Crypto Exchange Pentesting: What a Real Assessment Covers

Video transcript

Exchange losses have come through two factor bypass and signing systems, which a smart contract audit does not read. Here is what a real crypto exchange pentest covers.

At Crypto.com, transactions were approved without two factor. Bybit's signers were served a disguised transaction. At Binance, TRM Labs says evidence points to hot wallet signing.

A real pentest follows a withdrawal from button to chain, through apps, APIs, admin tools, cloud, trading engines, and the wallet and signing systems.

Business logic comes first. A withdrawal that runs twice looks like normal traffic, and OWASP says these flaws cannot be detected by a vulnerability scanner.

Testers race parallel withdrawals, check two factor and limits on the server, request other users' data by ID, and confirm read-only keys cannot withdraw.

The largest losses point to signing. Test which cloud roles reach a signer, who approves payouts, where policy rules apply, and whether signers see what they sign.

The report is evidence for your board and often a regulator. It should state scope, reproduce each finding, rank severity by impact, and end with a retest.

Guardian's offchain team is led by Carlos Polop, creator of HackTricks. On the Avantis exchange backend, two independent teams returned 68 findings, two of them Critical.

Read the full article for every test case, or talk to Guardian about testing your path from login to withdrawal.

An exchange is customer funds behind apps, APIs and a wallet stack. Three incidents show where it breaks.

In January 2022, Crypto.com said "transactions were being approved without the 2FA authentication control being inputted by the user." TechCrunch reported over $34 million taken from 483 users.

In February 2025, attackers who had breached a Safe{Wallet} developer machine served Bybit's signers a disguised transaction. Over $1.5 billion left Bybit's ETH cold wallet.

On October 29, 2026, about $6.36 billion left Binance wallets. TRM Labs says the evidence points to a compromise of Binance's hot wallet signing infrastructure.

Binance has yet to publish a root cause.

None of the reported causes sit in code a smart contract audit reads. Here is what a real exchange pentest covers.

Scope of an Exchange Pentest

A real assessment follows a withdrawal from the button to the chain.

For mobile, OWASP's MASVS groups the controls: storage, cryptography, authentication, network, platform, code, resilience and privacy.

Ask for testing from source. Guardian's web app pentest page calls it "the only way to be certain nothing user-reachable was missed."

Business Logic Comes First

Scanners find old libraries and missing headers. They do not find a withdrawal that runs twice.

OWASP's testing guide says this type of flaw "cannot be detected by a vulnerability scanner." Its business logic chapter tests process timing, usage limits and workflow circumvention.

PortSwigger calls race conditions "closely related to business logic flaws." Its examples include "withdrawing or transferring cash in excess of your account balance."

PortSwigger's single-packet attack, first shown at Black Hat USA 2023, completes 20 to 30 requests at once. That makes balance races practical to test.

For APIs, OWASP's API Security Top 10 (2023) ranks broken object level authorization first. Sixth is unrestricted access to sensitive business flows.

For more examples, see our guide to business logic vulnerabilities.

Exchange test cases

• Send parallel withdrawals, transfers and orders against one balance.
• Use zero, negative, tiny and maximum amounts, and check the rounding.
• Check that 2FA and limits hold on the server, not just the screen.
• Change a withdrawal address, then withdraw at once. Does a cooldown hold?
• Request other users' orders, sub-accounts, deposit addresses and statements by ID.
• Confirm read-only API keys cannot trade or withdraw, and revocation is immediate.
• Replay and reorder signed API requests and WebSocket messages.
• Abuse referral, rebate and fee logic at volume.
• Check each deposit is credited once, and only after the required confirmations.

From Guardian's published reports

Guardian's published reviews of backends that move funds show the same pattern:

• Synthetix Withdrawal Flow (H-06): a withdrawal that failed to submit was still acknowledged, so the request was dropped and funds stayed locked.
• Same review (H-15): signatures skipped fields like withdrawal amount and destination, so tampered requests still verified.
• Ethereal orderbook DEX (H-01): the WebSocket rate limiter logged an exceeded quota, then let the request through.
• Longshot (M-18): admin and vault routes that move funds had no step-up second factor.

Wallet and Signing Infrastructure

The two largest losses above point to signing systems, not the apps. The wallet stack needs its own test plan:

• Cloud to keys: which IAM roles, KMS policies and CI runners can reach a signer.
• Withdrawal pipeline: who can create, approve and release a payout, and with how many keys.
• Policy rules: limits, allowlists and velocity checks, enforced where the key signs.
• Signer view: whether the payload signed matches what the signer was shown.
• Wallet tiers: who can move funds between cold, warm and hot wallets.
• Key lifecycle: generation, storage, use, rotation and the response to a suspected compromise.

Bybit's loss came during a routine transfer from its multisig cold wallet to its hot wallet. Test the operations your team runs every week, not just the rare ones.

Keys and signers also need an OpSec audit: who holds what, what a quorum requires, and what happens when someone leaves.

Reporting and Retest

The report is evidence for your board, your bank partners and often a regulator.

In New York, 23 NYCRR 200.16(e) says each virtual currency licensee "shall conduct penetration testing of its electronic systems, at least annually." It also requires vulnerability assessment at least quarterly.

In the EU, read our guide to DORA penetration testing requirements. This is not legal advice; confirm how each rule applies to you with counsel.

A report that holds up includes:

• The scope, the test window, and the build or commit tested.
• Each finding reproduced, with steps and evidence.
• Severity ranked by what reaching it would do, such as funds or keys.
• A fix for each finding, then a retest with its result.
• A map to the frameworks you report against.

Get the number of retest rounds, and the window for them, in writing before you sign.

Choosing a Provider

Ask each firm:

1. Will you test from our source, and show every user-reachable function was mapped?
2. Which roles will you test, with credentials for each?
3. How will you test races on withdrawals, transfers and orders?
4. Will you test the wallet and signing pipeline, not just the apps?
5. Who are the named testers, and which crypto reports of theirs can we read?
6. How many retest rounds are included, and will status appear in the report?
7. Can you check findings against our contracts and keepers, if we run them?

For firms that do this work, see the best web application pentesting companies. For price drivers, see what a web3 pentest costs.

New to the discipline? Start with web3 penetration testing explained.

How Guardian Tests Exchanges

Guardian's offchain services are led by Carlos Polop, Head of Offchain Services, who created HackTricks and the PEASS privilege escalation suite.

• Web app pentest: every form, background request, socket and wallet interaction, at every privilege level.
• API pentest: REST, GraphQL, gRPC and custom protocols, each endpoint at each privilege level.
• Infrastructure pentest: cloud accounts treated as "a set of accounts to escalate through until something signs."
• Offchain automation pentest: relayers, sequencers, risk engines and threshold signers, from source.

For Avantis, a perpetuals exchange on Base, Guardian reviewed the V2 backend: relayer, order and TWAP engines, risk engine and public APIs.

Two independent teams returned 68 findings, including two Critical and six High. Both Criticals were fixed during the review, and every Guardian pentest is closed out with a retest.

Want an engineer's view of your exchange first? Book an hour-long system review.

Frequently Asked Questions

What does a crypto exchange pentest include?

The web and mobile apps, REST and WebSocket APIs, admin tools, cloud and CI/CD, and the wallet and signing systems behind withdrawals. Most of the depth goes to business logic: balance races, server-side 2FA and limits, and API key permissions.

How often should a crypto exchange be pentested?

At least annually, and after major changes. New York's 23 NYCRR 200.16 requires each virtual currency licensee to pentest its electronic systems at least annually and run vulnerability assessments at least quarterly.

Why do scanners miss exchange vulnerabilities?

Business logic flaws depend on what the app is meant to do. OWASP says this type of flaw cannot be detected by a vulnerability scanner. A withdrawal that runs twice under parallel requests looks like normal traffic.

Is a smart contract audit enough for an exchange?

No. Exchange losses have come through 2FA bypass and signing infrastructure, which an audit does not read. An exchange that also runs contracts needs both an audit and a pentest.

Sources

• TechCrunch: 2FA compromise led to $34M Crypto.com hack (January 20, 2022)
• BleepingComputer: Lazarus hacked Bybit via breached Safe{Wallet} developer machine (February 26, 2025)
• TRM Labs: North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History (October 29, 2026)
• OWASP WSTG v4.2: Business Logic Testing
• OWASP WSTG v4.2: Introduction to Business Logic
• PortSwigger Web Security Academy: Race conditions
• OWASP: API Security Top 10 (2023)
• OWASP: Mobile Application Security Verification Standard (MASVS)
• Cornell LII: 23 NYCRR 200.16, Cyber security program
• Guardian: Synthetix Withdrawal Flow (December 15, 2025)
• Guardian: Ethereal Orderbook DEX, Round 2 (July 7, 2025)
• Guardian: Longshot Protocol Review (July 3, 2026)
• Guardian: Avantis offchain review case study
• Guardian: Web application penetration testing
• Guardian: API penetration testing
• Guardian: Cloud and infrastructure penetration testing
• Guardian: Offchain automation pentest
• Guardian: OpSec audit
• Guardian: Regulatory compliance
• Guardian: Guardian Announces Vanguard
• Guardian: Team