Best Web Application Pentesting Firms for Crypto and Fintech

Video transcript

At an exchange, wallet or fintech, the web app is where a session turns into a withdrawal. So the pentest has to follow the money.

In January 2022, Crypto.com said withdrawals were approved without the user entering 2FA. Unauthorized withdrawals hit 483 users, worth over 34 million dollars at the time.

A crypto-grade test checks wallet-signature login for fresh nonces and session binding, server-side 2FA on every value-moving action, object-level authorization, race conditions on withdrawals, and business logic a scanner cannot see.

A disclosure first. Guardian publishes this guide and ranks itself first, and every claim about other firms comes from their own public pages or reputable reporting.

Guardian leads for apps that move funds onchain. NCC Group suits regulated institutions, Bishop Fox continuous testing, Cure53 wallet frontends, Doyensec source-assisted reviews, NetSPI recurring bank programs, and Cobalt fast PTaaS with retesting.

Guardian's offchain team is led by Carlos Polop, creator of HackTricks and PEASS. On the Avantis V2 backend, reviewed alongside the contracts, two independent teams returned 68 findings, including two Critical and six High.

Before you sign, ask whether testers work from your source repository, test every role, send parallel requests at withdrawal endpoints, and how many retest rounds land in the final report.

Read the full guide for price points and the complete checklist, or talk to Guardian.

Disclosure: Guardian publishes this guide, and we ranked ourselves first. We kept every claim about other firms to what their own sites or reputable reporting state, and linked our sources at the end.

Most web application penetration testing companies sell the same checklist to every industry.

At an exchange, wallet or fintech, the web app is where a session turns into a withdrawal.

So the test has to follow the money: who can move funds, under which checks, and what happens when two requests race.

In January 2022, Crypto.com said “transactions were being approved without the 2FA authentication control being inputted by the user.” Unauthorized withdrawals hit 483 users, worth over $34 million at the time.

How We Picked

We ranked firms on five criteria for apps that hold customer funds:

1. Crypto and fintech fit. Public work or named clients in those sectors.
2. Depth on value-moving flows. Business logic, authorization and race conditions.
3. Source access and method. Working from code, mapping every function, testing each privilege level.
4. Retesting and evidence. How fixes are verified, and what the report proves to a bank partner or auditor.
5. Public track record. Published reports, research and named clients.

Guardian ranks itself first because its offchain team works beside its smart contract researchers.

So a web app or backend finding can be judged against what the contracts will actually accept.

For a conventional fintech product with no onchain component, several firms below are equally strong.

What the Test Must Cover

Use this table to check a proposal. A firm that cannot say how it tests each row is quoting a generic web test.

EIP-4361, Sign-In with Ethereum, says the nonce should be chosen per session with enough entropy to prevent replay. It also says sessions must be bound to the address.

Wallets add their own surface. Our crypto wallet pentesting guide covers mobile, desktop and extension wallets.

The 7 Best Firms

1. Guardian

• Best for: exchanges, perps venues, wallets and fintechs whose web app moves funds onchain
• Team: offchain department led by Carlos Polop, creator of HackTricks and PEASS
• Public work: Avantis V2 backend, USDT0 web properties, LayerZero OneSig desktop signer

Guardian reviewed the Avantis V2 backend alongside the V2 contracts. Two independent teams returned 68 findings, including two Critical and six High.

2. NCC Group

• Best for: regulated institutions that want a large global firm
• Crypto and fintech: Web3 application and crypto-custody assessments, plus a financial services practice
• Track record: says it has completed “dozens of successful engagements across exchanges, DeFi protocols, and custodial platforms”

3. Bishop Fox

• Best for: continuous testing of a large or fast-changing external attack surface
• Fintech evidence: says it works with 15+ Fortune 500 financial services firms; Coinbase is among its logos

4. Cure53

• Best for: wallet apps and browser-heavy frontends
• Public work: ERA Wallet (August 2026), Tangem Wallet (November 2025), Coinbase cb-mpc (December 2024) and several MetaMask Snaps

5. Doyensec

• Best for: source-assisted reviews of web, API, GraphQL and Electron apps
• Public work: Brave Wallet audit (Q4 2022) and Zeal Wallet extension and backend audit (Q3 2023)

6. NetSPI

• Best for: banks and large fintechs running a recurring pentest program
• Evidence: lists “Top U.S. Banks” among its clients; logos include Broadridge and Chubb

7. Cobalt

• Best for: teams that need a test started quickly and retests on demand
• Retesting: free retesting with a 7-day SLA, and unlimited on-demand retests during the contract term

Prices and Timelines

Few firms publish prices, and even Cobalt quotes its human pentest credits by contract. The public price points we found:

• Software Secured: web and API pentesting from $10,800, with three retest rounds over 12 months.
• Astra: $5,999 a year for one target on its manual pentest plan.
• Cobalt: $3,500 per autonomous pentest, a limited-time offer for tests completed before December 31, 2026.
• US federal schedules: a median ceiling rate of $155.78 an hour across 441 penetration tester labor categories, as of November 4, 2026.

Treat starting prices as floors for a simple app. A crypto app with several roles, wallet login, a withdrawal flow and an admin panel takes more tester-days.

Guardian does not publish prices. Our Web3 pentest cost guide breaks down what drives a quote.

Questions to Ask Before You Sign

1. Will you test from our source repository, and show that every user-reachable function was mapped?
2. Which roles will you test, and do you need credentials for each one?
3. Will you send parallel requests at our withdrawal endpoints, and check limits and 2FA on the server?
4. Which crypto or fintech reports by the named testers can we read?
5. How many retest rounds are included, and will retest status appear in the final report?
6. Can findings in the app be checked against the contracts, keepers or signers it calls?

How Guardian Tests a Web App

Guardian's WebApp Pentest maps every form, background request, socket and wallet interaction a user can reach, at every privilege level. Then it tests each one.

We scope by what a user can actually do in the app, and strongly recommend working from the source repository.

The same offchain team runs API, cloud and infrastructure, browser extension, SDK and offchain automation engagements. So one test can follow a request from the browser to the backend and on to the chain.

For fintechs, Guardian pairs pentests with Managed Security and a trust center that packages audit and pentest outputs and retest status.

See the fintech page, or our Web3 pentesting firms guide for wallets, keepers and signers.

Frequently Asked Questions

Which company is best for web application pentesting of a crypto exchange or fintech app?

Against the criteria in this guide, Guardian ranks first, and Guardian publishes this guide. NCC Group, Bishop Fox and Cure53 are strong alternatives. Pick the firm whose public work matches your stack.

How much does a web application pentest cost?

Published starting prices include $5,999 a year for one target at Astra and $10,800 for web and API testing at Software Secured. A crypto app with several roles, wallet login and a withdrawal flow usually needs more tester-days.

How long does a web app pentest take?

Astra says its manual pentest takes 10 to 15 working days. Cobalt says its financial services tests can launch within 24 hours. Scope and retest rounds set the real length.

What is different about pentesting a crypto web app?

Crypto apps add wallet login, withdrawals, value-moving API keys and a signing frontend. Testers need to check Sign-In with Ethereum nonces, server-side 2FA, race conditions on balances, and whether the signing screen matches the payload.

Sources

• TechCrunch: 2FA compromise led to $34M Crypto.com hack (January 20, 2022)
• Ethereum Improvement Proposals: EIP-4361, Sign-In with Ethereum (created October 11, 2021)
• NCC Group: About us (accessed November 4, 2026)
• NCC Group: Blockchain security (accessed November 4, 2026)
• NCC Group: Financial services sector (accessed November 4, 2026)
• Bishop Fox: Homepage, services and customers (accessed November 4, 2026)
• Bishop Fox: Company (accessed November 4, 2026)
• Cure53: Services and published reports (accessed November 4, 2026)
• Doyensec: Services and offices (accessed November 4, 2026)
• Doyensec: Research and public reports (accessed November 4, 2026)
• NetSPI: Homepage (accessed November 4, 2026)
• NetSPI: About us (accessed November 4, 2026)
• Cobalt: Financial services pentesting (accessed November 4, 2026)
• Cobalt: Pricing (accessed November 4, 2026)
• Software Secured: Pricing (accessed November 4, 2026)
• Astra Security: Pricing (accessed November 4, 2026)
• US General Services Administration: CALC+ labor ceiling rates, search “penetration tester” (retrieved November 4, 2026)
• Guardian: Web application penetration testing
• Guardian: Avantis offchain review case study
• Guardian: LayerZero client story
• Guardian: USDT0 client story
• Guardian: Introducing Vanguard
• Guardian: Fintechs