing its origins to the UK's National Computing Centre (About)
Headquarters / jurisdiction	Presence across the UK, Europe, North America and APAC (About); a single headquarters city is not stated on that page; company announcements and press describe NCC Group plc as Manchester-based (Escode sale RNS, 2026-01-21)
Engagement model	Private consultancy engagements (quote-based)
Core specialties	Cryptography review, smart-contract assessment, Web3 application and custody/operational security, pentesting (Blockchain Security)
Ecosystems / languages	Evidenced: Zcash (Rust), Ethereum consensus cryptography (BLST), Filecoin, Solana (ZK-Token SDK, BLS), Aleo, Penumbra, Internet Computer, VeChain SDK, Mina (reports list)
Public report index	Cryptography Services reports. The general research hub has no dedicated audit index.
Open-source tooling	web3-decoder (Burp Suite extension for JSON-RPC and contract calls); many general security tools on GitHub
Published pricing	Not published

What they do

NCC Group's Blockchain Security page lists three services:

• Smart contract security assessment: logic review, attack-surface mapping, manual testing, fuzzing and exploitation.
• Web3 application security assessment: dApp front ends and off-chain components, including race conditions and replay issues.
• Crypto-custody and operational security assessment: key management, approval workflows, architecture review and threat modelling.

Corporate change (2026): NCC Group announced on 2026-01-21 the sale of Escode, its software escrow business, to funds managed by TDR Capital at an enterprise value of £275.0m (announcement). The sale completed on 2026-05-29, leaving NCC Group as a cyber-security-only business (completion notice). The blockchain practice is unaffected by the disposal as far as the announcements state.

Corporate change (2026): NCC Group announced on 2026-01-21 the sale of Escode, its software escrow business, to funds managed by TDR Capital at an enterprise value of £275.0m (announcement). The sale completed on 2026-05-29, leaving NCC Group as a cyber-security-only business (completion notice). The blockchain practice is unaffected by the disposal as far as the announcements state.

The page names client types (DeFi start-ups, exchanges, custodial platforms, traditional institutions) but no specific clients or chains.

The separate Cryptography Services practice describes itself as a dedicated team focused on cryptographic primitives, protocols and implementations. Its listed offerings include strategic cryptographic advice, design and architecture review, software assessment, primitive review, "Blockchain and Crypto Reviews", protocol review and training. The group's wider offering, visible on its cryptography services page and contact page, includes a 24/7 incident response hotline. No web3-specific fix-review, retainer or report publication policy is published.

Specialties and ecosystem coverage

The public evidence is concentrated in cryptography and protocol-level work rather than Solidity DeFi contracts. From the reports list (reviewed 2026-09-24):

• Zcash: NU3/Blossom (2019–2020), NU4 (2020), NU5 (2021), Zebra (2023), FROST (2023)
• Ethereum: BLST BLS12-381 implementation review, with the report file naming the Ethereum Foundation (2021)
• Protocol Labs / Filecoin: Bellman and BLS signatures (2020), Groth16 proof aggregation (2021)
• Solana: SPL ZK-Token SDK for the Solana Foundation (2023) and a BLS signatures implementation review whose report file names Anza Technology (2026)
• Others: Aleo snarkVM (2023) and snarkOS (2024), Penumbra R1CS (2023), DFINITY threshold ECDSA (2022) and vetKeys (2025), Mina/O(1) Labs (2020, 2021), Horizen Zendoo (2021), IOV Labs powHSM (2022), VeChain JavaScript SDK (2025), Keyfork key management (2024)

Directory comparison:

• Ethereum and Solana are evidenced (at the cryptography and client-library level).
• Polygon and Arbitrum are listed in the directory but no public NCC Group report for them was found.
• Zcash, Ethereum Foundation and Protocol Labs (directory "notable audits") are confirmed. Tezos was not found in the public report list in this pass.
• Cryptography and protocol design are strongly evidenced. Smart-contract (Solidity) auditing is offered on the service page but has little public report evidence.

Recent public work

From the Cryptography Services reports list, blockchain-related items, newest first:

• BLS signatures implementation review, Anza Technology (report PDF), report dated 2026-06-04 in its file name
• vetKeys cryptography review, DFINITY, published October 7, 2025 (engagement spring 2025)
• VeChain JavaScript SDK cryptography and security review (report PDF), report dated 2025-04-10 in its file name
• Keyfork implementation review, 2024
• Aleo snarkOS implementation and consensus review, published February 8, 2024 (25 person-days, November 2023 plus a January 2024 retest)
• Zcash FROST security assessment, 2023
• Penumbra Labs R1CS implementation review, 2023
• Zcash Zebra security assessment, 2023
• Solana Program Library ZK-Token security assessment, published April 13, 2023 for the Solana Foundation
• BLST cryptographic implementation review, 2021

The pace of blockchain reports is modest: roughly one to three a year since 2023 on this list. Client-confidential work would not appear here.

Research, tooling and methodology

• Bybit analysis. NCC Group published an in-depth technical analysis of the Bybit hack (March 10, 2025), covering the Safe{Wallet} front-end compromise. It is a retrospective analysis; NCC Group does not claim to have audited Bybit or Safe.
• Web3 tooling. web3-decoder is a Burp Suite extension that decodes JSON-RPC and smart-contract calls on EVM networks. The wider GitHub org is mostly general application, cloud and hardware security tooling.
• Cryptography community projects. Per the Cryptography Services site, current and former members built BearSSL and CTTK, co-founded CryptoHack, and wrote the Cryptopals challenges. The practice also led the OpenSSL and TrueCrypt audits under the Open Crypto Audit project. The site links IACR ePrint papers through 2026.
• Annual research. The 2025 annual research report references public assessments of "blockchain infrastructures" but gives no counts.
• Methodology. Public reports follow a standard NCC Group format with engagement dates, person-days and retests (see the Aleo snarkOS page). No standalone web3 methodology document was found.

Track record and incidents

No reputable post-audit incident naming NCC Group as auditor of the exploited code was found in this pass.

Who should consider them — and who might look elsewhere

The strongest public evidence is in cryptographic engineering for blockchains: signature schemes (BLS, threshold ECDSA, FROST), zk-SNARK circuits and proving systems, consensus implementations and key-management tooling. The firm also offers broader enterprise services (pentesting, cloud, incident response) that some web3 teams, particularly exchanges and custodians, want from one vendor. Teams whose main need is a Solidity, Move or Solana-program DeFi audit will find little recent public NCC Group report evidence for that work and may want to compare against firms with larger public smart-contract portfolios, or ask NCC Group for relevant private references.

How to engage

Use the contact sales form. It asks for name, company, job title, email, optional phone and a message. The page also lists regional phone lines for UK & Europe, US & Canada and APAC, plus a 24/7 incident response hotline. Prepare the cryptographic specification or whitepaper, the repositories and commit in scope, threat model and deployment context, and whether you want the report published.

Gaps and unverified claims

• The directory's publicReports URL is the Cryptography Services reports list; the general research hub does not list audit reports.
• The directory's team size is "1,800+ experts (company-wide)", matching the firm's About figure ("over 1,800 experts"). The blockchain-specific headcount is not published.
• Polygon and Arbitrum (directory chains) and Tezos (directory notable audit) were not evidenced in public reports.
• The client name and date for two items (Anza, VeChain) come from the report PDF file names and the reports-list title. The PDFs could not be text-extracted in this pass.
• Older research posts (e.g. the 2020 "Coinbugs" whitepaper) now redirect to the research hub and could not be loaded.
• A single headquarters city is not stated on the About page.

Sources

1. NCC Group About, accessed 2026-09-24
2. NCC Group Blockchain Security, accessed 2026-09-24
3. NCC Group Cryptography Services page, accessed 2026-09-24
4. Cryptography Services site, accessed 2026-09-24
5. Cryptography Services reports list, accessed 2026-09-24
6. NCC Group research hub, accessed 2026-09-24
7. NCC Group 2025 annual research report, accessed 2026-09-24
8. Bybit hack technical analysis, accessed 2026-09-24
9. NCC Group GitHub, accessed 2026-09-24
10. nccgroup/web3-decoder, accessed 2026-09-24
11. NCC Group contact sales, accessed 2026-09-24
12. Public report: vetKeys cryptography review, accessed 2026-09-24
13. Report PDF: Anza Technology BLS review, accessed 2026-09-24
14. Report PDF: VeChain JavaScript SDK review, accessed 2026-09-24
15. Public report: Aleo snarkOS, accessed 2026-09-24
16. Public report: Keyfork, accessed 2026-09-24
17. Public report: Zcash FROST, accessed 2026-09-24
18. Public report: Penumbra R1CS, accessed 2026-09-24
19. Public report: Solana ZK-Token, accessed 2026-09-24
20. Public report: Zcash Zebra, accessed 2026-09-24
21. Public report: BLST, accessed 2026-09-24
22. NCC Group newsroom: sale of Escode announced (2026-01-21), accessed 2026-10-14
23. NCC Group newsroom: sale of Escode completed (2026-05-29), accessed 2026-10-14