- Home
- Industries
- Digital assets
Security for exchanges, custodians and protocols,
down to the contract.
In digital assets, a malicious contract or a stolen key moves money in minutes and rarely moves it back. THRUD watches new smart contracts as they deploy and traces them to the people behind them, while MSOC and our responders protect the platform, the wallets and the staff who run them.
Where digital-asset businesses get hit.
The attackers are fast, well funded and after assets that settle instantly and are hard to recover.
Malicious contracts
Honeypots that block sells, hidden mint functions and liquidity drains. They look normal on a block explorer, and the worst rarely publish source.
Keys and signing
Hot wallets, signing infrastructure and the people who approve transactions are the direct route to funds. One compromised approver can be enough.
Targeted social engineering
State-backed and criminal groups approach engineers with fake job offers, malicious coding tests and poisoned packages to reach production and wallets.
Front-end and supply chain
A hijacked domain, a compromised dependency or an injected script turns a trusted interface into a wallet drainer for every user who connects.
Customer account takeover
SIM swap, credential stuffing and phishing let attackers withdraw customer balances, and the platform carries the fallout.
Insider and privileged access
Staff with access to custody systems, withdrawal approvals and customer data create opportunities for theft that look like routine operations.
The frameworks you answer to.
UAE regulators first, then Bahrain, Singapore and Hong Kong, then the EU regime for platforms serving Europe. We support the technical side; your counsel owns the legal position.
| Framework | Who it applies to | What we help with |
|---|---|---|
| Virtual Assets Regulatory Authority (VARA) rulebooks | Virtual asset service providers licensed in Dubai, outside the DIFC | Platform security assessment, 24/7 monitoring, and incident evidence your regulator can review |
| ADGM Financial Services Regulatory Authority (FSRA) virtual asset framework | Firms conducting regulated virtual asset activities in ADGM | Technology governance review, custody and key management assessment, and incident response readiness |
| Securities and Commodities Authority (SCA) virtual asset regulation | Virtual asset service providers under the UAE federal regime | Security controls assessment, monitoring and documented incident handling |
| Central Bank of Bahrain (CBB) rulebook, crypto-asset module | Crypto-asset service licensees in Bahrain | Cyber security controls review, penetration testing and incident evidence |
| MAS Payment Services Act and Technology Risk Management (TRM) Guidelines | Digital payment token service providers licensed by the Monetary Authority of Singapore | TRM gap assessment, wallet and platform testing, and incident handling support |
| SFC licensing regime for virtual asset trading platforms | Virtual asset trading platforms operating in Hong Kong | Custody, key management and platform security assessment |
| UAE PDPL, DIFC and ADGM data protection, and Singapore PDPA | Businesses handling personal data, including identity verification records | Breach investigation, impact assessment support and documented incident records |
| SOC 2 | Custodians and platforms whose regulators or institutional clients require independent assurance of controls | Readiness assessment and ongoing control evidence through Forseti |
| MiCA (EU Markets in Crypto-Assets Regulation) | Crypto-asset service providers operating in the EU | ICT security assessment, incident handling and resilience testing support |
The contract is the evidence,if you can read it.
THRUD reads deployed bytecode, so it works whether or not the source is public. Every contract gets a multi-factor risk score, and the deployer and connected wallets are mapped.
Listing and integration decisions
Exchanges and custodians see what a token's contract can actually do, and who deployed it, before they list, support or integrate it.
Token due diligence
Funds and investors check a contract for honeypot and rug-pull capability, and see the deployer's history, before committing capital.
How we help digital-asset businesses.
MSOC
An autonomous SOC that detects and contains threats across your platform, cloud and staff endpoints in under two minutes, around the clock.
Learn more →Web3 threat detectionTHRUD
Real-time monitoring of new contract deployments, bytecode analysis, honeypot and rug-pull detection, deployer attribution and risk-scored alerts.
Learn more →IR retainer
Pre-agreed terms and guaranteed response from four hours down to one, because minutes matter when assets settle instantly.
Learn more →BifrostDigital forensics
What happened, how and when, from wallet infrastructure to staff laptops, documented to a standard regulators, insurers and courts accept.
Learn more →RagnarökPenetration testing
Testing of your exchange, APIs, wallet infrastructure and withdrawal flows, every finding with a fix.
Learn more →Darknet & leak-site monitoring
Watch for your customers' data, staff credentials and planned attacks on your platform on criminal forums and leak sites.
Learn more →What buyers ask.
Is THRUD a smart contract audit?
No. An audit reviews your own code before launch. THRUD watches other people's contracts as they deploy, flags malicious capability in the bytecode and maps who is behind them. Many teams need both.
The contract source isn't published. Can you still assess it?
Yes. THRUD analyses the deployed bytecode directly, so it does not depend on the deployer publishing source code. Unverified contracts are often the ones that most need a look.
We have lost funds. What happens now?
Contact our incident team. Our analysts start from THRUD's attribution, our Bifrost team investigates, and TYR packages the evidence with chain of custody so it holds up with counsel, insurers and law enforcement.
Where does our data live?
We deploy to meet each client's data-residency requirements, including in-country where regulation requires it, and we operate to the group's SOC 2 Type II controls.
See the contract before you trust it.
Put a specialist on a call to scope THRUD, monitoring or response for your platform. No charge, no commitment.