Three Sigma

Three Sigma is a blockchain security firm, founded in January 2022, that offers code audits for Solidity, Rust and Move. It also has a separate economic-security practice covering tokenomics, mechanism design and risk. It fits DeFi teams, especially lending, stablecoin and yield protocols, that want a code audit and economic review from one vendor. The strongest evidence-backed signal is its public publications repository: 105 report PDFs, with new reports added through August–September 2026 and repeat engagements with the same clients (Maple Finance, Keyring, InfiniFi).

At a glance

Founded	January 2022 (about page)
Headquarters / jurisdiction	Not stated on the firm's pages; its GitHub organization profile lists Portugal (GitHub org)
Engagement model	Private firm audit, plus economic audits and incident response (services)
Core specialties	DeFi smart contract audits, economic/tokenomics audits, mechanism design, bridge and L1/L2 protocol audits, incident response
Ecosystems / languages	Per the firm: Solidity (EVM), Rust (Solana, NEAR), Move (Sui, Aptos), Bitcoin (services)
Public report index	github.com/threesigmaxyz/publications
Open-source tooling	No security analysis tools found; the org mainly holds SDKs and dev projects (StarkEx/StarkExpress clients, wallet code)
Published pricing	Not published (free quote on request)

What they do

The services page lists two practices.

• Code audits: smart contract audits (Solidity, Rust for Solana/NEAR, Move for Sui/Aptos), dApp audits, bridge audits, L1/L2 protocol audits, OpSec audits, Bitcoin audits and incident response.
• Economic and risk services: economic and tokenomics audits, mechanism design reviews, ecosystem risk assessments, points/incentive program design, DAO audits and staking design reviews.

It also lists continuous monitoring and post-audit support, and bug bounty program design.

The published process has six steps:

1. scoping and planning
2. architecture review
3. line-by-line code review
4. validation and testing
5. severity-ranked report
6. verify and support: PR review of patches, retesting of critical and high fixes, and a final shareable status for exchanges or investors

The same page says most audits take one to three weeks. The Move audit page says the firm uses the Move Prover "where specifications fit." The Rust/Solana page describes property tests, focused fuzzing and fork/devnet simulations.

The incident response page covers the following:

• war-room coordination
• containment
• on-chain forensics
• patches
• white-hat and fund-recovery coordination
• a post-mortem

Specialties and ecosystem coverage

• EVM / Solidity: This is where most of the published reports sit. Examples are Maple Finance (2022–2024), InfiniFi, Keyring and Felix.
• Hyperliquid ecosystem: Folders include Hyperwave (file "HyperliquidForwarder") and Felix.
• Move: A DeepBook report is published. This pass did not extract the report's text to confirm its chain or language. No Aptos report was identified.
• Solana / Rust: The firm offers it (Rust/Solana services) and publishes Solana research such as Rust memory safety on Solana. This pass did not identify a public Solana audit report in the repository.
• Economic reports: The repo holds two, for Yeti Finance (2022) and Panoptic (2024) (publications repo).

The directory lists Ethereum, Polygon, Arbitrum, Optimism, Solana, Aptos and Sui. EVM coverage is well evidenced. Sui has one likely report. Solana and Aptos are offered but not evidenced by public reports found in this pass. The directory's "bridges" specialty matches a listed service, and the archive includes an "orange-bridge-audit" report file.

Recent public work

The list below was pulled from the publications repo and its commit history. On 2026-09-24 the GitHub tree API showed 105 PDF files in 64 audit folders plus 2 economic reports. Dates come from report filenames or commit dates.

1. Keyring: a report dated 27 July 2026, added August 2026 and revised 5 September 2026. The folder also has an "RWA unwind" report (15 June) and several earlier versions.
2. InfiniFi: a series of reports dated 23 Feb, 25 Mar, 12 May, 8 Jun and 13 Jul 2026.
3. Anchored: added August 2026.
4. More Markets: vault core and allocation-transfer reports, added August 2026.
5. Cypher: reports dated 11 Feb 2026 and 8 Apr 2026.
6. Saturn Dollar: added February 2026.
7. DeepBook: added January 2026.
8. Felix: reports added August 2025 and January 2026.
9. Aborean Finance: added October 2025.

Research, tooling and methodology

• Blog research: Examples include an annual review, 2024's most exploited DeFi vulnerabilities (1 January 2025). It concludes that stolen private keys caused the largest losses in 2024. There are also exploit analyses such as the Ronin bridge August 2024 incident, which states the exploited contract was deployed without an audit, and ecosystem guides like Sui vs Solana.
• Tooling: No open-source security analysis tools were found in the GitHub org. Its repos are mostly SDKs and dev work (StarkEx/StarkExpress clients, wallet code) plus the publications repo.
• Methodology: The six-step process described on the services page. The severity scheme is inside the individual PDF reports, which were not parsed in this pass.
• Team: The about page names the CEO (Hugo Nicolau), co-founders and practice leads for code security and economic security. It does not publish a headcount.
• Self-reported figures: The homepage claims 150+ audits, $10B+ in client assets protected and 300+ critical/high issues found. These were not independently verified.

Track record and incidents

This pass found no reputable post-audit incident that names Three Sigma as auditor of the exploited code.

Who should consider them — and who might look elsewhere

• Consider them if you run an EVM DeFi protocol (lending, stablecoins, yield vaults, RWA) and want repeat or iterative audits across releases. The Maple, Keyring and InfiniFi series show that pattern. They are also an option if you want an economic or tokenomics review alongside the code audit from the same firm.
• Ask for samples if you are building on Solana or Aptos. The firm offers both, but public reports for them were not found in this pass.
• Look elsewhere if you need ZK-circuit review or formal verification as the main deliverable. This pass found little public evidence of either beyond the Move Prover mention.

How to engage

Use the contacts page or the "Get a Quote" buttons on the services pages. For urgent incidents, see the incident response page, which says the team mobilizes on short notice. Prepare a repository with a frozen commit, scope and line counts, documentation of invariants, and whether you also want an economic review.

Gaps and unverified claims

• Headquarters is not stated on the firm's own pages. Portugal appears only on the GitHub org profile.
• Team size is not published, so the directory's "25+" is not verified.
• The report PDFs appear to be image-based and could not be text-extracted in this pass. Chain/language per report and severity counts were not verified.
• The case studies page did not render client details when fetched.
• The directory's GitHub link (github.com/three-sigma) points to an org with no public repositories. The firm's own site links github.com/threesigmaxyz. The directory's publicReports points to the homepage, not the reports repo.
• Solana and Aptos are listed in the directory, but no public reports for them were found.

Sources

1. Three Sigma homepage — https://threesigma.xyz — accessed 2026-09-24
2. About page — https://threesigma.xyz/about — accessed 2026-09-24
3. Services page — https://threesigma.xyz/services — accessed 2026-09-24
4. Move audits page — https://threesigma.xyz/services/move-audits — accessed 2026-09-24
5. Rust/Solana audits page — https://threesigma.xyz/services/rust-solana-audits — accessed 2026-09-24
6. Incident response page — https://threesigma.xyz/services/incident-emergency-response — accessed 2026-09-24
7. Case studies page — https://threesigma.xyz/case-studies — accessed 2026-09-24
8. Contacts page — https://threesigma.xyz/contacts — accessed 2026-09-24
9. Blog: 2024 most exploited DeFi vulnerabilities — https://threesigma.xyz/blog/2024-defi-exploits-top-vulnerabilities — accessed 2026-09-24
10. Blog: Ronin bridge exploit analysis — https://threesigma.xyz/blog/exploit/ronin-network-12m-exploit-analysis — accessed 2026-09-24
11. Blog: Sui vs Solana guide — https://threesigma.xyz/blog/ecosystem/sui-vs-solana-guide — accessed 2026-09-24
12. Blog: Rust memory safety on Solana — https://threesigma.xyz/blog/rust-and-solana/rust-memory-safety-on-solana — accessed 2026-09-24
13. GitHub org threesigmaxyz — https://github.com/threesigmaxyz — accessed 2026-09-24
14. Publications repo — https://github.com/threesigmaxyz/publications — accessed 2026-09-24
15. Publications commit history — https://github.com/threesigmaxyz/publications/commits/main — accessed 2026-09-24
16. Keyring reports — https://github.com/threesigmaxyz/publications/tree/main/audits/Keyring — accessed 2026-09-24
17. InfiniFi reports — https://github.com/threesigmaxyz/publications/tree/main/audits/infiniFi — accessed 2026-09-24
18. Anchored report — https://github.com/threesigmaxyz/publications/tree/main/audits/anchored — accessed 2026-09-24
19. More Markets reports — https://github.com/threesigmaxyz/publications/tree/main/audits/More-Markets — accessed 2026-09-24
20. Cypher reports — https://github.com/threesigmaxyz/publications/tree/main/audits/cypher — accessed 2026-09-24
21. Saturn Dollar report — https://github.com/threesigmaxyz/publications/tree/main/audits/SaturnDollar — accessed 2026-09-24
22. DeepBook report — https://github.com/threesigmaxyz/publications/tree/main/audits/deepbook — accessed 2026-09-24
23. Felix reports — https://github.com/threesigmaxyz/publications/tree/main/audits/Felix — accessed 2026-09-24
24. Aborean Finance report — https://github.com/threesigmaxyz/publications/tree/main/audits/aborean-finance — accessed 2026-09-24
25. Maple Finance reports — https://github.com/threesigmaxyz/publications/tree/main/audits/Maple-new — accessed 2026-09-24
26. Hyperwave report — https://github.com/threesigmaxyz/publications/tree/main/audits/Hyperwave — accessed 2026-09-24