https://guardian.security/ https://guardian.security/pentests/ https://guardian.security/smart-contract-audit/ https://guardian.security/smart-contract-audit/stablecoin-audit/ https://guardian.security/smart-contract-audit/solidity-audit/ https://guardian.security/smart-contract-audit/solana-audit/ https://guardian.security/smart-contract-audit/defi-audit/ https://guardian.security/pentests/infrastructure-pentest/ https://guardian.security/pentests/webapp-pentest/ https://guardian.security/pentests/api-pentest/ https://guardian.security/pentests/browser-extension-pentest/ https://guardian.security/pentests/sdk-audit/ https://guardian.security/opsec-audit/ https://guardian.security/pentests/automation-pentest/ https://guardian.security/managed-security/ https://guardian.security/managed-security/watch/ https://guardian.security/institutional/ https://guardian.security/fintechs/ https://guardian.security/onchain-teams/ https://guardian.security/regulatory-compliance/ https://guardian.security/digital-asset-assurance-pilot/ https://guardian.security/digital-asset-assurance-pilot/start/ https://guardian.security/pilot-overview/ https://guardian.security/system-review/ https://guardian.security/vanguard/ https://guardian.security/vanguard/quote/ https://guardian.security/case-studies/ https://guardian.security/case-studies/synthetix-lp-vault/ https://guardian.security/case-studies/usdt0/ https://guardian.security/case-studies/yuga-labs/ https://guardian.security/case-studies/synthetix-bfp/ https://guardian.security/case-studies/poolshark/ https://guardian.security/case-studies/gmx/ https://guardian.security/case-studies/orderly/ https://guardian.security/case-studies/umami/ https://guardian.security/case-studies/dolomite/ https://guardian.security/case-studies/mimswap/ https://guardian.security/case-studies/gmx-keeper/ https://guardian.security/case-studies/avantis-offchain/ https://guardian.security/case-studies/veranta-v2/ https://guardian.security/case-studies/usdt0-gasolina/ https://guardian.security/case-studies/usdt0-deployment-verification/ https://guardian.security/client-stories/layerzero/ https://guardian.security/client-stories/ethena/ https://guardian.security/client-stories/jupiter/ https://guardian.security/client-stories/gmx/ https://guardian.security/client-stories/usdt0/ https://guardian.security/blog/ https://guardian.security/blog/adgm-cyber-risk-management-rules/ https://guardian.security/blog/sfc-vatp-external-assessment-requirements/ https://guardian.security/glossary/2026-11-04 https://guardian.security/glossary/digital-asset-compliance/2026-11-04 https://guardian.security/blog/guardian-vs-other-audit-firms/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/guardian-vs-other-audit-firms/v2/poster.jpg Same Code, Different Results: Guardian vs. Other Auditors We compared 17 codebases that Guardian and another audit firm reviewed at or near the same time, counting each firm's findings from its own public report. https://d1ryz0te1mu7pf.cloudfront.net/blog/guardian-vs-other-audit-firms/v2/video.mp4 96 2026-11-05T01:06:04+00:00 https://guardian.security/blog/sec-central-party-admin-powers/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-central-party-admin-powers/v2/poster.jpg The SEC Central Party Test: Which Admin Powers Make a Protocol Centralized How FAQ 1.5 from the SEC's Division of Corporation Finance defines a central party through four unilateral powers, how those powers map to contract functions, the two carve-outs, and what to hand counsel. https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-central-party-admin-powers/v2/video.mp4 108 2026-11-05T01:12:53+00:00 https://guardian.security/blog/who-controls-defi-admin-keys-census/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/who-controls-defi-admin-keys-census/v3/poster.jpg Who Controls DeFi? Admin Keys Behind 25 of the Largest Protocols Guardian traced who can upgrade, pause, freeze, mint and burn at 25 of the largest DeFi protocols on Ethereum, using public chain state, down to the final key. https://d1ryz0te1mu7pf.cloudfront.net/blog/who-controls-defi-admin-keys-census/v3/video.mp4 93 2026-11-08T17:56:30+00:00 https://guardian.security/blog/canton-coin-no-action-letter/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/canton-coin-no-action-letter/v2/poster.jpg Is Canton Coin a Security? The SEC No-Action Letter Explained What SEC staff's November 3, 2026 Canton Coin letter says and what it leaves out. Covers the 13 node operators, the two-thirds vote, and what these facts mean for teams seeking similar relief. https://d1ryz0te1mu7pf.cloudfront.net/blog/canton-coin-no-action-letter/v2/video.mp4 103 2026-11-05T00:42:56+00:00 https://guardian.security/blog/canton-network-security/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/canton-network-security/v2/poster.jpg Canton Network Security: A Guide for Banks and Asset Managers How secure is Canton Network for institutions? The protocol's guarantees, who controls the Global Synchronizer, and the validator, Daml and key risks banks should review before going live. https://d1ryz0te1mu7pf.cloudfront.net/blog/canton-network-security/v2/video.mp4 107 2026-11-05T00:43:56+00:00 https://guardian.security/blog/crypto-foundation-central-party-sec-faq/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-foundation-central-party-sec-faq/v2/poster.jpg When a Crypto Foundation Is a Central Party: SEC FAQ Footnote 4 Explained Footnote 4 to the SEC staff's FAQ 1.4 says a foundation can itself be a central party. This video covers which foundation-held keys raise that question and a plan for handing them off to governance. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-foundation-central-party-sec-faq/v2/video.mp4 99 2026-11-05T00:46:31+00:00 https://guardian.security/blog/essential-managerial-efforts-security-maintenance/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/essential-managerial-efforts-security-maintenance/v2/poster.jpg Essential managerial efforts after launch: funding audits, fixes and monitoring SEC staff FAQ 2.3 says securing and maintaining a functional crypto system are not essential managerial efforts. This video covers what that includes, and why who ships the fix still matters under FAQ 1.5. https://d1ryz0te1mu7pf.cloudfront.net/blog/essential-managerial-efforts-security-maintenance/v2/video.mp4 96 2026-11-05T00:55:54+00:00 https://guardian.security/blog/genius-freeze-mandate-vs-sec-central-party-test/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/genius-freeze-mandate-vs-sec-central-party-test/v3/poster.jpg Is USDC Centralized? GENIUS Freeze Mandates vs the SEC Central Party Test USDC is centralized by design. This video explains why the GENIUS Act requires freeze powers that SEC staff FAQ 1.5 counts as central party control, and who that affects. https://d1ryz0te1mu7pf.cloudfront.net/blog/genius-freeze-mandate-vs-sec-central-party-test/v3/video.mp4 97 2026-11-05T01:03:07+00:00 https://guardian.security/blog/decentralization-tests-compared/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/decentralization-tests-compared/v3/poster.jpg Decentralization Tests Compared: SEC, FCA, MiCA, FATF and IOSCO How the SEC, the UK FCA, the EU, FATF and IOSCO each test whether a DeFi protocol is decentralized, and the contract facts that feed all five. https://d1ryz0te1mu7pf.cloudfront.net/blog/decentralization-tests-compared/v3/video.mp4 110 2026-11-05T00:50:23+00:00 https://guardian.security/blog/fca-decentralisation-test-perg-18-control-facts/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-decentralisation-test-perg-18-control-facts/v2/poster.jpg FCA Crypto Perimeter Guidance: The Control Facts in Draft PERG 18 How the FCA's draft PERG 18 in CP26/36 decides whether anyone behind a DeFi protocol needs authorization, and the onchain control facts teams should record before applying. https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-decentralisation-test-perg-18-control-facts/v2/video.mp4 93 2026-11-05T00:58:33+00:00 https://guardian.security/blog/fca-gc26-7-defi-mapping-checklist/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-gc26-7-defi-mapping-checklist/v2/poster.jpg FCA DeFi Guidance GC26/7: Mapping Smart Contracts, Oracles, Bridges and Admin Keys A short guide to the FCA's draft DeFi guidance GC26/7. It covers what firms should map, how to record admin key powers, which scenario tests to run and how to monitor dependencies before comments close on November 18, 2026. https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-gc26-7-defi-mapping-checklist/v2/video.mp4 105 2026-11-05T00:59:27+00:00 https://guardian.security/blog/asic-cp-392-asset-holding-standards/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/asic-cp-392-asset-holding-standards/v3/poster.jpg ASIC CP 392: Asset-Holding Standards for Digital Asset Platforms A short guide to ASIC's CP 392 draft asset-holding standards: daily reconciliation, quarterly wallet reports, transfer controls and custodian oversight, with comments due November 27, 2026. https://d1ryz0te1mu7pf.cloudfront.net/blog/asic-cp-392-asset-holding-standards/v3/video.mp4 101 2026-11-05T00:37:18+00:00 https://guardian.security/blog/defi-protocol-due-diligence-checklist/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/defi-protocol-due-diligence-checklist/v2/poster.jpg DeFi Protocol Due Diligence Checklist for Regulated Firms, From ADGM's Draft Guidance How regulated firms can turn the ADGM FSRA's draft DeFi Risk Management Guidance into concrete protocol checks: deployed code, audits, admin keys, timelocks, oracles, bridges and re-diligence triggers. https://d1ryz0te1mu7pf.cloudfront.net/blog/defi-protocol-due-diligence-checklist/v2/video.mp4 100 2026-11-05T00:52:14+00:00 https://guardian.security/blog/adgm-defi-continuous-monitoring/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/adgm-defi-continuous-monitoring/v4/poster.jpg DeFi Protocol Monitoring Under ADGM's Draft Guidance What the FSRA's draft DeFi Risk Management Guidance expects ADGM firms to monitor: seven monitoring areas, onchain admin and governance events, threshold alerts and escalation outside business hours. https://d1ryz0te1mu7pf.cloudfront.net/blog/adgm-defi-continuous-monitoring/v4/video.mp4 105 2026-11-08T17:05:32+00:00 https://guardian.security/blog/federal-reserve-genius-act-proposal-it-security-standards/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/federal-reserve-genius-act-proposal-it-security-standards/v2/poster.jpg Federal Reserve GENIUS Act Proposal: IT, Smart Contract and Key Management Standards What the Federal Reserve's proposed 12 CFR 247.13 would require from stablecoin issuers: smart contract validation, independent testing, private key management and third party oversight. https://d1ryz0te1mu7pf.cloudfront.net/blog/federal-reserve-genius-act-proposal-it-security-standards/v2/video.mp4 100 2026-11-05T01:01:17+00:00 https://guardian.security/blog/cftc-crypto-anprm-comment-deadline/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/cftc-crypto-anprm-comment-deadline/v2/poster.jpg CFTC Request for Comment on Crypto Markets: Answering the Technical Questions Before December 14 The CFTC's crypto asset markets ANPRM closes December 14, 2026. How to answer its smart contract, fail-safe, validator and proof of reserves questions with evidence. https://d1ryz0te1mu7pf.cloudfront.net/blog/cftc-crypto-anprm-comment-deadline/v2/video.mp4 93 2026-11-05T00:44:49+00:00 https://guardian.security/blog/canada-stablecoin-act-draft-regulations/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/canada-stablecoin-act-draft-regulations/v2/poster.jpg Canada Stablecoin Act: Risk, Data Security and Incident Rules for Issuers How Canada's Stablecoin Act and the October 2026 draft regulations set out risk management, data security, review and incident duties for issuers, and the token contract controls that back them. https://d1ryz0te1mu7pf.cloudfront.net/blog/canada-stablecoin-act-draft-regulations/v2/video.mp4 90 2026-11-05T00:41:58+00:00 https://guardian.security/blog/esma-non-mica-compliant-stablecoins-opinion/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/esma-non-mica-compliant-stablecoins-opinion/v2/poster.jpg ESMA's Opinion on Non-MiCA Compliant Stablecoins: What EU CASPs Must Switch Off ESMA's October 2026 opinion puts every CASP service in scope for non-MiCA compliant stablecoins, including custody and transfers. It also rules out disclosures as a fix and sets an 8 January 2027 remediation deadline. https://d1ryz0te1mu7pf.cloudfront.net/blog/esma-non-mica-compliant-stablecoins-opinion/v2/video.mp4 106 2026-11-05T00:55:02+00:00 https://guardian.security/blog/foreign-stablecoin-due-diligence-freeze-seize-burn-checklist/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/foreign-stablecoin-due-diligence-freeze-seize-burn-checklist/v3/poster.jpg GENIUS Act Foreign Issuers: Freeze, Seize and Burn Due Diligence Checklist What Treasury's proposed 12 CFR 1523.3(c) asks exchanges to verify about foreign stablecoin issuers, and Guardian's six-step onchain checklist for freeze, seize and burn functions. https://d1ryz0te1mu7pf.cloudfront.net/blog/foreign-stablecoin-due-diligence-freeze-seize-burn-checklist/v3/video.mp4 98 2026-11-07T03:20:39+00:00 https://guardian.security/blog/is-usdt-genius-act-compliant-foreign-stablecoin-rule/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/is-usdt-genius-act-compliant-foreign-stablecoin-rule/v3/poster.jpg Is USDT GENIUS Act Compliant? What Treasury's Foreign Stablecoin Rule Asks Exchanges to Verify No regulator has ruled on USDT. This video covers the GENIUS Act's two dates for foreign stablecoins, Treasury's due diligence proposal, section 8 bans and the freeze functions that USDT's contracts actually show. https://d1ryz0te1mu7pf.cloudfront.net/blog/is-usdt-genius-act-compliant-foreign-stablecoin-rule/v3/video.mp4 102 2026-11-06T23:38:32+00:00 https://guardian.security/blog/stablecoin-freeze-requirements-mas-hkma-genius/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-freeze-requirements-mas-hkma-genius/v4/poster.jpg Stablecoin Freeze Requirements Compared: MAS, HKMA and the GENIUS Act How the GENIUS Act, the HKMA issuer guidelines and MAS proposal P015-2026 differ on stablecoin freeze requirements, with one role design that meets all three. https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-freeze-requirements-mas-hkma-genius/v4/video.mp4 100 2026-11-06T19:33:03+00:00 https://guardian.security/blog/stablecoin-regulation/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-regulation/v3/poster.jpg Stablecoin Regulation in 2026: GENIUS Act, MiCA, Hong Kong, Singapore and the Security Requirements A short guide to stablecoin regulation in 2026 across six regulations, and the key, freeze, audit and incident rules they place on issuers. https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-regulation/v3/video.mp4 101 2026-11-05T01:19:40+00:00 https://guardian.security/blog/fca-crypto-admission-due-diligence-smart-contracts/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-crypto-admission-due-diligence-smart-contracts/v2/poster.jpg UK Crypto Listing Due Diligence: The Smart Contract Checks in CRYPTO 3.2.5R What the FCA's PS26/9 admission rules require on token technology, and the per-token evidence UK listing teams need: admin powers, key custody, audits and verification limits. https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-crypto-admission-due-diligence-smart-contracts/v2/video.mp4 106 2026-11-05T00:57:41+00:00 https://guardian.security/blog/uk-crypto-regulation-october-2027-deadlines/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/uk-crypto-regulation-october-2027-deadlines/v4/poster.jpg UK Crypto Regulation October 2027: The Deadlines That Matter The UK crypto regulation under SI 2026/102 starts on October 25, 2027, but the FCA application window closes February 28, 2027. Here is every date and the controls each one needs. https://d1ryz0te1mu7pf.cloudfront.net/blog/uk-crypto-regulation-october-2027-deadlines/v4/video.mp4 99 2026-11-08T17:44:19+00:00 https://guardian.security/blog/sec-crypto-safe-harbor-proposal-form-tr/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-crypto-safe-harbor-proposal-form-tr/v2/poster.jpg The SEC Crypto Safe Harbor Proposal: Rule 400, Form TR and the Technical Evidence How the SEC's proposed Rule 400 safe harbor would work, what Form TR asks for, and the role, key and code evidence behind a certification. https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-crypto-safe-harbor-proposal-form-tr/v2/video.mp4 92 2026-11-05T01:13:51+00:00 https://guardian.security/blog/crypto-regulatory-compliance/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-regulatory-compliance/v3/poster.jpg Crypto Regulatory Compliance: The Security Requirements Behind MiCA, DORA, GENIUS, NYDFS and VARA What MiCA, DORA, the GENIUS Act, NYDFS, VARA, MAS and the SFC require on testing, keys and incidents, and the evidence supervisors expect to see. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-regulatory-compliance/v3/video.mp4 113 2026-11-05T00:48:31+00:00 https://guardian.security/blog/federal-decree-law-6-2025-defi/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/federal-decree-law-6-2025-defi/v2/poster.jpg Federal Decree-Law No. 6 of 2025: What the New CBUAE Law Means for DeFi Article 62 of the UAE's new Central Bank law covers DeFi, dApps and protocols that facilitate licensed financial activities. This video covers what is in scope, the penalties, and the control facts your counsel needs. https://d1ryz0te1mu7pf.cloudfront.net/blog/federal-decree-law-6-2025-defi/v2/video.mp4 105 2026-11-05T01:00:22+00:00 https://guardian.security/blog/fatf-defi-report-2026-control-indicators/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/fatf-defi-report-2026-control-indicators/v3/poster.jpg FATF DeFi Report 2026: The 12 Control Indicators Mapped to Smart Contract Functions The FATF's July 2026 DeFi report lists 12 onchain and offchain indicators of control. This video explains them and maps each one to the contract functions, keys and records a protocol should inventory. https://d1ryz0te1mu7pf.cloudfront.net/blog/fatf-defi-report-2026-control-indicators/v3/video.mp4 95 2026-11-05T00:56:46+00:00 https://guardian.security/blog/sfc-circular-on-tokenisation-smart-contract-integrity/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/sfc-circular-on-tokenisation-smart-contract-integrity/v2/poster.jpg SFC Circular on Tokenisation: Smart Contract Integrity and Third-Party Audits How the SFC's revised tokenisation circular makes fund providers prove smart contract integrity with a high level of confidence, control public chains, manage hacking risk and get third-party audits on request. https://d1ryz0te1mu7pf.cloudfront.net/blog/sfc-circular-on-tokenisation-smart-contract-integrity/v2/video.mp4 100 2026-11-05T01:14:54+00:00 https://guardian.security/blog/sfc-va-custody-circular-cold-wallet-standards/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/sfc-va-custody-circular-cold-wallet-standards/v2/poster.jpg SFC VA Custody Circular Explained: Cold Wallet Standards for Hong Kong VATPs How the SFC's custody circular 25EC44 changes cold wallets at Hong Kong VATPs: no public-chain smart contracts, air-gapped keys, whitelists, independent code review and 24/7 monitoring. https://d1ryz0te1mu7pf.cloudfront.net/blog/sfc-va-custody-circular-cold-wallet-standards/v2/video.mp4 101 2026-11-05T01:15:56+00:00 https://guardian.security/blog/in-bcb-701-technical-certification/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/in-bcb-701-technical-certification/v2/poster.jpg IN BCB 701: What Brazil's Technical Certification for Bank and Broker Crypto Services Must Cover A short explainer on Instrução Normativa BCB 701. It covers the 17 items an independent technical certification must address, why a consolidated opinion is rejected, and how Brazilian banks and brokers can prepare the security evidence. https://d1ryz0te1mu7pf.cloudfront.net/blog/in-bcb-701-technical-certification/v2/video.mp4 107 2026-11-05T01:07:04+00:00 https://guardian.security/blog/dora-smart-contract-audits-source-code-review/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/dora-smart-contract-audits-source-code-review/v2/poster.jpg DORA Source Code Review: Do Smart Contract Audits Count Under Article 25? A smart contract audit is one of the tests DORA Article 25 names, but it is not the whole resilience testing program. Here is what it must meet, what it misses, and how to file it as evidence. https://d1ryz0te1mu7pf.cloudfront.net/blog/dora-smart-contract-audits-source-code-review/v2/video.mp4 97 2026-11-05T00:54:04+00:00 https://guardian.security/blog/dora-penetration-testing-requirements/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/dora-penetration-testing-requirements/v2/poster.jpg DORA Penetration Testing Requirements: Articles 24 to 27 and TLPT What penetration testing DORA requires and how often: the Article 24 yearly testing program, TLPT under RTS 2025/1190, tester rules, and a test plan for crypto firms. https://d1ryz0te1mu7pf.cloudfront.net/blog/dora-penetration-testing-requirements/v2/video.mp4 98 2026-11-05T00:53:08+00:00 https://guardian.security/blog/openzeppelin-defender-alternatives/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/openzeppelin-defender-alternatives/v2/poster.jpg OpenZeppelin Defender Alternatives After the July 2026 Shutdown OpenZeppelin Defender shut down on July 1, 2026. This video matches each Defender module to a replacement, covers the gaps in the open-source tools, and walks through the main migration steps. https://d1ryz0te1mu7pf.cloudfront.net/blog/openzeppelin-defender-alternatives/v2/video.mp4 98 2026-11-05T01:11:50+00:00 https://guardian.security/blog/crypto-hack-time-to-detection/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-hack-time-to-detection/v2/poster.jpg How Fast Are Crypto Hacks Detected? Time-to-Detection Data From 30 Exploits Guardian timed 30 crypto exploits from 2024 to 2026 using onchain timestamps: a median 35 minutes to the first public alert, about 2 hours to a team statement, and 88 minutes to a pause. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-hack-time-to-detection/v2/video.mp4 93 2026-11-05T00:47:30+00:00 https://guardian.security/blog/guardian-critical-findings-report/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/guardian-critical-findings-report/v2/poster.jpg What 360 Critical Vulnerabilities Taught Us: Smart Contract Audit Findings Statistics Guardian counted every Critical finding in its 337 published audit reports. This video covers what the 360 Criticals were, which protocols had the most, how often they were fixed, and what teams can do before launch. https://d1ryz0te1mu7pf.cloudfront.net/blog/guardian-critical-findings-report/v2/video.mp4 102 2026-11-05T01:05:08+00:00 https://guardian.security/blog/critical-bugs-post-launch-updates/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/critical-bugs-post-launch-updates/v4/poster.jpg Smart Contract Upgrade Bugs: What Guardian Found in 49 Update Reviews Guardian's published update reviews found 21 Criticals and 83 Highs across 49 reviews. See how often post-launch changes introduce serious bugs, which types appear, and how to review updates. https://d1ryz0te1mu7pf.cloudfront.net/blog/critical-bugs-post-launch-updates/v4/video.mp4 88 2026-11-06T22:25:40+00:00 https://guardian.security/blog/onchain-vs-offchain-crypto-hacks/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/onchain-vs-offchain-crypto-hacks/v3/poster.jpg Onchain vs Offchain Attacks: Where Crypto Hack Losses Came From, 2024 to 2026 Guardian analyzed DefiLlama's hacks data from 2024 to 2026. Code exploits make up most incidents, but offchain compromises of keys, signers and infrastructure account for most of the money lost. https://d1ryz0te1mu7pf.cloudfront.net/blog/onchain-vs-offchain-crypto-hacks/v3/video.mp4 113 2026-11-08T17:34:12+00:00 https://guardian.security/blog/defi-offchain-pentest-findings/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/defi-offchain-pentest-findings/v4/poster.jpg Web3 Pentest Findings: What Guardian Found in DeFi Backends, APIs, Keepers and Cloud What Guardian's published offchain reviews found in 315 findings across DeFi backends, APIs, keepers and cloud, plus case studies and fix priorities. https://d1ryz0te1mu7pf.cloudfront.net/blog/defi-offchain-pentest-findings/v4/video.mp4 113 2026-11-08T18:12:45+00:00 https://guardian.security/blog/multichain-stablecoin-deployment-verification/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/multichain-stablecoin-deployment-verification/v3/poster.jpg Multichain Stablecoin Deployment Verification: How to Check That Every Chain Matches How multichain stablecoin issuers can check bytecode, messaging configuration, roles and migration transactions on every chain, based on Guardian's USDT0 deployment verification work. https://d1ryz0te1mu7pf.cloudfront.net/blog/multichain-stablecoin-deployment-verification/v3/video.mp4 93 2026-11-05T01:09:47+00:00 https://guardian.security/blog/best-web-application-pentesting-companies/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/best-web-application-pentesting-companies/v4/poster.jpg Best Web Application Pentesting Companies for Crypto and Fintech in 2026 Seven web application pentesting firms for crypto exchanges, wallets and fintechs, compared on scope, method and retesting. Guardian publishes this guide and ranks itself first. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-web-application-pentesting-companies/v4/video.mp4 102 2026-11-08T17:37:35+00:00 https://guardian.security/blog/best-web3-pentesting-firms/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/best-web3-pentesting-firms/v4/poster.jpg Best Web3 Penetration Testing Companies in 2026 A short guide to the best web3 penetration testing companies for exchanges, wallets and protocols in 2026. It covers what a web3 pentest should test and where each firm fits best. Guardian publishes the guide. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-web3-pentesting-firms/v4/video.mp4 101 2026-11-08T17:37:35+00:00 https://guardian.security/blog/crypto-wallet-pentesting/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-wallet-pentesting/v3/poster.jpg Crypto Wallet Penetration Testing: What to Test in Mobile, Desktop and Extension Wallets What a crypto wallet pentest covers across mobile, desktop and extension wallets: key storage, signing flows, backend and APIs, supply chain, MPC and passkeys. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-wallet-pentesting/v3/video.mp4 102 2026-11-08T17:17:03+00:00 https://guardian.security/blog/telegram-mini-app-security/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/telegram-mini-app-security/v3/poster.jpg Telegram Mini App Security: A Pentesting Checklist How to secure a Telegram Mini App that moves crypto: server-side initData validation, backend authorization, wallet proof with ton_proof, and webhook protection. https://d1ryz0te1mu7pf.cloudfront.net/blog/telegram-mini-app-security/v3/video.mp4 94 2026-11-08T17:53:18+00:00 https://guardian.security/blog/signing-ui-supply-chain-security/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/signing-ui-supply-chain-security/v3/poster.jpg Your Wallet Frontend Is Attack Surface: Securing Signing Interfaces After Bybit How attackers compromise a crypto wallet's signing interface through cloud buckets, build pipelines and developer machines, and the controls that stop it, from SRI and CSP to verifying on the signer. https://d1ryz0te1mu7pf.cloudfront.net/blog/signing-ui-supply-chain-security/v3/video.mp4 101 2026-11-08T17:32:35+00:00 https://guardian.security/blog/mcp-pentesting-checklist/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/mcp-pentesting-checklist/v2/poster.jpg MCP Pentesting Guide and Checklist How to pentest a Model Context Protocol server: recon, authorization, tool poisoning, transport and SSRF, and supply chain, mapped to the OWASP MCP Top 10. https://d1ryz0te1mu7pf.cloudfront.net/blog/mcp-pentesting-checklist/v2/video.mp4 97 2026-11-05T01:08:55+00:00 https://guardian.security/blog/best-smart-contract-monitoring-tools/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/best-smart-contract-monitoring-tools/v2/poster.jpg Best Smart Contract Monitoring Tools in 2026: 9 Platforms Compared Nine smart contract monitoring tools for 2026, ranked by what they detect, how they respond, who acts on an alert and how they deploy. Guardian publishes this guide and ranks its own service first. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-smart-contract-monitoring-tools/v2/video.mp4 100 2026-11-05T00:39:06+00:00 https://guardian.security/blog/what-is-web3-mdr/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-web3-mdr/v2/poster.jpg What Is Web3 MDR? Managed Detection and Response for Crypto Managed detection and response for crypto explained: what changes onchain, how MDR differs from a monitoring tool, what an SLA should define, and how Guardian delivers it. https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-web3-mdr/v2/video.mp4 97 2026-11-05T01:26:32+00:00 https://guardian.security/blog/web3-pentest-cost/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/web3-pentest-cost/v2/poster.jpg Blockchain Penetration Testing Cost: Public Web3 Pentest Prices in 2026 No one publishes a credible Web3 pentest price list. This video covers the public price points we found and the scope drivers that set a crypto pentest quote. https://d1ryz0te1mu7pf.cloudfront.net/blog/web3-pentest-cost/v2/video.mp4 93 2026-11-05T01:25:08+00:00 https://guardian.security/blog/audit-firm-pricing-compared/2026-11-04 https://d1ryz0te1mu7pf.cloudfront.net/blog/audit-firm-pricing-compared/v3/poster.jpg What Top Audit Firms Charge: OpenZeppelin, Trail of Bits, Halborn and More Public DAO records show what OpenZeppelin, Trail of Bits, Halborn, Certora and others quoted, plus typical weekly auditor rates and the factors behind the price. https://d1ryz0te1mu7pf.cloudfront.net/blog/audit-firm-pricing-compared/v3/video.mp4 100 2026-11-08T21:22:08+00:00 https://guardian.security/finality/2026-11-04 https://guardian.security/blog/top-smart-contract-auditors/2026-11-03 https://d1ryz0te1mu7pf.cloudfront.net/blog/top-smart-contract-auditors/v2/poster.jpg Top 10 Smart Contract Auditors and Digital Asset Security Firms in 2026 Guardian ranks the top 10 smart contract auditors and digital asset security firms of 2026 on coverage, method, protection after launch and track record. Guardian publishes this guide. https://d1ryz0te1mu7pf.cloudfront.net/blog/top-smart-contract-auditors/v2/video.mp4 105 2026-11-05T01:22:21+00:00 https://guardian.security/blog/guardian-announces-managed-security/ https://guardian.security/blog/guardian-commits-5m-to-digital-asset-assurance-pilots/ https://d1ryz0te1mu7pf.cloudfront.net/blog/guardian-commits-5m-to-digital-asset-assurance-pilots/v2/poster.jpg Guardian's Digital Asset Assurance Pilot and $5,000,000 in Funded Pilots How Guardian's Digital Asset Assurance Pilot helps regulated firms secure digital asset programs from design to live, and the $5,000,000 Guardian is committing to funded pilots. https://d1ryz0te1mu7pf.cloudfront.net/blog/guardian-commits-5m-to-digital-asset-assurance-pilots/v2/video.mp4 121 2026-11-05T01:04:13+00:00 https://guardian.security/blog/guardian-announces-vanguard/ https://guardian.security/blog/why-audited-teams-are-getting-hacked/ https://guardian.security/blog/web2-the-hidden-layer-of-defi-risk/ https://guardian.security/blog/introducing-guardian-defender/ https://guardian.security/blog/baseline-markets-vulnerabilities-reported-and-resolved/ https://guardian.security/blog/dn404-vulnerabilities-reported-and-resolved/ https://guardian.security/blog/how-to-audit-a-smart-contract/2026-11-04 https://i.ytimg.com/vi/5g-Hzw5ind8/hqdefault.jpg Complete Smart Contract Auditing System How to audit a smart contract with a repeatable system: preparation, jobs to be done, audit tags, attack knobs, broken invariants, PoCs and the final report. https://www.youtube.com/embed/5g-Hzw5ind8 1492 2023-02-17T00:00:00+00:00 https://guardian.security/blog/ways-to-miss-vulnerabilities-in-an-audit/2026-11-04 https://i.ytimg.com/vi/f--w08g7lyU/hqdefault.jpg 28 Ways To Miss Vulnerabilities In A Smart Contract Audit Smart contract audit mistakes that hide vulnerabilities: 27 ways auditors miss bugs, from unchecked external calls to weird ERC-20s, and what to do instead. https://www.youtube.com/embed/f--w08g7lyU 1613 2023-03-26T00:00:00+00:00 https://guardian.security/blog/how-to-prepare-for-a-smart-contract-audit/2026-11-04 https://i.ytimg.com/vi/BY0Edn_py_k/hqdefault.jpg Getting An Audit? 13 Mistakes To Avoid How to prepare for a smart contract audit: 13 mistakes protocol teams make, from thin docs to no code freeze, plus five design habits that cut audit cost. https://www.youtube.com/embed/BY0Edn_py_k 1293 2023-06-18T00:00:00+00:00 https://guardian.security/blog/smart-contract-audit-severity-levels/2026-11-04 https://i.ytimg.com/vi/f4UdAnHUpSE/hqdefault.jpg Is This A Critical? How To Rank Vulnerability Severity Smart contract audit severity levels explained: what makes a finding critical, high, medium or low, how to rate centralization risks and when to merge findings. https://www.youtube.com/embed/f4UdAnHUpSE 2894 2023-12-03T00:00:00+00:00 https://guardian.security/blog/solidity-security-best-practices/2026-11-04 https://i.ytimg.com/vi/UUhjTcD1BfM/hqdefault.jpg The 9 Keys To Developing Secure Smart Contracts Solidity security best practices from audit work: write less code, validate inputs, avoid loops, scrutinize external calls, add post checks and document flows. https://www.youtube.com/embed/UUhjTcD1BfM 2603 2024-03-03T00:00:00+00:00 https://guardian.security/blog/formal-verification-smart-contracts/2026-11-04 https://i.ytimg.com/vi/imSy7Ll9ftg/hqdefault.jpg Guide To Formal Verification | Take Security To The Next Level How formal verification of smart contracts works: Boolean formulas, SMT solvers and Solidity's SMTChecker, with worked examples of invariants and targets. https://www.youtube.com/embed/imSy7Ll9ftg 1129 2023-06-22T00:00:00+00:00 https://guardian.security/blog/mutation-testing-solidity/2026-11-04 https://i.ytimg.com/vi/HIN8lmj597M/hqdefault.jpg The #1 Most Underrated Web3 Security Tool Mutation testing in Solidity measures how many bugs your tests catch. Learn how it works, how to run Gambit and Vertigo, and how to kill surviving mutants. https://www.youtube.com/embed/HIN8lmj597M 2173 2024-03-10T00:00:00+00:00 https://guardian.security/blog/how-to-write-a-smart-contract-poc/2026-11-04 https://i.ytimg.com/vi/pn-UpJ0yas4/hqdefault.jpg Guide To Writing PoCs How to write a smart contract proof of concept: scope the PoC in comments, reuse the test harness, log as you debug and prove the finding, using a GMX V2 example. https://www.youtube.com/embed/pn-UpJ0yas4 1938 2023-06-08T00:00:00+00:00 https://guardian.security/blog/how-to-find-critical-vulnerabilities/2026-11-04 https://i.ytimg.com/vi/oIoozgIl4pw/hqdefault.jpg How To Find SO Many Criticals You Get Bored Of Auditing How to find critical vulnerabilities in smart contracts with the GTDA method: set goals, tag questions, diagram call paths, then attack with your toolbox. https://www.youtube.com/embed/oIoozgIl4pw 2741 2024-02-01T00:00:00+00:00 https://guardian.security/blog/how-to-become-a-smart-contract-auditor/2026-11-04 https://i.ytimg.com/vi/CUU5kVVVl7Y/hqdefault.jpg 4 Steps To Become A Master Security Researcher How to become a smart contract auditor: build in Solidity, learn DeFi primitives, read codebases deeply, study vulnerabilities, then audit and publish your work. https://www.youtube.com/embed/CUU5kVVVl7Y 1096 2023-10-08T00:00:00+00:00 https://guardian.security/blog/common-smart-contract-vulnerabilities/2026-11-04 https://i.ytimg.com/vi/MgCSEUrMnSQ/hqdefault.jpg 22 Vulnerabilities I Use To Find Criticals FAST! A smart contract vulnerabilities list of 22 attack vectors to check first in a new codebase, from front-running and weird ERC-20s to signatures and hash collisions. https://www.youtube.com/embed/MgCSEUrMnSQ 1996 2024-01-21T00:00:00+00:00 https://guardian.security/blog/sneaky-solidity-bugs/2026-11-04 https://i.ytimg.com/vi/8fNNVQv4-oY/hqdefault.jpg 21 Sneaky Smart Contract Bugs | Do Not Miss These! 21 sneaky Solidity bugs from real audits: struct deletes, downcast overflow, msg.value in loops, stale prices, off by one errors and more, with fixes. https://www.youtube.com/embed/8fNNVQv4-oY 1738 2023-06-11T00:00:00+00:00 https://guardian.security/blog/reentrancy-attacks-explained/2026-11-04 https://i.ytimg.com/vi/3T1t2ginfTg/hqdefault.jpg The Ultimate Guide To Reentrancy A reentrancy attack exploits state that is outdated during an external call. Learn classic, cross-function, cross-contract and read-only reentrancy. https://www.youtube.com/embed/3T1t2ginfTg 1881 2023-05-07T00:00:00+00:00 https://guardian.security/blog/liquidation-vulnerabilities/2026-11-04 https://i.ytimg.com/vi/AD2IF8ovE-w/hqdefault.jpg You Have To Know These 13 Critical Liquidation Vulnerabilities 13 liquidation vulnerabilities in DeFi lending, perps and options protocols, from blacklisted tokens and unpayable fees to self-liquidation, with a checklist. https://www.youtube.com/embed/AD2IF8ovE-w 3538 2024-01-18T00:00:00+00:00 https://guardian.security/blog/weird-erc20-tokens-checklist/2026-11-04 https://i.ytimg.com/vi/Tx0f8A2Yd3k/hqdefault.jpg 12 ERC20 Edge Cases | Web3 Exploits 101 Weird ERC20 tokens break DeFi protocols: fee-on-transfer, callbacks, missing return values, blacklists, approval rules, decimals and more, with a checklist. https://www.youtube.com/embed/Tx0f8A2Yd3k 2167 2023-11-16T00:00:00+00:00 https://guardian.security/blog/erc4626-inflation-attack/2026-11-04 https://i.ytimg.com/vi/3IMw7xbxJgY/hqdefault.jpg Vault Exploit Masterclass | 3 Red Flags | Web3 Exploits 101 How the ERC4626 inflation attack steals the first deposit, the three red flags that reveal it, the Beefy and Kelp examples, and the two fixes that stop it. https://www.youtube.com/embed/3IMw7xbxJgY 3777 2023-12-18T00:00:00+00:00 https://guardian.security/blog/defi-accounting-vulnerabilities/2026-11-04 https://i.ytimg.com/vi/-9VmITcdm3c/hqdefault.jpg The Vulnerability Nobody Talks About | Web3 Security 101 DeFi reward accounting vulnerabilities from stepwise jumps: sandwiched reward compounds, reward and interest rate updates, and vault inflation attacks. https://www.youtube.com/embed/-9VmITcdm3c 1611 2023-12-24T00:00:00+00:00 https://guardian.security/blog/price-oracle-manipulation/2026-11-04 https://i.ytimg.com/vi/tbGqaDHZtuc/hqdefault.jpg Oracle Manipulation | Web3 Security 101 How an oracle manipulation attack works: slot0 spot prices, a lending exploit with real numbers, Cream Finance, TWAP limits under proof of stake, and fixes. https://www.youtube.com/embed/tbGqaDHZtuc 2232 2023-10-28T00:00:00+00:00 https://guardian.security/blog/sandwich-attack/2026-11-04 https://i.ytimg.com/vi/6y3nwJS4UJw/hqdefault.jpg Sandwich Attacks | Web3 Exploits 101 How a sandwich attack in crypto works on an AMM, why slippage protection stops it, a real hard-coded slippage finding, and a live jaredfromsubway.eth sandwich. https://www.youtube.com/embed/6y3nwJS4UJw 1442 2023-09-10T00:00:00+00:00 https://guardian.security/blog/front-running-smart-contracts/2026-11-04 https://i.ytimg.com/vi/dlEIfGT2bHo/hqdefault.jpg Front-Running Attacks | Web3 Exploits 101 How a front running smart contract attack works: the mempool, priority fees, two real audit findings, and a framework for finding front running in review. https://www.youtube.com/embed/dlEIfGT2bHo 1541 2023-09-03T00:00:00+00:00 https://guardian.security/blog/upgradeable-smart-contracts-explained/2026-11-04 https://i.ytimg.com/vi/e5lWvt1rIm0/hqdefault.jpg Smart Contract Upgradeability 101 | 5 Upgradeability Methods Upgradeable smart contracts explained: eternal storage, transparent proxies, UUPS, beacon proxies and the diamond standard, with each pattern's pitfalls. https://www.youtube.com/embed/e5lWvt1rIm0 2417 2023-08-20T00:00:00+00:00 https://guardian.security/blog/upgradeable-contract-vulnerabilities/2026-11-04 https://i.ytimg.com/vi/6aPyykZhglM/hqdefault.jpg Do Not Miss These 5 Upgradeability Vulnerabilities Five upgradeable contract vulnerabilities auditors keep finding: storage gaps, upgradeable inheritance, initializers and unprotected UUPS upgrades. https://www.youtube.com/embed/6aPyykZhglM 1949 2024-01-14T00:00:00+00:00 https://guardian.security/blog/external-call-attacks/2026-11-04 https://i.ytimg.com/vi/VF1HYD50eus/hqdefault.jpg The 4 External Call Attacks | Web3 Exploits 101 The four external call vulnerabilities in Solidity: reentrancy, denial of service, gas griefing and return values, plus how GMX V2 makes callbacks safe. https://www.youtube.com/embed/VF1HYD50eus 1816 2023-11-19T00:00:00+00:00 https://guardian.security/blog/signature-malleability/2026-11-04 https://i.ytimg.com/vi/V3TJLDHZBFU/hqdefault.jpg Web3 Exploits | Signature Malleability What signature malleability is, why every ECDSA signature on secp256k1 has a twin, how an attacker forges it to double spend, and how to stop it in Solidity. https://www.youtube.com/embed/V3TJLDHZBFU 895 2023-02-27T00:00:00+00:00 https://guardian.security/blog/solidity-rounding-errors/2026-11-04 https://i.ytimg.com/vi/6rmLP-ri-JU/hqdefault.jpg Rounding Errors | Web3 Exploits 101 Why rounding errors in Solidity happen, how truncating division broke an average price and a tick rounding function, and what to check at every division. https://www.youtube.com/embed/6rmLP-ri-JU 1976 2023-10-16T00:00:00+00:00 https://guardian.security/blog/dao-governance-attacks/2026-11-04 https://i.ytimg.com/vi/O4fLWPKQINA/hqdefault.jpg Dao And Governance Attacks | Web3 Exploits 101 Governance attacks push a malicious proposal through a DAO's vote. Learn the common flaws, flash-loaned votes, and how Beanstalk's emergency commit was drained. https://www.youtube.com/embed/O4fLWPKQINA 1847 2023-11-12T00:00:00+00:00 https://guardian.security/blog/metamorphic-contracts/2026-11-04 https://i.ytimg.com/vi/XEe-FMiTDYU/hqdefault.jpg Metamorphic Contracts | Tornado Cash Exploit! A metamorphic contract swaps its code at one address. Learn how the Tornado Cash governance exploit used one, two ways to build one, and what EIP-6780 changed. https://www.youtube.com/embed/XEe-FMiTDYU 1292 2023-06-01T00:00:00+00:00 https://guardian.security/blog/critical-defi-vulnerability-patterns/2026-11-04 https://i.ytimg.com/vi/B8igzag_7jY/hqdefault.jpg 6 Critical Vulnerabilities | Build Your Toolbox Six critical DeFi vulnerabilities from real audits: reward sandwiches, unbounded loops, solvency gaps, gas manipulation, blacklists and price impact games. https://www.youtube.com/embed/B8igzag_7jY 4754 2023-11-30T00:00:00+00:00 https://guardian.security/blog/critical-vulnerabilities-breakdown/2026-11-04 https://i.ytimg.com/vi/N9VtIomWo2s/hqdefault.jpg Do Not Miss These 3 Critical Vulnerabilities | Critical Findings Breakdown Three critical smart contract vulnerabilities from Guardian audits: zero-amount withdrawals, parallel withdrawal state and liquidations that lower health. https://www.youtube.com/embed/N9VtIomWo2s 2230 2024-02-22T00:00:00+00:00 https://guardian.security/blog/audit-findings-explained/2026-11-04 https://i.ytimg.com/vi/ekFN7GtGtBU/hqdefault.jpg Learn From My Findings | 3 Findings Breakdown Six smart contract audit findings from Guardian reports, each with the context, the bug and the heuristic an auditor can reuse to find similar issues. https://www.youtube.com/embed/ekFN7GtGtBU 1835 2023-06-30T00:00:00+00:00 https://guardian.security/blog/solidity-compiler-bugs/2026-11-04 https://i.ytimg.com/vi/ulFDHyuVb1I/hqdefault.jpg Vulnerabilities With The Solidity Compiler! Solidity compiler bugs can make correct-looking code misbehave. See how dirty bytes copied to storage leak through an empty push, and how to check your version. https://www.youtube.com/embed/ulFDHyuVb1I 1275 2023-07-28T00:00:00+00:00 https://guardian.security/blog/evm-explained/2026-11-04 https://i.ytimg.com/vi/Ru3inmu1FuQ/hqdefault.jpg Complete Guide To The EVM | Everything You Need To Know How the EVM works: the stack, memory, calldata and storage, the opcodes that tie them together, and a function call traced opcode by opcode. https://www.youtube.com/embed/Ru3inmu1FuQ 2116 2023-06-15T00:00:00+00:00 https://guardian.security/blog/ethereum-calldata-explained/2026-11-04 https://i.ytimg.com/vi/WkyyT0pmJSw/hqdefault.jpg Guide To Advanced Calldata | Everything You Need To Know Ethereum calldata explained by decoding a real GMX V2 multicall byte by byte: function selectors, dynamic data, heads, tails, offsets and how memory differs. https://www.youtube.com/embed/WkyyT0pmJSw 2493 2023-07-06T00:00:00+00:00 https://guardian.security/blog/yul-memory-explained/2026-11-04 https://i.ytimg.com/vi/9qLUvtL5uKQ/hqdefault.jpg Yul & Memory Intro | Yul Exploit! A guide to Yul memory: how the EVM lays out memory, the free memory pointer, how strings are stored, and a low-level exploit built on a crafted string length. https://www.youtube.com/embed/9qLUvtL5uKQ 2413 2023-05-25T00:00:00+00:00 https://guardian.security/blog/what-is-secp256k1/2026-11-04 https://i.ytimg.com/vi/9ZKY8DoVCkI/hqdefault.jpg Ethereum Cryptography Basics What is secp256k1? A plain guide to the elliptic curve behind Ethereum keys: the equation, group theory, point addition and multiplication, and why keys are secure. https://www.youtube.com/embed/9ZKY8DoVCkI 846 2023-02-24T00:00:00+00:00 https://guardian.security/blog/constant-product-amm/2026-11-04 https://i.ytimg.com/vi/QvyMkRtjLv8/hqdefault.jpg The Ultimate Guide To AMMs How a constant product AMM works, with worked numbers: x * y = k, a swap's price, minting LP tokens, why deeper pools trade better, and impermanent loss. https://www.youtube.com/embed/QvyMkRtjLv8 1505 2023-04-06T00:00:00+00:00 https://guardian.security/blog/uniswap-v3-concentrated-liquidity/2026-11-04 https://i.ytimg.com/vi/Ltph_X60kbo/hqdefault.jpg Uniswap V3 Made Easy Uniswap V3 concentrated liquidity explained: why range-bound liquidity exists, how ticks and sqrtPriceX96 work, real reserves, and how swaps cross ticks. https://www.youtube.com/embed/Ltph_X60kbo 1218 2023-04-14T00:00:00+00:00 https://guardian.security/blog/how-makerdao-and-dai-work/2026-11-04 https://i.ytimg.com/vi/0a7W7s0K7SI/hqdefault.jpg How Does DAI & Maker DAO Work? | DeFi 101 How does DAI work? MakerDAO explained: collateral ratios, vaults, looping, the levers that hold the peg, liquidations by Dutch auction and how bad debt is covered. https://www.youtube.com/embed/0a7W7s0K7SI 2297 2023-11-09T00:00:00+00:00 https://guardian.security/blog/cdp-lending-protocol-explained/2026-11-04 https://i.ytimg.com/vi/zKAgEp9vHms/hqdefault.jpg Abracadabra Money Guide | DeFi 101 What is a CDP in crypto? Learn collateralized debt positions through Abracadabra Money: LTV ratios, cauldrons, DegenBox shares, interest, and liquidations. https://www.youtube.com/embed/zKAgEp9vHms 2233 2023-11-23T00:00:00+00:00 https://guardian.security/blog/gmx-v2-explained/2026-11-04 https://i.ytimg.com/vi/58om-oA1vpI/hqdefault.jpg DeFi Protocol Deep Dives | GMX V2 GMX V2 explained from the code, as of early 2023: markets and backing tokens, two-step keeper execution, deposits, orders, and an auditor's first pass on withdrawals. https://www.youtube.com/embed/58om-oA1vpI 2979 2023-04-30T00:00:00+00:00 https://guardian.security/blog/advanced-web3-security-course/2026-11-04 https://i.ytimg.com/vi/DRZogmD647U/hqdefault.jpg Advanced Web3 Security Course | Part 1 A free web3 security course in two parts and about 23 hours: every chapter with its start time, from smart contract design to fuzzing and formal verification. https://www.youtube.com/embed/DRZogmD647U 2023-10-22T00:00:00+00:00 https://guardian.security/blog/kelpdao-rseth-exploit/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/kelpdao-rseth-exploit/v1/poster.jpg Kelp DAO Hack: How the rsETH Exploit Reached Aave How a forged LayerZero message on Kelp DAO's 1-of-1 DVN route released 116,500 rsETH, why Aave faced bad debt, and what LRT teams and lenders should check. https://d1ryz0te1mu7pf.cloudfront.net/blog/kelpdao-rseth-exploit/v1/video.mp4 104 2026-11-05T05:53:29+00:00 https://guardian.security/blog/drift-exploit-durable-nonce/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/drift-exploit-durable-nonce/v1/poster.jpg The Drift Exploit Explained: Durable Nonces and a 2-of-5 Council How the Drift exploit worked: attackers got two of five Solana council signers to pre-sign durable nonce transactions, then, with no timelock, drained about $285 million. Plus the controls that fix it. https://d1ryz0te1mu7pf.cloudfront.net/blog/drift-exploit-durable-nonce/v1/video.mp4 96 2026-11-05T05:27:33+00:00 https://guardian.security/blog/daml-smart-contract-audit/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/daml-smart-contract-audit/v2/poster.jpg Daml Smart Contract Audit: What Reviewers Check on Canton What a Daml audit checks on Canton: authority tied to caller-supplied parties and contract IDs, privacy leaks in both directions, and risks in package upgrades. https://d1ryz0te1mu7pf.cloudfront.net/blog/daml-smart-contract-audit/v2/video.mp4 106 2026-11-05T16:28:47+00:00 https://guardian.security/blog/vara-reserve-assets-audit-circular/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/vara-reserve-assets-audit-circular/v2/poster.jpg VARA Reserve Assets Audit Circular: The Minimum Scope VARA's October 6, 2026 circular sets the minimum scope for Dubai reserve assets audits: full backing in the same asset, every wallet, control, daily reconciliation and rehypothecation. https://d1ryz0te1mu7pf.cloudfront.net/blog/vara-reserve-assets-audit-circular/v2/video.mp4 104 2026-11-08T18:01:24+00:00 https://guardian.security/blog/nydfs-risk-assessment-guidance-crypto-template/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/nydfs-risk-assessment-guidance-crypto-template/v2/poster.jpg NYDFS Risk Assessment Guidance: A 500.9 Template for Crypto A short explainer on the NYDFS September 10, 2026 risk assessment guidance under Part 500.9, and how crypto firms can bring wallets, keys, contracts and signer devices into the inventory and risk register. https://d1ryz0te1mu7pf.cloudfront.net/blog/nydfs-risk-assessment-guidance-crypto-template/v2/video.mp4 102 2026-11-08T17:24:37+00:00 https://guardian.security/blog/cyber-resilience-act-reporting-obligations-crypto/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/cyber-resilience-act-reporting-obligations-crypto/v1/poster.jpg Cyber Resilience Act Reporting Obligations for Crypto Teams How the EU Cyber Resilience Act's reporting duty applies to wallet, node and SDK makers since September 11, 2026: the triggers, the 24-hour, 72-hour and final reports, scope, and a runbook. https://d1ryz0te1mu7pf.cloudfront.net/blog/cyber-resilience-act-reporting-obligations-crypto/v1/video.mp4 103 2026-11-05T05:26:38+00:00 https://guardian.security/blog/sfc-ai-enabled-cyberattacks-circular/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/sfc-ai-enabled-cyberattacks-circular/v2/poster.jpg SFC June 2026 Cybersecurity Circular on AI-Enabled Attacks, Explained Hong Kong's SFC circular 26EC32 says AI shortens the time from disclosure to exploit. Here is what licensed crypto platforms should change in patching, access, suppliers and incident response. https://d1ryz0te1mu7pf.cloudfront.net/blog/sfc-ai-enabled-cyberattacks-circular/v2/video.mp4 115 2026-11-08T17:30:57+00:00 https://guardian.security/blog/california-dfal-token-listing-certification-1250/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/california-dfal-token-listing-certification-1250/v1/poster.jpg California DFAL Token Listing Certification: 10 CCR 1250 Explained California's DFAL rules require a covered exchange to file a signed certification with the DFPI before listing a token. Here is what it certifies and what the risk assessment should check. https://d1ryz0te1mu7pf.cloudfront.net/blog/california-dfal-token-listing-certification-1250/v1/video.mp4 103 2026-11-05T05:32:43+00:00 https://guardian.security/blog/fca-fg26-6-cryptoasset-operational-resilience-guidance/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-fg26-6-cryptoasset-operational-resilience-guidance/v2/poster.jpg FCA FG26/6 Crypto Operational Resilience Checklist A short guide to the FCA's FG26/6 guidance: the four crypto-specific risks, key controls, impact tolerances, scenario tests and the evidence crypto firms should prepare for SYSC 15A from October 25, 2027. https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-fg26-6-cryptoasset-operational-resilience-guidance/v2/video.mp4 106 2026-11-08T17:04:22+00:00 https://guardian.security/blog/cass-17-4-means-of-access-key-management-checklist/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/cass-17-4-means-of-access-key-management-checklist/v2/poster.jpg FCA Crypto Safeguarding: CASS 17.4 Key Management Checklist How CASS 17.4 in the FCA's PS26/11 applies to crypto keys and shards: what is in scope, key ceremony evidence, the means of access record, recovery testing, dependency risk and key incidents. https://d1ryz0te1mu7pf.cloudfront.net/blog/cass-17-4-means-of-access-key-management-checklist/v2/video.mp4 104 2026-11-08T17:41:01+00:00 https://guardian.security/blog/x402-facilitator-security-checklist/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/x402-facilitator-security-checklist/v1/poster.jpg x402 Facilitator Security Checklist: Stopping Double Settlement and Replay A checklist for x402 facilitator operators: close the gap between verify and settle, dedupe on payer and nonce, report success only on confirmed transfers, and cap gas. https://d1ryz0te1mu7pf.cloudfront.net/blog/x402-facilitator-security-checklist/v1/video.mp4 104 2026-11-05T05:33:42+00:00 https://guardian.security/blog/agentic-payments-security/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/agentic-payments-security/v1/poster.jpg Agentic Payments Security for Banks and Fintechs How banks and fintechs can secure AI agent payments: the main threats, six controls to require before agents pay, stablecoin rail risks, and evidence for DORA and NYDFS. https://d1ryz0te1mu7pf.cloudfront.net/blog/agentic-payments-security/v1/video.mp4 106 2026-11-05T05:34:39+00:00 https://guardian.security/blog/certik-alternatives/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/certik-alternatives/v2/poster.jpg CertiK Alternatives: 10 Smart Contract Audit Firms Compared Guardian ranks ten CertiK alternatives for a smart contract audit and matches each to the need it fits. It also covers how to switch auditors mid-roadmap. https://d1ryz0te1mu7pf.cloudfront.net/blog/certik-alternatives/v2/video.mp4 108 2026-11-08T17:41:04+00:00 https://guardian.security/blog/certik-audit-cost/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/certik-audit-cost/v1/poster.jpg CertiK Audit Cost: What CertiK Charges and What You Get CertiK publishes no prices, but Venus governance records show a $350-an-hour retainer. This video covers what the audit includes, how public rates compare and what to ask before signing. https://d1ryz0te1mu7pf.cloudfront.net/blog/certik-audit-cost/v1/video.mp4 100 2026-11-05T06:03:36+00:00 https://guardian.security/blog/hypernative-vs-hexagate-vs-blockaid/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/hypernative-vs-hexagate-vs-blockaid/v1/poster.jpg Hypernative vs Hexagate vs Blockaid Compared A neutral comparison of Hypernative, Hexagate and Blockaid on detection, automated response, pre-signing checks, pricing signals and who responds when an alert fires. https://d1ryz0te1mu7pf.cloudfront.net/blog/hypernative-vs-hexagate-vs-blockaid/v1/video.mp4 101 2026-11-05T05:06:44+00:00 https://guardian.security/blog/smart-contract-audit-cost-estimator/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-audit-cost-estimator/v2/poster.jpg Smart Contract Audit Cost Estimator: From nSLOC to a Price Range How to estimate a smart contract audit cost from nSLOC, using Guardian's published review lengths, Arbitrum's weekly auditor rates, Sherlock's premiums and real public price points. https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-audit-cost-estimator/v2/video.mp4 92 2026-11-05T16:23:27+00:00 https://guardian.security/blog/best-arbitrum-auditors/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/best-arbitrum-auditors/v3/poster.jpg Best Arbitrum Auditors in 2026 Guardian ranks the Arbitrum auditors with the most public Arbitrum work, explains where Arbitrum differs from Ethereum, and shows how the Arbitrum Security Program subsidizes audits. Guardian ranks itself first. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-arbitrum-auditors/v3/video.mp4 111 2026-11-08T17:09:16+00:00 https://guardian.security/blog/best-perp-dex-auditors/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/best-perp-dex-auditors/v2/poster.jpg Best Perp DEX Auditors in 2026 Guardian ranks the best perp DEX auditors of 2026 on public perpetuals reports and explains what a perps audit must cover, from oracles to keepers. Guardian publishes this ranking and placed itself first. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-perp-dex-auditors/v2/video.mp4 109 2026-11-05T16:26:32+00:00 https://guardian.security/blog/solana-smart-contract-audit/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/solana-smart-contract-audit/v1/poster.jpg Solana Smart Contract Audit: Cost, Timeline and Checks A short guide to Solana smart contract audits: what public records say about cost, how long Guardian's Solana reviews take, and what reviewers check, from account validation to CPIs. https://d1ryz0te1mu7pf.cloudfront.net/blog/solana-smart-contract-audit/v1/video.mp4 105 2026-11-05T04:57:24+00:00 https://guardian.security/blog/audit-contest-vs-private-audit/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/audit-contest-vs-private-audit/v1/poster.jpg Audit Contest vs Private Audit: Cost, Coverage and Timing How private smart contract audits and audit contests differ in coverage, cost and timing, and why high-value code should run both, in order. https://d1ryz0te1mu7pf.cloudfront.net/blog/audit-contest-vs-private-audit/v1/video.mp4 97 2026-11-05T05:52:33+00:00 https://guardian.security/blog/when-do-you-need-a-re-audit/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/when-do-you-need-a-re-audit/v1/poster.jpg When Do You Need a Smart Contract Re-Audit? When does a smart contract need to be audited again? This video covers re-audit triggers, diff audits versus full re-audits, and how to size a review by the value a change can reach. https://d1ryz0te1mu7pf.cloudfront.net/blog/when-do-you-need-a-re-audit/v1/video.mp4 101 2026-11-05T05:07:43+00:00 https://guardian.security/blog/pre-mainnet-security-checklist/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/pre-mainnet-security-checklist/v1/poster.jpg Pre-Mainnet Security Checklist for Smart Contract Teams A pre-mainnet checklist for smart contract teams: audit closure, configuration, roles and keys, monitoring, pause readiness and deployment day steps. https://d1ryz0te1mu7pf.cloudfront.net/blog/pre-mainnet-security-checklist/v1/video.mp4 106 2026-11-05T05:13:35+00:00 https://guardian.security/blog/vciso-for-crypto-companies/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/vciso-for-crypto-companies/v1/poster.jpg vCISO for Crypto Companies: Scope, Deliverables and Cost What a virtual CISO should own at a crypto company, what to expect in the first 90 days, published vendor pricing, and how Guardian Managed Security works alongside one. https://d1ryz0te1mu7pf.cloudfront.net/blog/vciso-for-crypto-companies/v1/video.mp4 103 2026-11-05T05:16:27+00:00 https://guardian.security/blog/crypto-exchange-pentesting/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-pentesting/v2/poster.jpg Crypto Exchange Pentesting: What a Real Assessment Covers What a crypto exchange pentest covers: apps, APIs, cloud and the wallet signing systems behind withdrawals, business logic tests like balance races, and a report that ends with a retest. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-pentesting/v2/video.mp4 101 2026-11-08T17:12:06+00:00 https://guardian.security/blog/privy-vs-turnkey-vs-dynamic/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/privy-vs-turnkey-vs-dynamic/v1/poster.jpg Privy vs Turnkey vs Dynamic: Embedded Wallet Security Compared Privy, Turnkey and Dynamic compared on key isolation, ownership after the Stripe and Fireblocks deals, policy controls and audit transparency, plus how to pick between them. https://d1ryz0te1mu7pf.cloudfront.net/blog/privy-vs-turnkey-vs-dynamic/v1/video.mp4 106 2026-11-05T05:36:22+00:00 https://guardian.security/blog/best-web3-bug-bounty-platforms/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/best-web3-bug-bounty-platforms/v1/poster.jpg Best Web3 Bug Bounty Platforms in 2026, Compared Guardian compares the best web3 bug bounty platforms of 2026 on fees, triage, KYC and payout records, and discloses that it publishes the guide and ranks itself first. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-web3-bug-bounty-platforms/v1/video.mp4 100 2026-11-05T05:25:42+00:00 https://guardian.security/blog/digital-asset-vendor-due-diligence-questionnaire/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/digital-asset-vendor-due-diligence-questionnaire/v1/poster.jpg Crypto Vendor Due Diligence Questionnaire: What to Ask What banks and funds should put in a crypto vendor due diligence questionnaire: governance, key management, smart contracts, offchain security, incidents and exit, plus the evidence to ask for. https://d1ryz0te1mu7pf.cloudfront.net/blog/digital-asset-vendor-due-diligence-questionnaire/v1/video.mp4 100 2026-11-05T05:37:17+00:00 https://guardian.security/blog/mica-compliance-checklist-security/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/mica-compliance-checklist-security/v1/poster.jpg MiCA Compliance Checklist: Security Controls for CASPs A security-only MiCA compliance checklist for CASPs: the ICT, custody, testing, incident and continuity controls required under MiCA and DORA, and the evidence to keep for each. https://d1ryz0te1mu7pf.cloudfront.net/blog/mica-compliance-checklist-security/v1/video.mp4 107 2026-11-05T05:24:48+00:00 https://guardian.security/blog/cost-to-tokenize-an-asset/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/cost-to-tokenize-an-asset/v2/poster.jpg How Much Does It Cost to Tokenize an Asset? What it costs to tokenize an asset, from legal and platform fees to audits and monitoring. The figures come from published prices, SEC filings and public audit records. https://d1ryz0te1mu7pf.cloudfront.net/blog/cost-to-tokenize-an-asset/v2/video.mp4 101 2026-11-08T17:12:05+00:00 https://guardian.security/blog/crypto-exchange-insider-threat-program/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-insider-threat-program/v1/poster.jpg Insider Threat Programs for Crypto Exchanges: A Template How a crypto exchange should build an insider threat program, drawn from the Coinbase and Kraken support-staff cases: access tiers, dual control, monitoring, offboarding and a written template. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-insider-threat-program/v1/video.mp4 99 2026-11-05T05:14:34+00:00 https://guardian.security/blog/best-ai-tools-smart-contract-auditing/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/best-ai-tools-smart-contract-auditing/v2/poster.jpg Best AI Tools for Smart Contract Auditing in 2026 A short guide to AI smart contract auditing tools: autonomous auditors, coding-agent skills and static analysis. It covers what EVMbench shows, how to combine the tools, and how Guardian, which builds Helix, uses AI. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-ai-tools-smart-contract-auditing/v2/video.mp4 109 2026-11-08T17:09:12+00:00 https://guardian.security/blog/audited-vs-unaudited-exploits/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/audited-vs-unaudited-exploits/v1/poster.jpg Were Hacked Protocols Audited? Audited vs Unaudited Exploits Guardian counted 512 DeFi protocol hacks from 2024 to 2026 and checked the 20 largest by hand to see which were audited, and whether the exploited path was inside the audit scope. https://d1ryz0te1mu7pf.cloudfront.net/blog/audited-vs-unaudited-exploits/v1/video.mp4 99 2026-11-05T05:58:10+00:00 https://guardian.security/blog/cost-of-a-crypto-hack/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/cost-of-a-crypto-hack/v1/poster.jpg Cost of a Crypto Hack: The Bill Beyond the Stolen Funds Guardian measures what a crypto hack costs beyond the stolen funds: token falls, deposit outflows, lenders' bad debt, bounties and remediation, based on 2024 to 2026 hacks. https://d1ryz0te1mu7pf.cloudfront.net/blog/cost-of-a-crypto-hack/v1/video.mp4 107 2026-11-05T05:59:14+00:00 https://guardian.security/blog/deployed-vs-audited-code-match-rate/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/deployed-vs-audited-code-match-rate/v2/poster.jpg Deployed vs Audited Code: What Bytecode Verification Found Guardian compared 25 deployed contracts from five public reports with their final reviewed commits. 15 matched, and nine of the 10 differences trace to a single report. https://d1ryz0te1mu7pf.cloudfront.net/blog/deployed-vs-audited-code-match-rate/v2/video.mp4 94 2026-11-08T17:18:29+00:00 https://guardian.security/blog/safe-multisig-statistics/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/safe-multisig-statistics/v2/poster.jpg Safe Multisig Statistics: Thresholds and Signers of 39 DeFi Admin Safes Guardian read the 39 Safes that hold admin powers at 22 large Ethereum DeFi protocols. The video covers their thresholds, signer counts, shared and nested signers, modules and guards. https://d1ryz0te1mu7pf.cloudfront.net/blog/safe-multisig-statistics/v2/video.mp4 102 2026-11-08T17:35:43+00:00 https://guardian.security/blog/mean-time-to-remediate-smart-contract-vulnerabilities/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/mean-time-to-remediate-smart-contract-vulnerabilities/v3/poster.jpg Audit Remediation Timelines: Data From 93 Guardian Reports Guardian measured smart contract audit remediation timelines across 93 of its public reports. Fix reviews began a median 11 days after the main review ended, and fixes were verified a median 14 days after it. https://d1ryz0te1mu7pf.cloudfront.net/blog/mean-time-to-remediate-smart-contract-vulnerabilities/v3/video.mp4 90 2026-11-06T22:27:04+00:00 https://guardian.security/blog/access-control-vulnerabilities-smart-contracts/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/access-control-vulnerabilities-smart-contracts/v2/poster.jpg Access Control Vulnerabilities in Smart Contracts: The Data Why access control leads smart contract hack counts but not dollar losses, five bug patterns from 53 Guardian audit findings, and how to test permissions. https://d1ryz0te1mu7pf.cloudfront.net/blog/access-control-vulnerabilities-smart-contracts/v2/video.mp4 100 2026-11-05T16:21:25+00:00 https://guardian.security/blog/crypto-hack-statistics/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-hack-statistics/v1/poster.jpg Crypto Hack Statistics 2026: Losses, Vectors and Trends Crypto hack statistics for 2026: $8.78B stolen in 328 incidents to November 2, why Binance dominates the total, where losses come from, and how the major reports compare. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-hack-statistics/v1/video.mp4 110 2026-11-05T05:57:12+00:00 https://guardian.security/blog/what-is-onchain-monitoring/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-onchain-monitoring/v2/poster.jpg What Is Onchain Monitoring? A Guide for Security Teams What onchain monitoring is, the signals it watches, why audited protocols still need it, how to build or buy it, and how Guardian's Managed Security watches every block. https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-onchain-monitoring/v2/video.mp4 105 2026-11-08T17:55:00+00:00 https://guardian.security/blog/web3-penetration-testing-explained/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/web3-penetration-testing-explained/v2/poster.jpg Web3 Penetration Testing Explained: Scope and Methodology What a web3 pentest covers beyond smart contracts, how the PTES phases shape the method, how it differs from a contract audit, and how Guardian runs offchain pentests. https://d1ryz0te1mu7pf.cloudfront.net/blog/web3-penetration-testing-explained/v2/video.mp4 102 2026-11-08T17:47:01+00:00 https://guardian.security/blog/what-is-a-smart-contract-audit/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-a-smart-contract-audit/v3/poster.jpg What Is a Smart Contract Audit? Process and Deliverables A short explainer on what a smart contract audit is, what auditors check, the six deliverables to expect, what an audit leaves out, and how Guardian runs its audits. https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-a-smart-contract-audit/v3/video.mp4 102 2026-11-08T17:55:01+00:00 https://guardian.security/blog/stablecoin-security/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-security/v1/poster.jpg Stablecoin Security: The Complete Risk Guide for Issuers A short guide to stablecoin security for issuers. It covers the five risk layers, onchain mint caps, separating roles, freeze testing and monitoring, plus what Guardian found across more than 50 USDT0 engagements. https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-security/v1/video.mp4 112 2026-11-05T05:46:04+00:00 https://guardian.security/blog/defi-incident-response-plan/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/defi-incident-response-plan/v1/poster.jpg How to Write a Web3 Incident Response Plan for DeFi A short guide to a web3 incident response plan for DeFi protocols. It covers roles, pause authority, signer availability, SEAL 911, severity levels, onchain containment and drills. https://d1ryz0te1mu7pf.cloudfront.net/blog/defi-incident-response-plan/v1/video.mp4 104 2026-11-05T05:30:48+00:00 https://guardian.security/blog/smart-contract-upgrade-change-management/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-upgrade-change-management/v1/poster.jpg Smart Contract Change Management for Live Protocols How live protocols can ship smart contract upgrades safely: a six-step pipeline from change record to monitoring, SEAL timelock guidance, sign-off roles, and how Guardian's Vanguard reviews updates. https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-upgrade-change-management/v1/video.mp4 99 2026-11-05T05:15:29+00:00 https://guardian.security/blog/perp-dex-security/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/perp-dex-security/v1/poster.jpg Perp DEX Security: The Attack Surface of Perpetual Exchanges How perp DEXs get attacked through oracles, margin and funding math, liquidations, keepers and admin keys, with public incidents and findings from Guardian's perps audits. https://d1ryz0te1mu7pf.cloudfront.net/blog/perp-dex-security/v1/video.mp4 108 2026-11-05T05:40:22+00:00 https://guardian.security/blog/lending-protocol-audit-checklist/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/lending-protocol-audit-checklist/v2/poster.jpg Lending Protocol Audit Checklist: 40 Money Market Checks A lending protocol audit checklist covering collateral, oracles, debt accounting, liquidations, access control and integrations, mapped to real exploits and Guardian findings. https://d1ryz0te1mu7pf.cloudfront.net/blog/lending-protocol-audit-checklist/v2/video.mp4 103 2026-11-06T22:26:47+00:00 https://guardian.security/blog/layerzero-oft-security-checklist/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/layerzero-oft-security-checklist/v1/poster.jpg LayerZero OFT Security Checklist: OFTs and OFT Adapters A code-level checklist for LayerZero OFTs and OFT adapters: contract type, shared decimals, peers and DVNs, enforced gas, rate limits, supply backing and upgrades. https://d1ryz0te1mu7pf.cloudfront.net/blog/layerzero-oft-security-checklist/v1/video.mp4 108 2026-11-05T05:31:45+00:00 https://guardian.security/blog/business-logic-vulnerabilities/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/business-logic-vulnerabilities/v3/poster.jpg Business Logic Vulnerabilities in Smart Contracts Business logic bugs let smart contract code run as written while breaking the protocol's own rules. This video covers real Guardian Criticals, why scanners and AI tools miss these bugs, and how Vanguard finds them. https://d1ryz0te1mu7pf.cloudfront.net/blog/business-logic-vulnerabilities/v3/video.mp4 101 2026-11-06T22:24:56+00:00 https://guardian.security/blog/institutional-security-requirements-onchain-teams/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/institutional-security-requirements-onchain-teams/v1/poster.jpg Institutional Security Requirements for Onchain Teams What banks and funds ask onchain partners for before they integrate, custody or allocate: SOC 2 and CCSS, audits tied to deployed code, key controls, pentests, and the rules such as DORA that drive these requests. https://d1ryz0te1mu7pf.cloudfront.net/blog/institutional-security-requirements-onchain-teams/v1/video.mp4 101 2026-11-05T05:55:20+00:00 https://guardian.security/blog/layerzero-vs-chainlink-ccip/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/layerzero-vs-chainlink-ccip/v3/poster.jpg LayerZero vs Chainlink CCIP: Security for Token Issuers Guardian compares LayerZero and Chainlink CCIP for token issuers: who verifies messages, what the issuer controls, rate limits, and which model fits. https://d1ryz0te1mu7pf.cloudfront.net/blog/layerzero-vs-chainlink-ccip/v3/video.mp4 104 2026-11-06T22:23:51+00:00 https://guardian.security/blog/genius-act-implementation-timeline/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/genius-act-implementation-timeline/v2/poster.jpg GENIUS Act Implementation Timeline: Rules and Deadlines The GENIUS Act takes effect January 18, 2027. This video covers which agency rules are final or still proposed, the waiver window for existing issuers, and what issuers and platforms should have ready. https://d1ryz0te1mu7pf.cloudfront.net/blog/genius-act-implementation-timeline/v2/video.mp4 113 2026-11-08T17:26:13+00:00 https://guardian.security/blog/occ-genius-act-final-rule/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/occ-genius-act-final-rule/v1/poster.jpg OCC GENIUS Act Final Rule: What Changed for IT and Keys The OCC's final GENIUS Act rule takes effect January 18, 2027. This video covers what changed from the proposal in 12 CFR 15.13 and the IT, key, vendor and testing controls issuers need to build. https://d1ryz0te1mu7pf.cloudfront.net/blog/occ-genius-act-final-rule/v1/video.mp4 105 2026-11-05T20:35:41+00:00 https://guardian.security/blog/bank-of-england-systemic-stablecoin-policy-2026/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/bank-of-england-systemic-stablecoin-policy-2026/v1/poster.jpg Bank of England Stablecoin Policy: What Changed in June 2026 A short explainer on the Bank of England's June 2026 systemic stablecoin policy: the £40bn issuance guardrail, 70/30 backing, 24-hour redemption, public ledgers, multi-issuance and the draft Code's status. https://d1ryz0te1mu7pf.cloudfront.net/blog/bank-of-england-systemic-stablecoin-policy-2026/v1/video.mp4 98 2026-11-05T20:29:20+00:00 https://guardian.security/blog/sec-user-interface-statement-wallets-front-ends/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-user-interface-statement-wallets-front-ends/v2/poster.jpg SEC user interface statement: 12 conditions for wallets and front ends A short explainer on the SEC staff's April 2026 user interface statement. It covers the 12 conditions for wallets and front ends to operate without broker registration, and what each one means for routing, fee and frontend code. https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-user-interface-statement-wallets-front-ends/v2/video.mp4 101 2026-11-08T17:29:14+00:00 https://guardian.security/blog/regulation-crypto-assets-sec-explained/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/regulation-crypto-assets-sec-explained/v2/poster.jpg SEC Regulation Crypto Assets: Security, Code and Governance Explained A short explainer on the SEC's proposed Regulation Crypto Assets: its two exemptions, and what Rule 103(b) would require on security, source code, mint and burn, and smart contract permissions. https://d1ryz0te1mu7pf.cloudfront.net/blog/regulation-crypto-assets-sec-explained/v2/video.mp4 105 2026-11-08T17:34:10+00:00 https://guardian.security/blog/fca-ps26-2-operational-incident-third-party-reporting/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-ps26-2-operational-incident-third-party-reporting/v1/poster.jpg FCA PS26/2 Explained: Operational Incident and Third Party Reporting A short explainer on the FCA's PS26/2 and the PRA's PS7/26, which take effect on March 18, 2027. It covers who reports operational incidents, the three thresholds, the 24 hour expectation and material third party reporting. https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-ps26-2-operational-incident-third-party-reporting/v1/video.mp4 106 2026-11-05T20:28:25+00:00 https://guardian.security/blog/hong-kong-virtual-asset-custodian-licence/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/hong-kong-virtual-asset-custodian-licence/v2/poster.jpg Hong Kong Virtual Asset Custodian Licence: Who Needs One A short guide to Hong Kong's proposed virtual asset custodian licence: who is in scope, how MPC providers are treated, the SFC custody standards, capital rules and pre-application. https://d1ryz0te1mu7pf.cloudfront.net/blog/hong-kong-virtual-asset-custodian-licence/v2/video.mp4 100 2026-11-08T17:26:10+00:00 https://guardian.security/blog/digital-asset-security-banks/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/digital-asset-security-banks/v1/poster.jpg Digital Asset Security for Banks: How It Differs From IT How digital asset security differs from traditional bank cybersecurity: final transactions, keys as the perimeter and a public attack surface, plus a control map for bank CISOs. https://d1ryz0te1mu7pf.cloudfront.net/blog/digital-asset-security-banks/v1/video.mp4 107 2026-11-05T20:45:23+00:00 https://guardian.security/blog/multisig-best-practices/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/multisig-best-practices/v1/poster.jpg Multisig Best Practices: The Institutional Signer Policy A signer policy for Safe multisigs at institutions covering thresholds, signer devices, calldata checks, timelocks and monitoring, mapped to the Bybit, WazirX and Drift losses. https://d1ryz0te1mu7pf.cloudfront.net/blog/multisig-best-practices/v1/video.mp4 102 2026-11-05T20:36:37+00:00 https://guardian.security/blog/smart-contract-security/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-security/v1/poster.jpg Smart Contract Security: Seven Layers Beyond One Audit Smart contract security in seven layers, from secure design and invariant fuzzing to audits, deployment checks and monitoring, and why one audit is rarely enough. https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-security/v1/video.mp4 104 2026-11-05T20:20:38+00:00 https://guardian.security/blog/defi-security/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/defi-security/v1/poster.jpg DeFi Security: Risks and Controls by Protocol Type DeFi security by protocol type: what breaks in lending, perps, AMMs, vaults, liquid staking, restaking and bridges, a public incident for each, and the controls that answer it. https://d1ryz0te1mu7pf.cloudfront.net/blog/defi-security/v1/video.mp4 106 2026-11-05T20:24:49+00:00 https://guardian.security/blog/what-is-offchain-security/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-offchain-security/v1/poster.jpg What Is Offchain Security? The Attack Surface Audits Miss A short explainer that defines offchain security in crypto, maps the attack surface around smart contracts, and shows how teams test and mature it. https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-offchain-security/v1/video.mp4 105 2026-11-05T20:38:41+00:00 https://guardian.security/blog/crypto-custody/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-custody/v1/poster.jpg Crypto Custody: How It Works and How to Choose a Custodian A security-led guide to institutional crypto custody: the custody models, HSM, MPC and multisig, the key lifecycle, how the signing path gets attacked, and how to score a custodian on evidence. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-custody/v1/video.mp4 107 2026-11-05T20:46:21+00:00 https://guardian.security/blog/how-to-set-up-a-web3-bug-bounty/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-set-up-a-web3-bug-bounty/v1/poster.jpg How to Set Up a Web3 Bug Bounty Program How to set up a web3 bug bounty program: scope, severity and rewards, platform choice, triage and SEAL Safe Harbor, plus the steps Vanguard handles for you. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-set-up-a-web3-bug-bounty/v1/video.mp4 103 2026-11-05T20:53:55+00:00 https://guardian.security/blog/how-to-choose-a-smart-contract-auditor/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-choose-a-smart-contract-auditor/v2/poster.jpg How to Choose a Smart Contract Auditor: 15 Questions to Ask A short guide to choosing a smart contract auditor: the questions to ask, the evidence to request, the red flags to walk away from, and a 12 point scorecard for comparing audit firms. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-choose-a-smart-contract-auditor/v2/video.mp4 94 2026-11-08T17:27:37+00:00 https://guardian.security/blog/smart-contract-vulnerability-scanner/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-vulnerability-scanner/v2/poster.jpg Smart Contract Vulnerability Scanners: What Free Tools Miss Can a free smart contract vulnerability scanner replace an audit? This video covers what Slither, Aderyn and similar tools catch, and what peer-reviewed studies and Guardian's 343 Critical findings show they miss. https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-vulnerability-scanner/v2/video.mp4 108 2026-11-08T17:51:48+00:00 https://guardian.security/blog/when-to-launch-a-bug-bounty/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/when-to-launch-a-bug-bounty/v1/poster.jpg When to Launch a Bug Bounty: Before or After Your Audit When to launch a smart contract bug bounty: after the audit and fix review. The launch sequence, what to fix before going live, and how to size rewards as deposits grow. https://d1ryz0te1mu7pf.cloudfront.net/blog/when-to-launch-a-bug-bounty/v1/video.mp4 96 2026-11-05T20:51:45+00:00 https://guardian.security/blog/browser-extension-security-crypto-wallets/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/browser-extension-security-crypto-wallets/v2/poster.jpg Browser Extension Pentest Guide for Crypto Wallets How to pentest a crypto wallet browser extension: manifest, content scripts, messaging, key storage, signing UI and the publish pipeline behind the Trust Wallet incident. https://d1ryz0te1mu7pf.cloudfront.net/blog/browser-extension-security-crypto-wallets/v2/video.mp4 104 2026-11-08T17:39:19+00:00 https://guardian.security/blog/private-key-management-digital-assets/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/private-key-management-digital-assets/v1/poster.jpg Private Key Management for Digital Asset Platforms How exchanges, custodians and protocols should manage private keys: hot, warm and cold tiers, HSM vs KMS vs MPC vs multisig, signing policies, key ceremonies and recovery. https://d1ryz0te1mu7pf.cloudfront.net/blog/private-key-management-digital-assets/v1/video.mp4 103 2026-11-05T20:37:33+00:00 https://guardian.security/blog/most-secure-domain-registrar/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/most-secure-domain-registrar/v3/poster.jpg Most Secure Domain Registrars for Crypto Projects Which domain registrar is most secure for a DeFi frontend? A comparison of registry lock, hardware-key 2FA, transfer locks and support verification, based on real frontend hijacks. https://d1ryz0te1mu7pf.cloudfront.net/blog/most-secure-domain-registrar/v3/video.mp4 102 2026-11-08T17:23:03+00:00 https://guardian.security/blog/crypto-prime-broker-due-diligence/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-prime-broker-due-diligence/v2/poster.jpg Crypto Prime Broker Due Diligence: A Checklist for Funds A due diligence checklist for funds using a crypto prime broker. It covers custody and segregation, rehypothecation, margin terms, key controls, proof of reserves and what happens if the broker defaults. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-prime-broker-due-diligence/v2/video.mp4 106 2026-11-08T17:13:52+00:00 https://guardian.security/blog/crypto-exchange-incident-response-plan/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-incident-response-plan/v1/poster.jpg Crypto Exchange Incident Response Plan: The First Hour A first hour incident response runbook for crypto exchanges: declare, stop outflows, request freezes and notify partners, with lessons from Bybit, Coinbase and Binance. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-incident-response-plan/v1/video.mp4 107 2026-11-05T20:34:46+00:00 https://guardian.security/blog/crypto-exchange-bug-bounty-programs/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-bug-bounty-programs/v1/poster.jpg Crypto Exchange Bug Bounty Programs: A 2026 Benchmark A benchmark of bug bounty programs at CoinGecko's top 10 crypto exchanges, covering max payouts, scope, safe harbor and disclosure rules, read November 2026. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-bug-bounty-programs/v1/video.mp4 103 2026-11-05T20:52:45+00:00 https://guardian.security/blog/legacy-smart-contract-risk/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/legacy-smart-contract-risk/v1/poster.jpg Legacy Smart Contract Risk: How to Retire Old Deployments Deprecated smart contracts are still attack surface. This video covers five public incidents and how to inventory, drain, revoke, migrate and monitor old deployments. https://d1ryz0te1mu7pf.cloudfront.net/blog/legacy-smart-contract-risk/v1/video.mp4 100 2026-11-05T20:23:48+00:00 https://guardian.security/blog/dao-governance-security-checklist/2026-11-05 https://d1ryz0te1mu7pf.cloudfront.net/blog/dao-governance-security-checklist/v1/poster.jpg DAO Governance Security Checklist A short guide to DAO governance security: snapshot voting and quorum, proposal review, timelocks, emergency roles, signer keys and upgrade paths, with real cases from Compound, Drift, Arbitrum and Audius. https://d1ryz0te1mu7pf.cloudfront.net/blog/dao-governance-security-checklist/v1/video.mp4 103 2026-11-05T20:48:03+00:00 https://guardian.security/blog/binance-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/binance-hack-explained/v1/poster.jpg The Binance Hack Explained: What Happened and What to Learn The Binance hack explained: how about $6.36 billion left Binance wallets on October 29, 2026, how about $2.7 billion was frozen within hours, and what exchanges can learn. https://d1ryz0te1mu7pf.cloudfront.net/blog/binance-hack-explained/v1/video.mp4 99 2026-11-05T22:29:42+00:00 https://guardian.security/blog/vault-curator-risk/ https://d1ryz0te1mu7pf.cloudfront.net/blog/vault-curator-risk/v2/poster.jpg Vault Curator Risk: What Stream Finance Taught DeFi What a DeFi vault curator controls on Morpho, Euler and Kamino, how Stream Finance's xUSD losses reached curated vaults, and a scorecard for judging a curator. https://d1ryz0te1mu7pf.cloudfront.net/blog/vault-curator-risk/v2/video.mp4 108 2026-11-08T17:46:59+00:00 https://guardian.security/blog/cass-17-fca-cryptoasset-safeguarding-rules/ https://d1ryz0te1mu7pf.cloudfront.net/blog/cass-17-fca-cryptoasset-safeguarding-rules/v2/poster.jpg CASS 17 Rules: FCA Safeguarding for Client Cryptoassets What the FCA's CASS 17 rules in PS26/11 require of UK firms that control client cryptoassets: trusts and exceptions, daily reconciliations, key controls, third-party custodians and the CASS audit. https://d1ryz0te1mu7pf.cloudfront.net/blog/cass-17-fca-cryptoasset-safeguarding-rules/v2/video.mp4 111 2026-11-08T17:41:01+00:00 https://guardian.security/blog/fca-ps26-10-final-stablecoin-rules/ https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-ps26-10-final-stablecoin-rules/v1/poster.jpg FCA PS26/10 Final Stablecoin Rules: What Changed for Issuers A short explainer on FCA PS26/10, the UK's final stablecoin issuance rules. It covers backing every minted coin, daily reconciliation, T+1 redemption and what changed from CP25/14. https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-ps26-10-final-stablecoin-rules/v1/video.mp4 92 2026-11-05T21:58:28+00:00 https://guardian.security/blog/fca-marc-onchain-monitoring-large-platforms/ https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-marc-onchain-monitoring-large-platforms/v2/poster.jpg Crypto Market Monitoring: FCA Onchain Rules for UK Exchanges A short explainer on the FCA's MARC rules in PS26/9. It covers which UK crypto platforms must monitor wallets onchain, what to detect, the price dislocation duty, and the audit and records the rules require. https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-marc-onchain-monitoring-large-platforms/v2/video.mp4 99 2026-11-08T17:04:22+00:00 https://guardian.security/blog/mas-stablecoin-consultation-paper-ps-act/ https://d1ryz0te1mu7pf.cloudfront.net/blog/mas-stablecoin-consultation-paper-ps-act/v1/poster.jpg MAS stablecoin consultation paper P015-2026: what issuers must build An explainer on MAS consultation paper P015-2026: the proposed stablecoin issuance license, reserves and par redemption, quarterly stress tests, wind-down plans, and the duty to trace, freeze and burn coins. https://d1ryz0te1mu7pf.cloudfront.net/blog/mas-stablecoin-consultation-paper-ps-act/v1/video.mp4 99 2026-11-05T21:47:49+00:00 https://guardian.security/blog/clarity-act-status-senate-cloture-vote/ https://d1ryz0te1mu7pf.cloudfront.net/blog/clarity-act-status-senate-cloture-vote/v1/poster.jpg CLARITY Act status after the September 2026 cloture vote The CLARITY Act stalled in the Senate after a 49 to 50 cloture vote on September 15, 2026. Here is what the Senate substitute tests for control, and the dated record crypto teams should build now. https://d1ryz0te1mu7pf.cloudfront.net/blog/clarity-act-status-senate-cloture-vote/v1/video.mp4 102 2026-11-05T21:44:17+00:00 https://guardian.security/blog/sec-liquid-staking-guidance-staking-receipt-tokens/ https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-liquid-staking-guidance-staking-receipt-tokens/v1/poster.jpg SEC Liquid Staking Guidance: Contract Conditions for LSTs A short explainer on SEC Release 33-11412 and liquid staking. It covers the four conditions for a staking receipt token, where each one lives in code, and the admin powers that can break them. https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-liquid-staking-guidance-staking-receipt-tokens/v1/video.mp4 102 2026-11-05T21:45:13+00:00 https://guardian.security/blog/fsa-crypto-exchange-cybersecurity-policy/ https://d1ryz0te1mu7pf.cloudfront.net/blog/fsa-crypto-exchange-cybersecurity-policy/v1/poster.jpg Japan Crypto Exchange Cybersecurity: The FSA's 2026 Policy Japan's FSA says cold wallets alone cannot keep crypto exchanges safe. This video covers its April 2026 policy, including CSSA, guideline revisions, Delta Wall and a 2026 TLPT pilot. https://d1ryz0te1mu7pf.cloudfront.net/blog/fsa-crypto-exchange-cybersecurity-policy/v1/video.mp4 106 2026-11-05T22:17:54+00:00 https://guardian.security/blog/sfc-passkey-requirement-phishing-resistant-login/ https://d1ryz0te1mu7pf.cloudfront.net/blog/sfc-passkey-requirement-phishing-resistant-login/v1/poster.jpg SFC Passkey Requirement: What Must Be Live by July 8, 2027 SFC circular 26EC35 says OTP is not phishing resistant. This video covers what Hong Kong crypto platforms and internet brokers must change by July 8, 2027, what applies now, and how to test it. https://d1ryz0te1mu7pf.cloudfront.net/blog/sfc-passkey-requirement-phishing-resistant-login/v1/video.mp4 105 2026-11-05T21:49:39+00:00 https://guardian.security/blog/korea-real-time-ledger-wallet-reconciliation/ https://d1ryz0te1mu7pf.cloudfront.net/blog/korea-real-time-ledger-wallet-reconciliation/v1/poster.jpg Korea's Real-Time Reconciliation Rule for Crypto Exchanges Korea's FSC says crypto exchanges will be required to reconcile ledger to wallet every five minutes, with a kill switch on large mismatches. This video covers what changed after the Bithumb payout error and how to build the check. https://d1ryz0te1mu7pf.cloudfront.net/blog/korea-real-time-ledger-wallet-reconciliation/v1/video.mp4 99 2026-11-05T22:14:52+00:00 https://guardian.security/blog/digital-assets-framework-act-2026-deadlines/ https://d1ryz0te1mu7pf.cloudfront.net/blog/digital-assets-framework-act-2026-deadlines/v2/poster.jpg Digital Assets Framework Act 2026: AFS License Deadlines Explained Australia's Digital Assets Framework Act commences April 8, 2027. This video covers the AFS license deadline, ASIC's draft CP 392 standards, market maker duties and a readiness plan. https://d1ryz0te1mu7pf.cloudfront.net/blog/digital-assets-framework-act-2026-deadlines/v2/video.mp4 103 2026-11-08T17:18:32+00:00 https://guardian.security/blog/bcb-resolution-520-proof-of-reserves/ https://d1ryz0te1mu7pf.cloudfront.net/blog/bcb-resolution-520-proof-of-reserves/v1/poster.jpg BCB Resolution 520 Proof of Reserves: What VASPs Must Build How BCB Resolution 520 and IN BCB 713 set monthly proof of reserves and daily custody reporting for Brazilian VASPs, and what a verifiable proof needs. https://d1ryz0te1mu7pf.cloudfront.net/blog/bcb-resolution-520-proof-of-reserves/v1/video.mp4 110 2026-11-05T22:11:19+00:00 https://guardian.security/blog/fatf-stablecoins-unhosted-wallets-report/ https://d1ryz0te1mu7pf.cloudfront.net/blog/fatf-stablecoins-unhosted-wallets-report/v1/poster.jpg FATF Stablecoins and Unhosted Wallets: Freeze and Screening A short explainer on the FATF's March 2026 report on stablecoins and unhosted wallets: the freeze, burn and allow-list controls it encourages for issuers, and how VASPs should screen peer-to-peer flows. https://d1ryz0te1mu7pf.cloudfront.net/blog/fatf-stablecoins-unhosted-wallets-report/v1/video.mp4 106 2026-11-05T22:06:56+00:00 https://guardian.security/blog/web3-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/web3-security/v1/poster.jpg Web3 Security: Best Practices for Onchain Teams A short guide to web3 security for onchain teams: protect five layers, from smart contracts and admin keys to offchain systems, people and monitoring, and add controls stage by stage. https://d1ryz0te1mu7pf.cloudfront.net/blog/web3-security/v1/video.mp4 101 2026-11-05T21:32:57+00:00 https://guardian.security/blog/rwa-tokenization/ https://d1ryz0te1mu7pf.cloudfront.net/blog/rwa-tokenization/v1/poster.jpg RWA Tokenization: How It Works and Where It Breaks How RWA tokenization works, from legal wrapper to bridge, where admin keys, compliance logic, oracles and bridges break, and the controls institutions should require. https://d1ryz0te1mu7pf.cloudfront.net/blog/rwa-tokenization/v1/video.mp4 103 2026-11-05T21:40:19+00:00 https://guardian.security/blog/crypto-exchange-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-security/v1/poster.jpg Crypto Exchange Security: How Exchanges Protect Funds How crypto exchanges protect customer funds with cold wallets and withdrawal controls, how the biggest hacks got in, and how to judge whether an exchange is safe. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-security/v1/video.mp4 108 2026-11-05T22:27:43+00:00 https://guardian.security/blog/cross-chain-bridge-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/cross-chain-bridge-security/v3/poster.jpg Cross-chain bridge security: how bridges get hacked How cross-chain bridges get hacked, from Ronin and Wormhole to Nomad, Multichain and Kelp DAO, and the verifier, configuration, rate limit and upgrade controls that limit the damage. https://d1ryz0te1mu7pf.cloudfront.net/blog/cross-chain-bridge-security/v3/video.mp4 100 2026-11-08T17:12:04+00:00 https://guardian.security/blog/opsec-crypto-founders-teams/ https://d1ryz0te1mu7pf.cloudfront.net/blog/opsec-crypto-founders-teams/v1/poster.jpg Crypto OpSec for Founders and Teams: A Practical Baseline A practical crypto OpSec baseline for founders and early teams: managed devices, hardware keys, fake recruiter defenses, physical safety and a 30-day hardening plan. https://d1ryz0te1mu7pf.cloudfront.net/blog/opsec-crypto-founders-teams/v1/video.mp4 102 2026-11-05T21:55:02+00:00 https://guardian.security/blog/crypto-insurance-institutions/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-insurance-institutions/v1/poster.jpg Crypto Insurance for Institutions: Coverage and Exclusions What crypto insurance covers for institutions: crime, specie, liability and smart contract cover, what they generally exclude, why capacity is limited and what underwriters ask. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-insurance-institutions/v1/video.mp4 100 2026-11-05T22:10:09+00:00 https://guardian.security/blog/mica-and-dora/ https://d1ryz0te1mu7pf.cloudfront.net/blog/mica-and-dora/v2/poster.jpg MiCA and DORA: How They Work Together for Crypto Firms How MiCA and DORA work together for EU crypto-asset service providers and token issuers: which duty comes from which text, how incident reporting and vendor rules overlap, and what to build first. https://d1ryz0te1mu7pf.cloudfront.net/blog/mica-and-dora/v2/video.mp4 111 2026-11-08T17:23:03+00:00 https://guardian.security/blog/crypto-security-standards-compared/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-security-standards-compared/v2/poster.jpg Blockchain Security Standards Compared: CCSS, SOC 2, ISO 27001, NIST A comparison of six blockchain security standards: SOC 2, ISO 27001, NIST CSF 2.0, CCSS, BSSC and SEAL. It covers who attests, what each one produces and what banks ask crypto companies for. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-security-standards-compared/v2/video.mp4 110 2026-11-08T17:15:35+00:00 https://guardian.security/blog/smart-contract-audit-vs-pentest/ https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-audit-vs-pentest/v2/poster.jpg Smart Contract Audit vs Pentest: What Each Covers A smart contract audit reviews contract code at a fixed commit. A pentest attacks the apps, APIs, cloud, signers and keepers around it. This video covers what each one tests, where they overlap and how to scope both. https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-audit-vs-pentest/v2/video.mp4 105 2026-11-08T17:49:24+00:00 https://guardian.security/blog/smart-contract-audit-scoping/ https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-audit-scoping/v2/poster.jpg How Smart Contract Audit Scoping Works How auditors set smart contract audit scope before a quote: the frozen commit, files and nSLOC, complexity, dependencies and exclusions, and how Guardian sizes work in auditor-days. https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-audit-scoping/v2/video.mp4 103 2026-11-08T17:49:23+00:00 https://guardian.security/blog/formal-verification-vs-fuzzing-vs-audit/ https://d1ryz0te1mu7pf.cloudfront.net/blog/formal-verification-vs-fuzzing-vs-audit/v2/poster.jpg Formal Verification vs Fuzzing vs Audit: Which Do You Need? Fuzzing vs formal verification vs a manual audit: what each method finds and misses, what it costs, and how Guardian combines manual review and fuzzing in Vanguard. https://d1ryz0te1mu7pf.cloudfront.net/blog/formal-verification-vs-fuzzing-vs-audit/v2/video.mp4 113 2026-11-08T17:05:39+00:00 https://guardian.security/blog/custom-evm-implementation-audit/ https://d1ryz0te1mu7pf.cloudfront.net/blog/custom-evm-implementation-audit/v1/poster.jpg Custom EVM Audit: What to Review in a Forked or Modified EVM What a custom EVM audit covers when a chain forks geth or revm: gas metering, opcode and state changes, custom precompiles, and differential testing against reference clients. https://d1ryz0te1mu7pf.cloudfront.net/blog/custom-evm-implementation-audit/v1/video.mp4 109 2026-11-05T22:16:53+00:00 https://guardian.security/blog/mica-license-cost/ https://d1ryz0te1mu7pf.cloudfront.net/blog/mica-license-cost/v2/poster.jpg MiCA License Cost: Fees, Capital and the Security Budget What a MiCA license costs: regulator fees in Cyprus, Malta, the Netherlands and Sweden, capital by CASP class, and the DORA security work behind the authorization file. https://d1ryz0te1mu7pf.cloudfront.net/blog/mica-license-cost/v2/video.mp4 98 2026-11-08T17:21:28+00:00 https://guardian.security/blog/best-hardware-wallets-multisig-signers/ https://d1ryz0te1mu7pf.cloudfront.net/blog/best-hardware-wallets-multisig-signers/v1/poster.jpg Best Hardware Wallets for Multisig Signers in 2026 Which hardware wallet should Safe multisig signers use? Guardian compares Ledger, Trezor, Keystone and GridPlus on clear signing, key protection and device diversity. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-hardware-wallets-multisig-signers/v1/video.mp4 103 2026-11-05T22:21:39+00:00 https://guardian.security/blog/best-ethereum-multisig-wallets/ https://d1ryz0te1mu7pf.cloudfront.net/blog/best-ethereum-multisig-wallets/v2/poster.jpg Best Multisig Wallets for Ethereum in 2026 Safe is the default multisig on Ethereum. This video compares Safe{Wallet}, Ledger Enterprise Multisig, Eternal Safe, Den and Avocado on how signers check what they sign after the Bybit hack. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-ethereum-multisig-wallets/v2/video.mp4 99 2026-11-08T17:10:32+00:00 https://guardian.security/blog/best-mpc-wallet-providers/ https://d1ryz0te1mu7pf.cloudfront.net/blog/best-mpc-wallet-providers/v1/poster.jpg Best MPC Wallet Providers in 2026: A Security Comparison A security comparison of institutional MPC wallet providers, including Fireblocks, Fordefi, BitGo, Dfns, Utila and Cobo, on key shares, policy engines and published audits. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-mpc-wallet-providers/v1/video.mp4 105 2026-11-05T22:28:44+00:00 https://guardian.security/blog/bitgo-vs-anchorage-digital/ https://d1ryz0te1mu7pf.cloudfront.net/blog/bitgo-vs-anchorage-digital/v1/poster.jpg BitGo vs Anchorage Digital: Chartered Custodians Compared BitGo and Anchorage Digital both run OCC-chartered national trust banks. This video compares their charters, key models, insurance and regulatory records using public sources, then lists the questions to ask either custodian. https://d1ryz0te1mu7pf.cloudfront.net/blog/bitgo-vs-anchorage-digital/v1/video.mp4 101 2026-11-06T00:58:21+00:00 https://guardian.security/blog/cobalt-io-alternatives/ https://d1ryz0te1mu7pf.cloudfront.net/blog/cobalt-io-alternatives/v2/poster.jpg Cobalt.io Alternatives: 9 Pentest Firms for Crypto Teams Nine Cobalt.io alternatives for crypto teams, ranked by Guardian, which publishes the guide: crypto-native testers, application security boutiques and PTaaS platforms like NetSPI, HackerOne and Bugcrowd. https://d1ryz0te1mu7pf.cloudfront.net/blog/cobalt-io-alternatives/v2/video.mp4 102 2026-11-08T17:10:38+00:00 https://guardian.security/blog/tokenization-platform-due-diligence-checklist/ https://d1ryz0te1mu7pf.cloudfront.net/blog/tokenization-platform-due-diligence-checklist/v1/poster.jpg Tokenization Platform Due Diligence: A Security Checklist The security questions to ask a tokenization platform vendor: who can mint and upgrade, how keys are held, which record governs, oracle and bridge limits, and audits matched to deployed code. https://d1ryz0te1mu7pf.cloudfront.net/blog/tokenization-platform-due-diligence-checklist/v1/video.mp4 105 2026-11-05T21:39:20+00:00 https://guardian.security/blog/stablecoin-due-diligence-checklist/ https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-due-diligence-checklist/v3/poster.jpg Stablecoin Due Diligence Checklist for Institutions A short guide for banks and fintechs on what to check before integrating a stablecoin: the issuer's license, reserves, redemption, contract controls, chains and bridges, and operations. https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-due-diligence-checklist/v3/video.mp4 105 2026-11-08T18:04:39+00:00 https://guardian.security/blog/neobank-crypto-integration/ https://d1ryz0te1mu7pf.cloudfront.net/blog/neobank-crypto-integration/v1/poster.jpg Neobank Crypto Integration: A Security Plan for Fintechs How a neobank can add crypto securely: pick a licensed partner, crypto-as-a-service or your own stack, then secure custody, withdrawals and fraud controls, and test before launch. https://d1ryz0te1mu7pf.cloudfront.net/blog/neobank-crypto-integration/v1/video.mp4 100 2026-11-05T22:20:42+00:00 https://guardian.security/blog/time-to-exploit-crypto/ https://d1ryz0te1mu7pf.cloudfront.net/blog/time-to-exploit-crypto/v1/poster.jpg Time to Exploit in Crypto: Data From 17 Attacks Guardian timed 17 attacks on 11 disclosed crypto flaws. When a flaw was public first, attacks came within a week or months later. CISA KEV does not cover the crypto stack. https://d1ryz0te1mu7pf.cloudfront.net/blog/time-to-exploit-crypto/v1/video.mp4 102 2026-11-05T22:37:03+00:00 https://guardian.security/blog/tvl-upgradeable-contracts-no-timelock/ https://d1ryz0te1mu7pf.cloudfront.net/blog/tvl-upgradeable-contracts-no-timelock/v2/poster.jpg TVL Behind Upgradeable Contracts Without a Timelock Guardian puts a dollar figure on instant upgradeability: $20.6B of $95.0B in Ethereum TVL at 25 large DeFi protocols sits where a multisig can change core code with no delay. https://d1ryz0te1mu7pf.cloudfront.net/blog/tvl-upgradeable-contracts-no-timelock/v2/video.mp4 99 2026-11-08T17:42:38+00:00 https://guardian.security/blog/nextjs-versions-crypto-frontends/ https://d1ryz0te1mu7pf.cloudfront.net/blog/nextjs-versions-crypto-frontends/v1/poster.jpg Next.js Versions on Crypto Frontends: Known Critical Flaws Guardian scanned 249 top crypto sites by TVL. 62 of the 104 that exposed a Next.js version were in range of a critical advisory. This video covers what that means and how to check your own app. https://d1ryz0te1mu7pf.cloudfront.net/blog/nextjs-versions-crypto-frontends/v1/video.mp4 107 2026-11-05T22:07:52+00:00 https://guardian.security/blog/best-smart-contract-language-for-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/best-smart-contract-language-for-security/v2/poster.jpg Best Smart Contract Language for Security: What Audits Show Which smart contract language is most secure? Guardian's 320 public audits show each language removes some bug classes, while logic errors lead Critical and High findings in Solidity and Rust. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-smart-contract-language-for-security/v2/video.mp4 109 2026-11-08T17:10:36+00:00 https://guardian.security/blog/secure-foundry-deployment-scripts/ https://d1ryz0te1mu7pf.cloudfront.net/blog/secure-foundry-deployment-scripts/v2/poster.jpg Secure Foundry Deployment Scripts: Keys, Proxies and Checks How to run forge script broadcast deployments without exposing your key: encrypted keystores, hardware wallets, fork dry runs, atomic proxy setup and onchain checks after the run. https://d1ryz0te1mu7pf.cloudfront.net/blog/secure-foundry-deployment-scripts/v2/video.mp4 100 2026-11-08T17:30:52+00:00 https://guardian.security/blog/dapp-frontend-supply-chain-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/dapp-frontend-supply-chain-security/v2/poster.jpg dApp Frontend Supply Chain Security: npm Attack Mitigation How compromised npm packages reach a dApp's build machines and users' browsers, and the lockfile, CI, CSP and response controls that stop them. https://d1ryz0te1mu7pf.cloudfront.net/blog/dapp-frontend-supply-chain-security/v2/video.mp4 98 2026-11-08T17:18:33+00:00 https://guardian.security/blog/social-engineering-multisig-signers/ https://d1ryz0te1mu7pf.cloudfront.net/blog/social-engineering-multisig-signers/v1/poster.jpg Social Engineering Attacks on Crypto Multisig Signers How attackers socially engineered signers at Drift, Radiant, Ronin and Bybit, and how to harden signing devices, verify out of band, alert on queued transactions and escalate. https://d1ryz0te1mu7pf.cloudfront.net/blog/social-engineering-multisig-signers/v1/video.mp4 103 2026-11-05T21:55:59+00:00 https://guardian.security/blog/exchange-withdrawal-security-controls/ https://d1ryz0te1mu7pf.cloudfront.net/blog/exchange-withdrawal-security-controls/v1/poster.jpg Crypto Exchange Withdrawal Security: From Request to Signing A walk through crypto exchange withdrawal security, from allowlists, limits and delays to maker-checker approvals, isolated signing and ledger reconciliation. https://d1ryz0te1mu7pf.cloudfront.net/blog/exchange-withdrawal-security-controls/v1/video.mp4 107 2026-11-05T22:30:54+00:00 https://guardian.security/blog/assumed-breach-pentest/ https://d1ryz0te1mu7pf.cloudfront.net/blog/assumed-breach-pentest/v1/poster.jpg Assumed Breach Pentest: Starting From a Compromised Laptop An assumed breach pentest starts from a compromised laptop, credential or signer device. How it compares to external pentests and red teams, and how crypto firms scope one. https://d1ryz0te1mu7pf.cloudfront.net/blog/assumed-breach-pentest/v1/video.mp4 101 2026-11-05T21:58:52+00:00 https://guardian.security/blog/exposure-management-vs-attack-surface-management/ https://d1ryz0te1mu7pf.cloudfront.net/blog/exposure-management-vs-attack-surface-management/v2/poster.jpg Exposure Management vs Attack Surface Management for Crypto How attack surface management finds what you expose, and how exposure management, run as Gartner's CTEM cycle, ranks, validates and fixes what is actually exploitable for digital asset teams. https://d1ryz0te1mu7pf.cloudfront.net/blog/exposure-management-vs-attack-surface-management/v2/video.mp4 108 2026-11-08T17:03:16+00:00 https://guardian.security/blog/strong-customer-authentication-emt-wallets/ https://d1ryz0te1mu7pf.cloudfront.net/blog/strong-customer-authentication-emt-wallets/v1/poster.jpg PSD2 Strong Customer Authentication for Crypto EMT Wallets How the EBA's PSD2 and MiCA opinion applies strong customer authentication to custodial e-money token wallets after 2 March 2026, and how to test login and withdrawal flows. https://d1ryz0te1mu7pf.cloudfront.net/blog/strong-customer-authentication-emt-wallets/v1/video.mp4 105 2026-11-05T22:32:52+00:00 https://guardian.security/blog/pentest-rules-of-engagement-template/ https://d1ryz0te1mu7pf.cloudfront.net/blog/pentest-rules-of-engagement-template/v1/poster.jpg Pentest Rules of Engagement Template for Crypto and Fintech What a pentest rules of engagement document should include for a crypto platform: scope, third-party permissions, wallet and mainnet clauses, stop conditions and escalation. https://d1ryz0te1mu7pf.cloudfront.net/blog/pentest-rules-of-engagement-template/v1/video.mp4 94 2026-11-05T22:09:09+00:00 https://guardian.security/blog/third-party-risk-management-digital-assets/ https://d1ryz0te1mu7pf.cloudfront.net/blog/third-party-risk-management-digital-assets/v1/poster.jpg Third-Party Risk Management for Crypto: A Bank Playbook How banks can apply the 2023 interagency third-party guidance, DORA and NYDFS 500.11 to custodians, chains, oracles and protocols, from tiering and diligence through contracts, monitoring and exit. https://d1ryz0te1mu7pf.cloudfront.net/blog/third-party-risk-management-digital-assets/v1/video.mp4 101 2026-11-06T03:03:18+00:00 https://guardian.security/blog/crypto-exchange-security-rating-methodology/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-security-rating-methodology/v2/poster.jpg How to Rate a Crypto Exchange's Security: A Methodology A method for institutions to rate crypto exchange security: seven weighted categories, scored on evidence rather than claims, capped by three gates and rescored when the facts change. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-security-rating-methodology/v2/video.mp4 102 2026-11-08T17:13:49+00:00 https://guardian.security/blog/perp-dex-audit-checklist/ https://d1ryz0te1mu7pf.cloudfront.net/blog/perp-dex-audit-checklist/v1/poster.jpg Perp DEX Audit Checklist: 40 Checks for Perpetual Exchanges What should a perpetual DEX audit check? This video walks through the checklist for oracles, funding, liquidations, ADL, execution, keepers and LP accounting. Every check comes from public Guardian findings. https://d1ryz0te1mu7pf.cloudfront.net/blog/perp-dex-audit-checklist/v1/video.mp4 100 2026-11-06T02:57:44+00:00 https://guardian.security/blog/human-plus-ai-audit-model/ https://d1ryz0te1mu7pf.cloudfront.net/blog/human-plus-ai-audit-model/v1/poster.jpg What Is a Hybrid AI and Human Smart Contract Audit? A hybrid smart contract audit uses independent human teams and AI tools, and a human verifies every finding. This video covers what each side catches and misses, what the research shows, and how Guardian's Vanguard uses the model. https://d1ryz0te1mu7pf.cloudfront.net/blog/human-plus-ai-audit-model/v1/video.mp4 101 2026-11-06T02:34:51+00:00 https://guardian.security/blog/web-application-pentesting-crypto-fintech/ https://d1ryz0te1mu7pf.cloudfront.net/blog/web-application-pentesting-crypto-fintech/v1/poster.jpg Web Application Pentesting for Crypto and Fintech What a web application pentest covers for crypto and fintech teams: the login, withdrawal, KYC, admin, signing and API flows that generic tests miss, mapped to OWASP WSTG and ASVS 5.0. https://d1ryz0te1mu7pf.cloudfront.net/blog/web-application-pentesting-crypto-fintech/v1/video.mp4 103 2026-11-06T02:47:06+00:00 https://guardian.security/blog/bug-bounty-vs-smart-contract-audit/ https://d1ryz0te1mu7pf.cloudfront.net/blog/bug-bounty-vs-smart-contract-audit/v1/poster.jpg Bug Bounty vs Smart Contract Audit: What Each Catches Smart contract audit vs bug bounty: how timing, incentives, coverage and cost differ, why teams with both still get hit, and how to run them in order. https://d1ryz0te1mu7pf.cloudfront.net/blog/bug-bounty-vs-smart-contract-audit/v1/video.mp4 98 2026-11-06T02:26:24+00:00 https://guardian.security/blog/layerzero-vs-wormhole/ https://d1ryz0te1mu7pf.cloudfront.net/blog/layerzero-vs-wormhole/v2/poster.jpg LayerZero vs Wormhole: Verification Models Compared LayerZero lets each app pick its own DVNs for every route. Wormhole uses one shared set of 13 of 19 Guardians. This video covers who can change the security, one major incident on each, and how OFT and NTT differ for token issuers. https://d1ryz0te1mu7pf.cloudfront.net/blog/layerzero-vs-wormhole/v2/video.mp4 91 2026-11-06T22:24:39+00:00 https://guardian.security/blog/layerzero-dvn-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/layerzero-dvn-security/v2/poster.jpg LayerZero DVN Configuration: A Security Guide After Kelp What failed in Kelp DAO's LayerZero route, how required and optional DVNs, confirmations and defaults work, and a configuration checklist for OApp and OFT teams. https://d1ryz0te1mu7pf.cloudfront.net/blog/layerzero-dvn-security/v2/video.mp4 103 2026-11-06T22:26:07+00:00 https://guardian.security/blog/stablecoin-risk-assessment/ https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-risk-assessment/v3/poster.jpg Stablecoin Risk Assessment Template for Treasuries How a treasury can score a stablecoin out of 100 across seven weighted categories, apply knockouts, and set holding limits by score band. https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-risk-assessment/v3/video.mp4 100 2026-11-08T17:51:44+00:00 https://guardian.security/blog/dora-for-crypto-companies/ https://d1ryz0te1mu7pf.cloudfront.net/blog/dora-for-crypto-companies/v2/poster.jpg DORA for Crypto Companies: What the Regulation Requires DORA has applied to MiCA-authorized CASPs and asset-referenced token issuers since January 17, 2025. This video covers its five pillars and how they apply to wallets, signers, nodes and smart contracts. https://d1ryz0te1mu7pf.cloudfront.net/blog/dora-for-crypto-companies/v2/video.mp4 109 2026-11-08T17:02:06+00:00 https://guardian.security/blog/state-of-smart-contract-audits-2026/ https://d1ryz0te1mu7pf.cloudfront.net/blog/state-of-smart-contract-audits-2026/v1/poster.jpg Smart Contract Audit Statistics 2026: 320 Guardian Reports What 320 public Guardian audit reports and 9,617 findings show about severity, top finding categories, sectors and fix rates. Logic errors lead. https://d1ryz0te1mu7pf.cloudfront.net/blog/state-of-smart-contract-audits-2026/v1/video.mp4 96 2026-11-06T02:33:04+00:00 https://guardian.security/blog/vulnerability-remediation-rate-by-severity/ https://d1ryz0te1mu7pf.cloudfront.net/blog/vulnerability-remediation-rate-by-severity/v1/poster.jpg Vulnerability Remediation Rate by Severity: What Gets Fixed How many smart contract audit findings get fixed? Across 9,617 findings in Guardian's 320 public audit reports, 51.7% were resolved, and fix rates rise with severity. https://d1ryz0te1mu7pf.cloudfront.net/blog/vulnerability-remediation-rate-by-severity/v1/video.mp4 98 2026-11-06T02:34:02+00:00 https://guardian.security/blog/why-crypto-hack-reports-disagree/ https://d1ryz0te1mu7pf.cloudfront.net/blog/why-crypto-hack-reports-disagree/v2/poster.jpg Crypto Hack Statistics Compared: Why the Reports Disagree Why Chainalysis, TRM Labs, CertiK, Immunefi, PeckShield and DefiLlama publish 2025 crypto hack totals from $2.72B to $4.04B, and how to cite them correctly. https://d1ryz0te1mu7pf.cloudfront.net/blog/why-crypto-hack-reports-disagree/v2/video.mp4 108 2026-11-08T18:13:36+00:00 https://guardian.security/blog/biggest-crypto-hacks-of-all-time/ https://d1ryz0te1mu7pf.cloudfront.net/blog/biggest-crypto-hacks-of-all-time/v1/poster.jpg The Biggest Crypto Hacks of All Time, Ranked The 20 biggest crypto hacks of all time, ranked from DefiLlama data. Led by Binance, LuBian and Bybit, with the root causes, attribution and patterns behind them. https://d1ryz0te1mu7pf.cloudfront.net/blog/biggest-crypto-hacks-of-all-time/v1/video.mp4 96 2026-11-06T02:42:58+00:00 https://guardian.security/blog/how-long-does-a-smart-contract-audit-take/ https://d1ryz0te1mu7pf.cloudfront.net/blog/how-long-does-a-smart-contract-audit-take/v1/poster.jpg How Long Does a Smart Contract Audit Take? Smart contract audit timelines by codebase size, plus the full cycle from booking and code freeze to fixes and fix review, so you can plan your launch. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-long-does-a-smart-contract-audit-take/v1/video.mp4 93 2026-11-06T02:36:54+00:00 https://guardian.security/blog/how-to-read-a-smart-contract-audit-report/ https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-read-a-smart-contract-audit-report/v1/poster.jpg How to Read a Smart Contract Audit Report A five-minute guide to reading a smart contract audit report: scope and commit, severity definitions, finding statuses, fix reviews, disclaimers and red flags. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-read-a-smart-contract-audit-report/v1/video.mp4 95 2026-11-06T02:33:54+00:00 https://guardian.security/blog/how-many-audits-does-a-protocol-need/ https://d1ryz0te1mu7pf.cloudfront.net/blog/how-many-audits-does-a-protocol-need/v1/poster.jpg How Many Audits Does a Protocol Need? A Risk-Based Answer No standard sets how many audits a protocol needs. This video sizes the answer by code novelty, value at stake and upgrade rate, from one audit to layered reviews, contests and bounties. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-many-audits-does-a-protocol-need/v1/video.mp4 89 2026-11-06T02:36:35+00:00 https://guardian.security/blog/smart-contract-audit-rfp-template/ https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-audit-rfp-template/v1/poster.jpg Smart Contract Audit RFP Template for Institutions What a smart contract audit RFP should include: scope, timeline, deliverables, team and methodology, conflicts and disclosure, and published evaluation criteria. https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-audit-rfp-template/v1/video.mp4 102 2026-11-06T02:37:30+00:00 https://guardian.security/blog/token-launch-security-checklist/ https://d1ryz0te1mu7pf.cloudfront.net/blog/token-launch-security-checklist/v1/poster.jpg Token Launch Security Checklist: Before Your TGE A TGE checklist from smart contract auditors, covering token, vesting and claim contracts, mint keys, liquidity setup, frontend and DNS, and monitoring from day one. https://d1ryz0te1mu7pf.cloudfront.net/blog/token-launch-security-checklist/v1/video.mp4 101 2026-11-06T02:56:51+00:00 https://guardian.security/blog/how-long-does-a-pentest-take/ https://d1ryz0te1mu7pf.cloudfront.net/blog/how-long-does-a-pentest-take/v1/poster.jpg How Long Does a Pentest Take? Timelines by Test Type How long a penetration test takes from kickoff to report: lead time, testing days by test type, reporting and retest windows, based on published vendor timelines and TIBER-EU. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-long-does-a-pentest-take/v1/video.mp4 82 2026-11-06T02:44:50+00:00 https://guardian.security/blog/ai-pentesting-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/ai-pentesting-explained/v1/poster.jpg AI Pentesting: What Agents Find and What Needs a Human What XBOW, DARPA's AI Cyber Challenge, Big Sleep and Aardvark show about AI pentesting, where human testers still lead, and how Guardian uses both. https://d1ryz0te1mu7pf.cloudfront.net/blog/ai-pentesting-explained/v1/video.mp4 97 2026-11-06T02:47:08+00:00 https://guardian.security/blog/web3-vulnerability-disclosure-policy-template/ https://d1ryz0te1mu7pf.cloudfront.net/blog/web3-vulnerability-disclosure-policy-template/v1/poster.jpg Vulnerability Disclosure Policy Template for Web3 Protocols A web3 vulnerability disclosure policy template adapted from CISA. It covers scope by contract address, a security.txt contact, safe harbor, response times, exclusions, rewards and disclosure timing. https://d1ryz0te1mu7pf.cloudfront.net/blog/web3-vulnerability-disclosure-policy-template/v1/video.mp4 98 2026-11-06T02:27:20+00:00 https://guardian.security/blog/flash-loan-attacks-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/flash-loan-attacks-explained/v1/poster.jpg Flash Loan Attacks Explained, With Real Examples How flash loan attacks work, five real exploits from bZx to Euler and Bunni, the bugs flash loans amplify, and the controls that stop them. https://d1ryz0te1mu7pf.cloudfront.net/blog/flash-loan-attacks-explained/v1/video.mp4 98 2026-11-06T03:02:31+00:00 https://guardian.security/blog/owasp-smart-contract-top-10/ https://d1ryz0te1mu7pf.cloudfront.net/blog/owasp-smart-contract-top-10/v1/poster.jpg OWASP Smart Contract Top 10 for 2026, With Real Exploits The OWASP Smart Contract Top 10 for 2026, explained: the ten ranked risks, how 2025 losses compare, real exploits and Guardian audit findings, and what the list leaves out. https://d1ryz0te1mu7pf.cloudfront.net/blog/owasp-smart-contract-top-10/v1/video.mp4 99 2026-11-06T03:02:23+00:00 https://guardian.security/blog/multisig-vs-mpc-wallet/ https://d1ryz0te1mu7pf.cloudfront.net/blog/multisig-vs-mpc-wallet/v1/poster.jpg Multisig vs MPC Wallets: Security Tradeoffs for Institutions How multisig and MPC wallets compare on transparency, chains, fees and recovery, what BitForge, Bybit and Radiant showed, and when institutions should choose each. https://d1ryz0te1mu7pf.cloudfront.net/blog/multisig-vs-mpc-wallet/v1/video.mp4 101 2026-11-06T03:09:57+00:00 https://guardian.security/blog/hot-warm-cold-wallets/ https://d1ryz0te1mu7pf.cloudfront.net/blog/hot-warm-cold-wallets/v2/poster.jpg Hot, Warm and Cold Wallets: How Institutions Tier Storage How exchanges and custodians split client assets across hot, warm and cold wallets, what regulators in Hong Kong, Japan, Singapore and Dubai require, and the controls each tier needs. https://d1ryz0te1mu7pf.cloudfront.net/blog/hot-warm-cold-wallets/v2/video.mp4 96 2026-11-08T17:27:37+00:00 https://guardian.security/blog/omnibus-vs-segregated-crypto-wallets/ https://d1ryz0te1mu7pf.cloudfront.net/blog/omnibus-vs-segregated-crypto-wallets/v1/poster.jpg Omnibus vs Segregated Wallets: How Exchanges Hold Crypto How omnibus and segregated crypto wallets differ, the security and insolvency tradeoffs of each, what MiCA, CASS 17, NYDFS and VARA require, and what Celsius and FTX showed. https://d1ryz0te1mu7pf.cloudfront.net/blog/omnibus-vs-segregated-crypto-wallets/v1/video.mp4 103 2026-11-06T03:10:42+00:00 https://guardian.security/blog/how-to-verify-proof-of-reserves/ https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-verify-proof-of-reserves/v2/poster.jpg How to Verify an Exchange's Proof of Reserves Yourself A step-by-step walkthrough for checking your balance in an exchange's proof of reserve Merkle tree, verifying the reserve wallets, and knowing what the proof misses. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-verify-proof-of-reserves/v2/video.mp4 89 2026-11-08T17:27:35+00:00 https://guardian.security/blog/crypto-protocol-investment-due-diligence/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-protocol-investment-due-diligence/v2/poster.jpg Crypto Due Diligence Checklist: Security Before You Invest A security due diligence checklist for funds: match deployed code to audits, map admin keys and timelocks, and check dependencies, offchain managers, team OpSec and incidents. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-protocol-investment-due-diligence/v2/video.mp4 104 2026-11-08T17:15:31+00:00 https://guardian.security/blog/soc-2-for-crypto-companies/ https://d1ryz0te1mu7pf.cloudfront.net/blog/soc-2-for-crypto-companies/v1/poster.jpg SOC 2 for Crypto Companies: What It Covers and Misses What a SOC 2 report tests for crypto custodians and exchanges, Type 1 vs Type 2, and the onchain gaps in contracts, keys, signing and monitoring that audits and pentests fill. https://d1ryz0te1mu7pf.cloudfront.net/blog/soc-2-for-crypto-companies/v1/video.mp4 103 2026-11-06T03:06:03+00:00 https://guardian.security/blog/is-aave-safe/ https://d1ryz0te1mu7pf.cloudfront.net/blog/is-aave-safe/v2/poster.jpg Is Aave Safe? Security, Bad Debt and the Safety Module A neutral explainer on Aave's security controls, its bad debt events from CRV to the April 2026 rsETH exploit, the Umbrella backstop, and how lenders can monitor their exposure. https://d1ryz0te1mu7pf.cloudfront.net/blog/is-aave-safe/v2/video.mp4 111 2026-11-08T17:29:14+00:00 https://guardian.security/blog/eip-7702-vs-erc-4337/ https://d1ryz0te1mu7pf.cloudfront.net/blog/eip-7702-vs-erc-4337/v2/poster.jpg EIP-7702 vs ERC-4337: Which Account Abstraction Is Safer? A security comparison of EIP-7702 and ERC-4337 for wallet and app developers. It covers key and recovery risk, delegation phishing, broken contract assumptions, EntryPoint risk and when to use both. https://d1ryz0te1mu7pf.cloudfront.net/blog/eip-7702-vs-erc-4337/v2/video.mp4 116 2026-11-08T17:49:26+00:00 https://guardian.security/blog/rollup-stages-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/rollup-stages-explained/v2/poster.jpg L2BEAT Stages Explained: What Rollup Stage 0, 1 and 2 Mean What L2BEAT, now ETHBEAT, rollup Stages 0, 1 and 2 require, where Base, Arbitrum and other major rollups stand, and how institutions and deployers should use stages in diligence. https://d1ryz0te1mu7pf.cloudfront.net/blog/rollup-stages-explained/v2/video.mp4 98 2026-11-08T17:35:39+00:00 https://guardian.security/blog/liquid-staking-risks/ https://d1ryz0te1mu7pf.cloudfront.net/blog/liquid-staking-risks/v2/poster.jpg Liquid Staking Risks Explained Liquid staking tokens like stETH and JitoSOL carry contract, slashing, depeg, withdrawal, concentration and admin key risk. This video covers the main ones and how to monitor your exposure. https://d1ryz0te1mu7pf.cloudfront.net/blog/liquid-staking-risks/v2/video.mp4 96 2026-11-08T17:21:30+00:00 https://guardian.security/blog/address-poisoning-attacks/ https://d1ryz0te1mu7pf.cloudfront.net/blog/address-poisoning-attacks/v1/poster.jpg Address Poisoning Attacks: How Treasuries Lose Millions How address poisoning plants lookalike addresses in a wallet's history, the $68M and $50M losses, and the allowlist and address book controls treasury teams use to stop it. https://d1ryz0te1mu7pf.cloudfront.net/blog/address-poisoning-attacks/v1/video.mp4 96 2026-11-06T02:29:14+00:00 https://guardian.security/blog/permit2-phishing/ https://d1ryz0te1mu7pf.cloudfront.net/blog/permit2-phishing/v1/poster.jpg Permit2 Phishing: How One Signature Drains a Wallet How Permit and Permit2 phishing turns one offchain signature into a token allowance for a drainer. Covers which fields to read, the controls to use before signing and how to revoke after a bad signature. https://d1ryz0te1mu7pf.cloudfront.net/blog/permit2-phishing/v1/video.mp4 95 2026-11-06T02:30:06+00:00 https://guardian.security/blog/fake-job-interview-malware-crypto-developers/ https://d1ryz0te1mu7pf.cloudfront.net/blog/fake-job-interview-malware-crypto-developers/v1/poster.jpg North Korea Hiring Scams: Fake Interviews and Coding Tests How fake crypto job interviews get developers to run coding tests that install BeaverTail and InvisibleFerret malware, the warning signs to watch for, and what to do if you ran the code. https://d1ryz0te1mu7pf.cloudfront.net/blog/fake-job-interview-malware-crypto-developers/v1/video.mp4 95 2026-11-06T02:48:02+00:00 https://guardian.security/blog/spot-north-korean-it-workers/ https://d1ryz0te1mu7pf.cloudfront.net/blog/spot-north-korean-it-workers/v1/poster.jpg How to Spot North Korean IT Workers in Crypto Hiring How to spot DPRK IT workers in crypto hiring. This video covers red flags in applications, interviews and payroll, and verification steps drawn from FBI, DOJ, Microsoft, SEAL and Kraken guidance. https://d1ryz0te1mu7pf.cloudfront.net/blog/spot-north-korean-it-workers/v1/video.mp4 98 2026-11-06T02:49:09+00:00 https://guardian.security/blog/fake-zoom-meeting-attack-crypto/ https://d1ryz0te1mu7pf.cloudfront.net/blog/fake-zoom-meeting-attack-crypto/v1/poster.jpg Fake Zoom Meeting Scams Targeting Crypto Executives How attackers use fake Zoom pages, bogus updates and remote control requests to steal keys from crypto executives, plus the settings and steps that stop them. https://d1ryz0te1mu7pf.cloudfront.net/blog/fake-zoom-meeting-attack-crypto/v1/video.mp4 97 2026-11-06T02:50:03+00:00 https://guardian.security/blog/what-is-a-wrench-attack/ https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-a-wrench-attack/v1/poster.jpg What Is a Wrench Attack? Physical Coercion Risk in Crypto A wrench attack is physical coercion of a crypto holder to force a transfer or reveal keys. Learn why attacks are rising and which custody and duress controls limit losses. https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-a-wrench-attack/v1/video.mp4 96 2026-11-06T02:59:43+00:00 https://guardian.security/blog/can-stolen-crypto-be-traced/ https://d1ryz0te1mu7pf.cloudfront.net/blog/can-stolen-crypto-be-traced/v1/poster.jpg Can Stolen Crypto Be Traced? How Onchain Tracing Works Stolen crypto can usually be traced, because every blockchain transfer is public. This video covers how tracing works, where trails go cold, and how freezes and seizures turn a trace into a recovery. https://d1ryz0te1mu7pf.cloudfront.net/blog/can-stolen-crypto-be-traced/v1/video.mp4 103 2026-11-06T02:59:34+00:00 https://guardian.security/blog/crypto-wallet-drained-what-to-do/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-wallet-drained-what-to-do/v1/poster.jpg My Crypto Wallet Got Drained: What to Do in the First Hour A calm first-hour checklist for drained crypto wallets: stop further losses, move what is left, record evidence, request freezes, report the theft and avoid recovery scams. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-wallet-drained-what-to-do/v1/video.mp4 95 2026-11-06T02:30:59+00:00 https://guardian.security/blog/crypto-tabletop-exercise-scenarios/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-tabletop-exercise-scenarios/v2/poster.jpg Crypto Tabletop Exercise Scenarios: 12 Incident Drills How to run a crypto tabletop exercise, and twelve incident drills from signer compromise to a regulator's clock, each with the inject and what good looks like. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-tabletop-exercise-scenarios/v2/video.mp4 106 2026-11-08T17:15:35+00:00 https://guardian.security/blog/bybit-hack-explained-frontend/ https://d1ryz0te1mu7pf.cloudfront.net/blog/bybit-hack-explained-frontend/v1/poster.jpg Bybit Hack Explained: How a Tampered Frontend Stole .5B How the Bybit hack happened: a compromised Safe{Wallet} developer laptop, tampered JavaScript in AWS S3, and a signing screen that hid a theft the FBI put at about .5B. https://d1ryz0te1mu7pf.cloudfront.net/blog/bybit-hack-explained-frontend/v1/video.mp4 90 2026-11-06T02:40:06+00:00 https://guardian.security/blog/what-is-blind-signing/ https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-blind-signing/v1/poster.jpg What Is Blind Signing? The Risk Behind Bybit and Radiant Blind signing means approving a crypto transaction your wallet can't show. This video covers why it led to the Bybit, Radiant and WazirX losses, how clear signing and EIP-712 help, and a policy that removes it. https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-blind-signing/v1/video.mp4 108 2026-11-06T02:41:05+00:00 https://guardian.security/blog/verify-safe-transaction-before-signing/ https://d1ryz0te1mu7pf.cloudfront.net/blog/verify-safe-transaction-before-signing/v1/poster.jpg How to Verify a Safe Transaction Before Signing: 5 Steps Five checks for verifying a Safe multisig transaction before you sign: compute the hashes, decode the calldata, check every field, simulate, then match the hashes on your hardware wallet. https://d1ryz0te1mu7pf.cloudfront.net/blog/verify-safe-transaction-before-signing/v1/video.mp4 104 2026-11-06T02:43:38+00:00 https://guardian.security/blog/dfsa-crypto-token-suitability-assessment/ https://d1ryz0te1mu7pf.cloudfront.net/blog/dfsa-crypto-token-suitability-assessment/v1/poster.jpg DFSA Crypto Token Suitability Assessment for DIFC Firms Since January 12, 2026, DIFC firms assess token suitability themselves under GEN Rule 3A.2.1. This video covers the five criteria, negative indicators and the onchain evidence firms should document. https://d1ryz0te1mu7pf.cloudfront.net/blog/dfsa-crypto-token-suitability-assessment/v1/video.mp4 100 2026-11-06T03:08:06+00:00 https://guardian.security/blog/amla-cdd-rts-casps-wallet-screening/ https://d1ryz0te1mu7pf.cloudfront.net/blog/amla-cdd-rts-casps-wallet-screening/v2/poster.jpg AMLA's CDD RTS for CASPs: Wallet and Sanctions Screening What AMLA's final draft customer due diligence RTS means for CASPs: who and what to screen, including wallet addresses, when to screen, and why sanctions screening is not risk-based. https://d1ryz0te1mu7pf.cloudfront.net/blog/amla-cdd-rts-casps-wallet-screening/v2/video.mp4 106 2026-11-08T17:06:48+00:00 https://guardian.security/blog/smart-contract-vulnerability-examples-search/ https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-vulnerability-examples-search/v1/poster.jpg Smart Contract Vulnerability Examples: Search 9,617 Real Audit Findings Where to find real smart contract vulnerability examples. Guardian's public portfolio has 9,617 findings from 320 audit reports, with code locations and fixes. Here are the counts by category and how search works. https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-vulnerability-examples-search/v1/video.mp4 99 2026-11-06T18:56:28+00:00 https://guardian.security/blog/ai-generated-smart-contracts-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/ai-generated-smart-contracts-security/v2/poster.jpg Are AI-Generated Smart Contracts Safe? What Research Shows Are AI-generated smart contracts safe to deploy? A look at 2025 and 2026 research on LLM-written Solidity, the Moonwell cbETH case, and the review teams should require. https://d1ryz0te1mu7pf.cloudfront.net/blog/ai-generated-smart-contracts-security/v2/video.mp4 111 2026-11-08T17:06:43+00:00 https://guardian.security/blog/cross-chain-bridge-audit/ https://d1ryz0te1mu7pf.cloudfront.net/blog/cross-chain-bridge-audit/v2/poster.jpg Cross-Chain Bridge Audit: Scope, Timeline and Cost Cross-chain bridge audits explained: the five layers to scope, why deployment needs its own checks, what drives cost and timeline, and how Guardian's Vanguard covers bridges. https://d1ryz0te1mu7pf.cloudfront.net/blog/cross-chain-bridge-audit/v2/video.mp4 101 2026-11-06T22:22:38+00:00 https://guardian.security/blog/bug-bounty-payout-calculator/ https://d1ryz0te1mu7pf.cloudfront.net/blog/bug-bounty-payout-calculator/v1/poster.jpg Bug Bounty Payout Calculator: Size Critical Rewards to TVL How to size a Critical bug bounty reward: pay 10% of the funds at risk, between a minimum and a cap. Includes GMX and Sky benchmarks and Guardian's $50K Critical bounty matching with Vanguard. https://d1ryz0te1mu7pf.cloudfront.net/blog/bug-bounty-payout-calculator/v1/video.mp4 92 2026-11-06T18:59:41+00:00 https://guardian.security/blog/blockchain-security-risks/ https://d1ryz0te1mu7pf.cloudfront.net/blog/blockchain-security-risks/v1/poster.jpg Blockchain Security Risks: A Layer-by-Layer Map Blockchain security risks mapped across six layers, from consensus to people, with recent incidents, the core control for each layer, and how to turn the map into a risk register. https://d1ryz0te1mu7pf.cloudfront.net/blog/blockchain-security-risks/v1/video.mp4 104 2026-11-06T18:51:49+00:00 https://guardian.security/blog/is-usdt-safe/ https://d1ryz0te1mu7pf.cloudfront.net/blog/is-usdt-safe/v2/poster.jpg Is USDT Safe? Reserves, Freezes and Smart Contract Controls A neutral look at whether USDT is safe to hold. It covers Tether's BDO-assured reserves, its freeze powers, contract and chain risk, and the January 2027 regulatory deadlines. https://d1ryz0te1mu7pf.cloudfront.net/blog/is-usdt-safe/v2/video.mp4 107 2026-11-06T23:38:24+00:00 https://guardian.security/blog/is-morpho-safe/ https://d1ryz0te1mu7pf.cloudfront.net/blog/is-morpho-safe/v2/poster.jpg Is Morpho Safe? A Security Review for Allocators A short review of Morpho's risks for allocators: immutable, audited core contracts, curator vault risk, past oracle and collateral losses including xUSD and USR, and Coinbase USDC lending. https://d1ryz0te1mu7pf.cloudfront.net/blog/is-morpho-safe/v2/video.mp4 102 2026-11-08T17:20:02+00:00 https://guardian.security/blog/usdc-usdt-freeze-blacklist-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/usdc-usdt-freeze-blacklist-explained/v1/poster.jpg USDC Blacklist and USDT Freeze Functions Explained Guardian's auditors explain how the USDC blacklist and USDT freeze functions work in the contracts, who can call them, and what a frozen address means for a fintech's omnibus wallets. https://d1ryz0te1mu7pf.cloudfront.net/blog/usdc-usdt-freeze-blacklist-explained/v1/video.mp4 101 2026-11-06T19:40:55+00:00 https://guardian.security/blog/usdc-e-vs-usdc/ https://d1ryz0te1mu7pf.cloudfront.net/blog/usdc-e-vs-usdc/v1/poster.jpg USDC.e vs USDC: Bridged vs Native and Why It Matters Native USDC is issued by Circle. USDC.e is a bridged copy minted by a third party. Guardian explains who redeems and freezes each, the bridge risk inside USDC.e, and how to migrate safely. https://d1ryz0te1mu7pf.cloudfront.net/blog/usdc-e-vs-usdc/v1/video.mp4 102 2026-11-06T19:41:53+00:00 https://guardian.security/blog/flash-usdt-scam/ https://d1ryz0te1mu7pf.cloudfront.net/blog/flash-usdt-scam/v1/poster.jpg Flash USDT Scams: Why Fake Tether Tokens Fool Buyers Flash USDT is not real. This video explains how the scam works, from lookalike tokens and unconfirmed transfers to fake screens and approvals, and how to verify real USDT before releasing funds. https://d1ryz0te1mu7pf.cloudfront.net/blog/flash-usdt-scam/v1/video.mp4 104 2026-11-06T19:22:29+00:00 https://guardian.security/blog/how-to-check-if-token-is-honeypot/ https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-check-if-token-is-honeypot/v1/poster.jpg How to Check if a Token Is a Honeypot Before You Buy How to check if a token is a honeypot before you buy: read the contract for owner powers, simulate a sell, check who controls liquidity, and know what scanners miss. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-check-if-token-is-honeypot/v1/video.mp4 98 2026-11-06T18:50:49+00:00 https://guardian.security/blog/infinite-mint-exploit/ https://d1ryz0te1mu7pf.cloudfront.net/blog/infinite-mint-exploit/v1/poster.jpg Infinite Mint Attacks: How Unbacked Tokens Get Minted How infinite mint attacks happen through logic bugs and stolen minter keys, what the Resolv exploit shows, and the onchain controls that cap a mint. https://d1ryz0te1mu7pf.cloudfront.net/blog/infinite-mint-exploit/v1/video.mp4 101 2026-11-06T18:50:33+00:00 https://guardian.security/blog/underconstrained-zk-circuits/ https://d1ryz0te1mu7pf.cloudfront.net/blog/underconstrained-zk-circuits/v1/poster.jpg Underconstrained Circuits: The Most Common ZK Bug, Explained What an underconstrained ZK circuit is, why assigned but unconstrained signals break proofs, three real incident patterns, and the tools and checks that find them. https://d1ryz0te1mu7pf.cloudfront.net/blog/underconstrained-zk-circuits/v1/video.mp4 100 2026-11-06T19:02:42+00:00 https://guardian.security/blog/initializer-vulnerabilities-upgradeable/ https://d1ryz0te1mu7pf.cloudfront.net/blog/initializer-vulnerabilities-upgradeable/v1/poster.jpg Initializer vulnerabilities and _disableInitializers in upgradeable contracts How uninitialized implementations and front-run initialize calls let attackers take over upgradeable contracts, and how _disableInitializers and a deploy checklist close the gap. https://d1ryz0te1mu7pf.cloudfront.net/blog/initializer-vulnerabilities-upgradeable/v1/video.mp4 109 2026-11-06T19:14:35+00:00 https://guardian.security/blog/ownable-vs-accesscontrol-vs-accessmanager/ https://d1ryz0te1mu7pf.cloudfront.net/blog/ownable-vs-accesscontrol-vs-accessmanager/v3/poster.jpg Ownable vs AccessControl vs AccessManager in Solidity A short guide to Solidity access control in OpenZeppelin v5. It covers when to use Ownable2Step, AccessControl or AccessManager and the failure modes that audits keep finding. https://d1ryz0te1mu7pf.cloudfront.net/blog/ownable-vs-accesscontrol-vs-accessmanager/v3/video.mp4 105 2026-11-08T18:02:34+00:00 https://guardian.security/blog/openzeppelin-v4-to-v5-migration/ https://d1ryz0te1mu7pf.cloudfront.net/blog/openzeppelin-v4-to-v5-migration/v1/poster.jpg OpenZeppelin Contracts v4 to v5: Can Live Proxies Upgrade? OpenZeppelin Contracts 5 moved upgradeable storage to ERC-7201 slots, so live v4 proxies cannot safely upgrade. See what v5 breaks, the three migration cases and a safe checklist. https://d1ryz0te1mu7pf.cloudfront.net/blog/openzeppelin-v4-to-v5-migration/v1/video.mp4 104 2026-11-06T19:46:19+00:00 https://guardian.security/blog/smart-contract-ci-cd-pipeline/ https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-ci-cd-pipeline/v1/poster.jpg Smart Contract CI/CD Pipeline: Foundry, Slither and Fuzzing A GitHub Actions pipeline for Foundry smart contracts, with pinned tools, Slither with SARIF, CI fuzzing, multisig deploys and release evidence retention. https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-ci-cd-pipeline/v1/video.mp4 101 2026-11-06T19:27:27+00:00 https://guardian.security/blog/solana-program-security-best-practices/ https://d1ryz0te1mu7pf.cloudfront.net/blog/solana-program-security-best-practices/v1/poster.jpg Solana Smart Contract Security: Best Practices for Anchor Solana smart contract security for Anchor developers: account validation, PDA seeds and bumps, CPI targets, init and close, upgrade authority and Anchor's own security advisories. https://d1ryz0te1mu7pf.cloudfront.net/blog/solana-program-security-best-practices/v1/video.mp4 100 2026-11-06T19:43:59+00:00 https://guardian.security/blog/how-to-check-if-audited/ https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-check-if-audited/v1/poster.jpg How to Check if a Smart Contract Is Really Audited How to check if a smart contract is really audited: find the report at the auditor's own source, match its final commit to deployed code, check upgrades and spot fake reports. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-check-if-audited/v1/video.mp4 92 2026-11-06T18:49:48+00:00 https://guardian.security/blog/audit-finding-statuses/ https://d1ryz0te1mu7pf.cloudfront.net/blog/audit-finding-statuses/v1/poster.jpg Acknowledged vs Resolved: Audit Finding Statuses Explained What it means when an audit finding is acknowledged instead of resolved, how often each status appears across 9,617 public Guardian findings, and what to ask about an acknowledged Critical. https://d1ryz0te1mu7pf.cloudfront.net/blog/audit-finding-statuses/v1/video.mp4 93 2026-11-06T19:00:48+00:00 https://guardian.security/blog/how-to-report-smart-contract-vulnerability/ https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-report-smart-contract-vulnerability/v1/poster.jpg How to Report a Smart Contract Vulnerability Safely A researcher's guide to reporting a smart contract vulnerability safely: find a private channel, write a report teams can act on, avoid banned moves and stay inside safe harbor. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-report-smart-contract-vulnerability/v1/video.mp4 97 2026-11-06T19:00:49+00:00 https://guardian.security/blog/what-is-seal-911/ https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-seal-911/v1/poster.jpg What Is SEAL 911 and When Should You Contact It? A short explainer on SEAL 911, the Security Alliance's free 24/7 crypto emergency hotline. It covers how to contact it during a hack, what to send, what it does not do and how it differs from Safe Harbor. https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-seal-911/v1/video.mp4 96 2026-11-06T19:04:35+00:00 https://guardian.security/blog/crypto-hack-post-mortem-template/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-hack-post-mortem-template/v1/poster.jpg Incident Post-Mortem Template for Crypto Hacks A fill-in post-mortem template for crypto hacks covering when to publish, what each section should contain, three published reports worth copying, and what to hold back. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-hack-post-mortem-template/v1/video.mp4 96 2026-11-06T19:05:30+00:00 https://guardian.security/blog/how-to-track-crypto-hacks-in-real-time/ https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-track-crypto-hacks-in-real-time/v1/poster.jpg How to Track Crypto Hacks in Real Time Was there a crypto hack today? Where exploits are reported first, which trackers keep the record, how to tell a real exploit from a rumor, and how to monitor your own contracts. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-track-crypto-hacks-in-real-time/v1/video.mp4 96 2026-11-06T19:45:01+00:00 https://guardian.security/blog/project-x-account-hacked-playbook/ https://d1ryz0te1mu7pf.cloudfront.net/blog/project-x-account-hacked-playbook/v1/poster.jpg Crypto Project X Account Hacked? A Response Playbook What a crypto project should do when its X account is hacked to post a scam: warn users, recover the account, remove attacker access, find the root cause and harden logins. https://d1ryz0te1mu7pf.cloudfront.net/blog/project-x-account-hacked-playbook/v1/video.mp4 98 2026-11-06T19:23:37+00:00 https://guardian.security/blog/private-key-exposed-github/ https://d1ryz0te1mu7pf.cloudfront.net/blog/private-key-exposed-github/v1/poster.jpg Private Key Exposed on GitHub: What to Do in the First Hour What to do when a private key is exposed on GitHub: how fast scanners find it, the first-hour order of moving funds and rotating roles, and how to block the next leak. https://d1ryz0te1mu7pf.cloudfront.net/blog/private-key-exposed-github/v1/video.mp4 90 2026-11-06T19:27:22+00:00 https://guardian.security/blog/wazirx-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/wazirx-hack-explained/v1/poster.jpg The WazirX Hack Explained: How $230M Left a Multisig How over $230 million left a WazirX Safe multisig in July 2024, the competing WazirX and Liminal accounts, attribution, the Singapore restructuring, and the signing controls that close the gap. https://d1ryz0te1mu7pf.cloudfront.net/blog/wazirx-hack-explained/v1/video.mp4 109 2026-11-06T19:47:30+00:00 https://guardian.security/blog/stablecoin-mint-error-lessons/ https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-mint-error-lessons/v2/poster.jpg Paxos PYUSD Minting Error: Lessons for Stablecoin Issuers How Paxos minted 300 trillion PYUSD by mistake in one transaction, and the mint caps, approvals, simulation and alerts that help issuers prevent a repeat. https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-mint-error-lessons/v2/video.mp4 105 2026-11-06T19:54:22+00:00 https://guardian.security/blog/biggest-bridge-hacks/ https://d1ryz0te1mu7pf.cloudfront.net/blog/biggest-bridge-hacks/v2/poster.jpg Biggest Bridge Hacks Ranked, With Root Causes Guardian ranks the 12 biggest crypto bridge hacks by loss using DefiLlama data, from Ronin to Kelp DAO, and groups them by what the attacker had to break. https://d1ryz0te1mu7pf.cloudfront.net/blog/biggest-bridge-hacks/v2/video.mp4 105 2026-11-06T22:22:29+00:00 https://guardian.security/blog/rwa-hacks-exploits-root-causes/ https://d1ryz0te1mu7pf.cloudfront.net/blog/rwa-hacks-exploits-root-causes/v1/poster.jpg RWA Hacks and Exploits: Losses and Root Causes Since 2023 Real-world asset protocols lost 1.73M in seven incidents since 2023, by Guardian's count of DefiLlama data. This video covers each root cause, from one admin key compromise to five contract bugs, and the controls that address them. https://d1ryz0te1mu7pf.cloudfront.net/blog/rwa-hacks-exploits-root-causes/v1/video.mp4 104 2026-11-06T19:15:17+00:00 https://guardian.security/blog/defi-hack-to-tvl-ratio/ https://d1ryz0te1mu7pf.cloudfront.net/blog/defi-hack-to-tvl-ratio/v2/poster.jpg Hack-to-TVL Ratio: Is DeFi Getting Safer? Guardian divides DeFi hack losses by average TVL, using DefiLlama data. Losses per dollar locked fell every year from 2022 to 2025, then rose again in 2026. https://d1ryz0te1mu7pf.cloudfront.net/blog/defi-hack-to-tvl-ratio/v2/video.mp4 102 2026-11-08T17:17:07+00:00 https://guardian.security/blog/erc-3643-vs-erc-1400/ https://d1ryz0te1mu7pf.cloudfront.net/blog/erc-3643-vs-erc-1400/v1/poster.jpg ERC-3643 vs ERC-1400: Choosing a Security Token Standard An auditor's comparison of the ERC-3643 and ERC-1400 security token standards. It covers status, how each enforces compliance, override powers, what to audit first and when to pick each. https://d1ryz0te1mu7pf.cloudfront.net/blog/erc-3643-vs-erc-1400/v1/video.mp4 108 2026-11-06T19:41:14+00:00 https://guardian.security/blog/tokenized-stocks-risks/ https://d1ryz0te1mu7pf.cloudfront.net/blog/tokenized-stocks-risks/v1/poster.jpg Tokenized Stocks Risks: Issuers, Custody and Smart Contracts What tokenized stock holders actually own, and the issuer, custodian, smart contract, bridge and off-hours pricing risks that come with it, plus the SEC's September 2026 order. https://d1ryz0te1mu7pf.cloudfront.net/blog/tokenized-stocks-risks/v1/video.mp4 98 2026-11-06T19:19:17+00:00 https://guardian.security/blog/llm-pentesting-checklist/ https://d1ryz0te1mu7pf.cloudfront.net/blog/llm-pentesting-checklist/v1/poster.jpg LLM Pentesting Checklist for Crypto and Fintech Apps How to pentest an LLM feature in a crypto or fintech app: map its tools and data, test prompt injection, leakage and tool authorization, and report each finding against the OWASP LLM Top 10. https://d1ryz0te1mu7pf.cloudfront.net/blog/llm-pentesting-checklist/v1/video.mp4 101 2026-11-06T19:18:22+00:00 https://guardian.security/blog/what-is-a-key-ceremony/ https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-a-key-ceremony/v1/poster.jpg What Is a Key Ceremony? How Custodians Generate Crypto Keys A short explainer on key ceremonies in crypto custody: who takes part, how HSM, MPC and multisig ceremonies differ, the evidence to keep, and how Guardian reviews them. https://d1ryz0te1mu7pf.cloudfront.net/blog/what-is-a-key-ceremony/v1/video.mp4 93 2026-11-06T19:36:27+00:00 https://guardian.security/blog/ofac-stablecoin-issuer-sanctions-program-502-201/ https://d1ryz0te1mu7pf.cloudfront.net/blog/ofac-stablecoin-issuer-sanctions-program-502-201/v1/poster.jpg OFAC's GENIUS Act Sanctions Program for Stablecoin Issuers A short explainer on OFAC's proposed 31 CFR 502.201 under the GENIUS Act: the five required sanctions program elements, blocking on the secondary market, and a designation to freeze pipeline for stablecoin issuers. https://d1ryz0te1mu7pf.cloudfront.net/blog/ofac-stablecoin-issuer-sanctions-program-502-201/v1/video.mp4 100 2026-11-06T19:30:49+00:00 https://guardian.security/blog/nydfs-part-500-penetration-testing/ https://d1ryz0te1mu7pf.cloudfront.net/blog/nydfs-part-500-penetration-testing/v1/poster.jpg NYDFS Part 500 Penetration Testing Requirements (500.5) A short guide to NYDFS Part 500 penetration testing under section 500.5. It covers the annual pentest from inside and outside, the BitLicensee rules, how a crypto firm scopes the test and the evidence it needs for certification. https://d1ryz0te1mu7pf.cloudfront.net/blog/nydfs-part-500-penetration-testing/v1/video.mp4 104 2026-11-06T19:32:58+00:00 https://guardian.security/blog/are-smart-contract-audits-required-by-law/ https://d1ryz0te1mu7pf.cloudfront.net/blog/are-smart-contract-audits-required-by-law/v2/poster.jpg Are Smart Contract Audits Required by Law? 8 Rules Compared Is a smart contract audit legally required? This video covers what eight texts say about audits and code review, from the HKMA and DORA to MiCA and the OCC's GENIUS Act rule, and what a regulator-grade review looks like. https://d1ryz0te1mu7pf.cloudfront.net/blog/are-smart-contract-audits-required-by-law/v2/video.mp4 104 2026-11-08T17:07:55+00:00 https://guardian.security/blog/eba-sanctions-screening-guidelines-casps/ https://d1ryz0te1mu7pf.cloudfront.net/blog/eba-sanctions-screening-guidelines-casps/v3/poster.jpg EBA Sanctions Screening Guidelines for CASPs: A Checklist A short guide to EBA/GL/2024/15 for CASPs: screen every crypto transfer before release, check listed wallet addresses, calibrate fuzzy matching and test the pipeline for bypasses. https://d1ryz0te1mu7pf.cloudfront.net/blog/eba-sanctions-screening-guidelines-casps/v3/video.mp4 107 2026-11-08T18:03:41+00:00 https://guardian.security/blog/eba-no-action-letter-mica-psd2-emt/ https://d1ryz0te1mu7pf.cloudfront.net/blog/eba-no-action-letter-mica-psd2-emt/v3/poster.jpg EBA No-Action Letter on MiCA and PSD2: Who Needs a License How the EBA's No Action letter splits e-money token services between MiCA and PSD2, what changed on March 2, 2026, and which PSD2 security duties now apply to CASPs. https://d1ryz0te1mu7pf.cloudfront.net/blog/eba-no-action-letter-mica-psd2-emt/v3/video.mp4 108 2026-11-08T18:03:29+00:00 https://guardian.security/blog/south-korea-crypto-travel-rule-expansion/ https://d1ryz0te1mu7pf.cloudfront.net/blog/south-korea-crypto-travel-rule-expansion/v1/poster.jpg South Korea Crypto Travel Rule Expansion: The 2027 Start South Korea's amended AML decree extends the crypto travel rule to transfers of any amount from February 19, 2027. This video covers the new duties for receiving VASPs, the limits on overseas transfers, KoFIU reports and the registration rules. https://d1ryz0te1mu7pf.cloudfront.net/blog/south-korea-crypto-travel-rule-expansion/v1/video.mp4 106 2026-11-06T19:48:29+00:00 https://guardian.security/blog/uae-travel-rule-crypto/ https://d1ryz0te1mu7pf.cloudfront.net/blog/uae-travel-rule-crypto/v2/poster.jpg UAE Travel Rule for crypto: AED 3,500 and unhosted wallets How the UAE Virtual Assets Travel Rule works for VASPs: the data each transfer carries, counterparty checks, the AED 3,500 threshold, unhosted wallets and the privacy token ban. https://d1ryz0te1mu7pf.cloudfront.net/blog/uae-travel-rule-crypto/v2/video.mp4 110 2026-11-08T17:44:22+00:00 https://guardian.security/blog/crypto-exchange-reconciliation-rules-asia-pacific/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-reconciliation-rules-asia-pacific/v1/poster.jpg Crypto Exchange Reconciliation Requirements in Asia-Pacific, Explained How often exchanges must reconcile client balances to onchain wallets in Korea, Hong Kong, Australia and Pakistan, what a break triggers, and one design that meets the strictest rule. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-exchange-reconciliation-rules-asia-pacific/v1/video.mp4 98 2026-11-06T19:31:56+00:00 https://guardian.security/blog/japan-crypto-fiea-amendment-security-rules/ https://d1ryz0te1mu7pf.cloudfront.net/blog/japan-crypto-fiea-amendment-security-rules/v1/poster.jpg Japan's Crypto FIEA Amendment: Security and Custody Rules Japan's new law moves crypto trading into the FIEA. This video covers the cold wallet rule, custody vendor duties, the liability reserve, token disclosure and insider trading rules. https://d1ryz0te1mu7pf.cloudfront.net/blog/japan-crypto-fiea-amendment-security-rules/v1/video.mp4 107 2026-11-06T19:31:51+00:00 https://guardian.security/blog/kenya-vasp-regulations-2026-cybersecurity/ https://d1ryz0te1mu7pf.cloudfront.net/blog/kenya-vasp-regulations-2026-cybersecurity/v2/poster.jpg Kenya VASP Regulations 2026: Cybersecurity and Pentests Kenya's 2026 VASP Regulations require a pentest to apply, a CISO, twice-yearly testing in year one and 24-hour incident reports. Here is what applicants and licensees must prove. https://d1ryz0te1mu7pf.cloudfront.net/blog/kenya-vasp-regulations-2026-cybersecurity/v2/video.mp4 101 2026-11-08T17:21:28+00:00 https://guardian.security/blog/lazarus-group-crypto-hacking-playbook/ https://d1ryz0te1mu7pf.cloudfront.net/blog/lazarus-group-crypto-hacking-playbook/v1/poster.jpg How Lazarus Group Hacks Crypto Companies: The 2026 Playbook How North Korea's Lazarus Group gets into crypto companies through fake recruiters, fake investors and signer compromise, how it launders the funds, and the defenses that keep one laptop from reaching your keys. https://d1ryz0te1mu7pf.cloudfront.net/blog/lazarus-group-crypto-hacking-playbook/v1/video.mp4 108 2026-11-06T20:42:25+00:00 https://guardian.security/blog/is-hyperliquid-safe/ https://d1ryz0te1mu7pf.cloudfront.net/blog/is-hyperliquid-safe/v2/poster.jpg Is Hyperliquid Safe? A Security and Risk Breakdown A neutral look at Hyperliquid's main risks: validator concentration, the legacy Arbitrum bridge, oracles, the HLP backstop and HIP-3 markets, with dated incidents and checks you can run yourself. https://d1ryz0te1mu7pf.cloudfront.net/blog/is-hyperliquid-safe/v2/video.mp4 97 2026-11-08T17:19:57+00:00 https://guardian.security/blog/is-solana-secure/ https://d1ryz0te1mu7pf.cloudfront.net/blog/is-solana-secure/v1/poster.jpg Is Solana Secure? Network, Client and Application Risk An institutional look at Solana security that separates network outages, client diversity and validator concentration from application and key risk, with controls risk teams can adopt. https://d1ryz0te1mu7pf.cloudfront.net/blog/is-solana-secure/v1/video.mp4 108 2026-11-06T21:07:37+00:00 https://guardian.security/blog/wrapped-bitcoin-risks/ https://d1ryz0te1mu7pf.cloudfront.net/blog/wrapped-bitcoin-risks/v2/poster.jpg cbBTC vs WBTC vs LBTC vs tBTC: Wrapped Bitcoin Risks A comparison of the trust behind WBTC, cbBTC, LBTC and tBTC: who holds the bitcoin, who can mint or freeze it, and what to check before you accept one as collateral. https://d1ryz0te1mu7pf.cloudfront.net/blog/wrapped-bitcoin-risks/v2/video.mp4 106 2026-11-08T17:56:35+00:00 https://guardian.security/blog/zk-vs-optimistic-rollup-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/zk-vs-optimistic-rollup-security/v1/poster.jpg ZK Rollup vs Optimistic Rollup: What Each One Trusts A security-first comparison of ZK and optimistic rollups. It covers what each one trusts, from proof soundness and challengers to escape hatches and upgrade keys. https://d1ryz0te1mu7pf.cloudfront.net/blog/zk-vs-optimistic-rollup-security/v1/video.mp4 102 2026-11-06T21:01:29+00:00 https://guardian.security/blog/owasp-top-10-2025/ https://d1ryz0te1mu7pf.cloudfront.net/blog/owasp-top-10-2025/v1/poster.jpg OWASP Top 10 2025 Explained for Crypto and Fintech Web Apps What changed in the OWASP Top 10 2025 since 2021, how each risk shows up in crypto and fintech web apps, and which fixes to prioritize by what can move funds. https://d1ryz0te1mu7pf.cloudfront.net/blog/owasp-top-10-2025/v1/video.mp4 102 2026-11-06T20:44:23+00:00 https://guardian.security/blog/prediction-market-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/prediction-market-security/v1/poster.jpg Prediction Market Manipulation and How Platforms Prevent It How prediction markets get manipulated, from resolution votes and vague rules to insider trading and injected front-end scripts, and the defenses platforms use at each layer. https://d1ryz0te1mu7pf.cloudfront.net/blog/prediction-market-security/v1/video.mp4 103 2026-11-06T20:42:21+00:00 https://guardian.security/blog/accept-stablecoin-payments/ https://d1ryz0te1mu7pf.cloudfront.net/blog/accept-stablecoin-payments/v1/poster.jpg How to Accept Stablecoin Payments Securely How merchants can accept stablecoin payments securely: processor vs self-hosted options, and the webhook, finality, custody, sanctions and refund controls that stay with you. https://d1ryz0te1mu7pf.cloudfront.net/blog/accept-stablecoin-payments/v1/video.mp4 96 2026-11-06T20:47:58+00:00 https://guardian.security/blog/tokenized-treasuries-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/tokenized-treasuries-explained/v2/poster.jpg Tokenized Treasuries Explained: Structures and Risks Tokenized treasuries explained for institutions: the three structures behind the tokens, who you are exposed to in each, and the diligence questions to ask before allocating. https://d1ryz0te1mu7pf.cloudfront.net/blog/tokenized-treasuries-explained/v2/video.mp4 96 2026-11-08T17:42:35+00:00 https://guardian.security/blog/which-solidity-version-to-use/ https://d1ryz0te1mu7pf.cloudfront.net/blog/which-solidity-version-to-use/v1/poster.jpg Which Solidity Version Should You Use? A Security View A security view of the latest Solidity version: why 0.8.38 is the pick, known compiler bugs by version, via-IR versus legacy, EVM targets and a pragma policy. https://d1ryz0te1mu7pf.cloudfront.net/blog/which-solidity-version-to-use/v1/video.mp4 98 2026-11-06T20:29:16+00:00 https://guardian.security/blog/stablecoin-depeg-history/ https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-depeg-history/v2/poster.jpg Stablecoin Depeg History: Major Depegs and Their Root Causes A short explainer on the biggest stablecoin depegs since 2022, from TerraUSD and USDC to xUSD and USR. It covers each one's low, whether it recovered and what broke: reserves, design, exploits, keys or markets. https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-depeg-history/v2/video.mp4 102 2026-11-06T22:20:22+00:00 https://guardian.security/blog/stolen-crypto-recovery-rates/ https://d1ryz0te1mu7pf.cloudfront.net/blog/stolen-crypto-recovery-rates/v1/poster.jpg Stolen Crypto Recovery Rates: How Much Is Returned or Frozen How much stolen crypto is recovered? Data from PeckShield, Immunefi, Hacken and TRM Labs puts recent full years at roughly 8% to 16%. This video covers what each source counts and how to spot recovery scams. https://d1ryz0te1mu7pf.cloudfront.net/blog/stolen-crypto-recovery-rates/v1/video.mp4 104 2026-11-06T21:10:34+00:00 https://guardian.security/blog/erc20-vulnerabilities/ https://d1ryz0te1mu7pf.cloudfront.net/blog/erc20-vulnerabilities/v1/poster.jpg ERC-20 Vulnerabilities: Approve Races, Mint Bugs and Hooks Guardian explains the most common ERC-20 vulnerabilities in your own token code, from approve races and broken permits to mint bugs, reentrant hooks and blacklist gaps. https://d1ryz0te1mu7pf.cloudfront.net/blog/erc20-vulnerabilities/v1/video.mp4 103 2026-11-06T20:40:30+00:00 https://guardian.security/blog/erc4626-security-checklist/ https://d1ryz0te1mu7pf.cloudfront.net/blog/erc4626-security-checklist/v1/poster.jpg ERC-4626 Vulnerabilities: A Vault Security Checklist A vault security checklist for ERC-4626: rounding, previews and max limits, donation and inflation attacks, fees, reentrancy and share-price oracles, backed by Guardian audit findings. https://d1ryz0te1mu7pf.cloudfront.net/blog/erc4626-security-checklist/v1/video.mp4 99 2026-11-06T20:43:19+00:00 https://guardian.security/blog/emergency-pause-design/ https://d1ryz0te1mu7pf.cloudfront.net/blog/emergency-pause-design/v1/poster.jpg Pausable Contract Design: Roles, Scope and Who Can Unpause A short guide to pausable contract design: what to pause, which paths stay open, who pauses and unpauses, automated triggers and real findings from Guardian audits. https://d1ryz0te1mu7pf.cloudfront.net/blog/emergency-pause-design/v1/video.mp4 104 2026-11-06T20:31:38+00:00 https://guardian.security/blog/uups-vs-transparent-proxy/ https://d1ryz0te1mu7pf.cloudfront.net/blog/uups-vs-transparent-proxy/v1/poster.jpg UUPS vs Transparent Proxy: Security Tradeoffs Compared UUPS or transparent proxy? Where upgrade logic lives, who can upgrade, bricking and initialization risks, real findings from Guardian audits, and which pattern to choose. https://d1ryz0te1mu7pf.cloudfront.net/blog/uups-vs-transparent-proxy/v1/video.mp4 101 2026-11-06T20:30:33+00:00 https://guardian.security/blog/balancer-exploit-post-mortem/ https://d1ryz0te1mu7pf.cloudfront.net/blog/balancer-exploit-post-mortem/v1/poster.jpg Balancer Exploit Post-Mortem: How Rounding Drained V2 Pools How a rounding error in exact-out swaps drained Balancer V2 Composable Stable Pools on November 3, 2025. Covers what the audits covered and how invariant fuzzing finds this class of bug. https://d1ryz0te1mu7pf.cloudfront.net/blog/balancer-exploit-post-mortem/v1/video.mp4 104 2026-11-06T20:35:53+00:00 https://guardian.security/blog/negotiate-with-hacker-defi-exploit/ https://d1ryz0te1mu7pf.cloudfront.net/blog/negotiate-with-hacker-defi-exploit/v1/poster.jpg How to Negotiate With a Hacker After a DeFi Exploit How DeFi protocols negotiate with attackers to recover stolen funds: leverage, onchain offers, 10% bounties, deadlines, sanctions checks and closing the deal. https://d1ryz0te1mu7pf.cloudfront.net/blog/negotiate-with-hacker-defi-exploit/v1/video.mp4 89 2026-11-06T21:17:51+00:00 https://guardian.security/blog/request-exchange-freeze-after-hack/ https://d1ryz0te1mu7pf.cloudfront.net/blog/request-exchange-freeze-after-hack/v1/poster.jpg How to Request an Exchange Freeze After a Hack A short guide for hacked protocol teams. It covers who can freeze stolen funds, which contacts to reach in parallel, the evidence package to send, and what a freeze cannot do. https://d1ryz0te1mu7pf.cloudfront.net/blog/request-exchange-freeze-after-hack/v1/video.mp4 101 2026-11-06T21:17:56+00:00 https://guardian.security/blog/multisig-signer-compromised-response/ https://d1ryz0te1mu7pf.cloudfront.net/blog/multisig-signer-compromised-response/v1/poster.jpg What to Do When a Multisig Signer Is Compromised A step-by-step Safe runbook for a compromised multisig signer: contain, clear pending transactions, rotate to a clean quorum, check modules and guards, and move funds if needed. https://d1ryz0te1mu7pf.cloudfront.net/blog/multisig-signer-compromised-response/v1/video.mp4 101 2026-11-06T21:03:37+00:00 https://guardian.security/blog/safe-multisig-monitoring/ https://d1ryz0te1mu7pf.cloudfront.net/blog/safe-multisig-monitoring/v1/poster.jpg Safe Multisig Monitoring: Owner, Module and Guard Alerts Which alerts to set on a Safe multisig: owner and threshold changes, modules, guards, fallback handlers, delegatecalls, pending proposals and the nonce. https://d1ryz0te1mu7pf.cloudfront.net/blog/safe-multisig-monitoring/v1/video.mp4 101 2026-11-06T21:16:48+00:00 https://guardian.security/blog/hot-wallet-monitoring/ https://d1ryz0te1mu7pf.cloudfront.net/blog/hot-wallet-monitoring/v1/poster.jpg Hot Wallet Monitoring for Exchanges and Custodians How exchanges and custodians should monitor hot wallets after the Binance theft: real-time ledger reconciliation, velocity and destination rules, signer alerts and automatic halts. https://d1ryz0te1mu7pf.cloudfront.net/blog/hot-wallet-monitoring/v1/video.mp4 106 2026-11-06T20:53:49+00:00 https://guardian.security/blog/malicious-vscode-extensions-crypto/ https://d1ryz0te1mu7pf.cloudfront.net/blog/malicious-vscode-extensions-crypto/v1/poster.jpg Malicious VS Code Extensions: GlassWorm and Crypto Theft How malicious VS Code extensions like GlassWorm steal crypto wallet data and developer tokens, what to hunt for, and the extension allowlist policy that protects your team. https://d1ryz0te1mu7pf.cloudfront.net/blog/malicious-vscode-extensions-crypto/v1/video.mp4 112 2026-11-06T20:40:31+00:00 https://guardian.security/blog/foundry-invariant-testing/ https://d1ryz0te1mu7pf.cloudfront.net/blog/foundry-invariant-testing/v2/poster.jpg Foundry Invariant Testing: Handlers, Ghost Variables, Actors A short walkthrough of invariant testing in Foundry. It covers handlers, ghost variables, actors, bounded inputs, foundry.toml settings and how to debug a failing call sequence. https://d1ryz0te1mu7pf.cloudfront.net/blog/foundry-invariant-testing/v2/video.mp4 92 2026-11-06T22:20:41+00:00 https://guardian.security/blog/echidna-vs-medusa-vs-foundry/ https://d1ryz0te1mu7pf.cloudfront.net/blog/echidna-vs-medusa-vs-foundry/v1/poster.jpg Echidna vs Medusa vs Foundry: Which Solidity Fuzzer Should You Use? A short comparison of Foundry, Echidna and Medusa for Solidity invariant fuzzing, drawn from each tool's docs and two public benchmarks, with a practical way to run more than one. https://d1ryz0te1mu7pf.cloudfront.net/blog/echidna-vs-medusa-vs-foundry/v1/video.mp4 108 2026-11-06T21:11:34+00:00 https://guardian.security/blog/slither-tutorial/ https://d1ryz0te1mu7pf.cloudfront.net/blog/slither-tutorial/v2/poster.jpg Slither Tutorial: Static Analysis for Solidity Teams How to install and run Slither, read impact and confidence, triage false positives, write a custom detector and gate CI. It also covers what static analysis cannot find. https://d1ryz0te1mu7pf.cloudfront.net/blog/slither-tutorial/v2/video.mp4 99 2026-11-08T17:32:33+00:00 https://guardian.security/blog/token-2022-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/token-2022-security/v1/poster.jpg Token-2022 Extensions: The Security Risk Each One Adds A short explainer for Solana integrators on the risk each Token-2022 extension adds, covering permanent delegates, transfer hooks, transfer fees and closable mints, with an integration checklist. https://d1ryz0te1mu7pf.cloudfront.net/blog/token-2022-security/v1/video.mp4 97 2026-11-06T20:32:36+00:00 https://guardian.security/blog/restaking-risks/ https://d1ryz0te1mu7pf.cloudfront.net/blog/restaking-risks/v3/poster.jpg Restaking Risks: EigenLayer, Symbiotic and LRTs Explained A layer by layer look at restaking risk: slashing on EigenLayer and Symbiotic, LRT contracts, bridges, leverage loops and what to monitor, using the April 2026 rsETH loss as the example. https://d1ryz0te1mu7pf.cloudfront.net/blog/restaking-risks/v3/video.mp4 104 2026-11-08T17:35:41+00:00 https://guardian.security/blog/ethereum-slashing-risk/ https://d1ryz0te1mu7pf.cloudfront.net/blog/ethereum-slashing-risk/v1/poster.jpg Ethereum Slashing Risk: Causes, Penalties and Prevention What gets an Ethereum validator slashed, how big the penalties are since Pectra, and the operator mistakes behind real slashings, with a prevention checklist. https://d1ryz0te1mu7pf.cloudfront.net/blog/ethereum-slashing-risk/v1/video.mp4 101 2026-11-06T21:20:18+00:00 https://guardian.security/blog/bad-debt-in-defi/ https://d1ryz0te1mu7pf.cloudfront.net/blog/bad-debt-in-defi/v2/poster.jpg Bad Debt in DeFi: How It Forms and Who Pays for It How bad debt forms in DeFi lending, who absorbs it and the backstops that cap it, with rsETH on Aave and xUSD in curated vaults as case studies. https://d1ryz0te1mu7pf.cloudfront.net/blog/bad-debt-in-defi/v2/video.mp4 105 2026-11-08T17:09:00+00:00 https://guardian.security/blog/synthetic-stablecoin-risks/ https://d1ryz0te1mu7pf.cloudfront.net/blog/synthetic-stablecoin-risks/v3/poster.jpg Synthetic and Delta-Neutral Stablecoin Risks Explained How synthetic, delta-neutral stablecoins like USDe hold their peg, and how funding, custody, venue, redemption and mint risk can break it. https://d1ryz0te1mu7pf.cloudfront.net/blog/synthetic-stablecoin-risks/v3/video.mp4 105 2026-11-08T17:53:19+00:00 https://guardian.security/blog/settlement-finality-confirmations-by-chain/ https://d1ryz0te1mu7pf.cloudfront.net/blog/settlement-finality-confirmations-by-chain/v1/poster.jpg Blockchain Finality Compared: How Many Confirmations to Wait A blockchain finality comparison for fintechs: what final means on each chain, how rollup sequencers fit in, what Kraken waits for, and a deposit crediting policy to copy. https://d1ryz0te1mu7pf.cloudfront.net/blog/settlement-finality-confirmations-by-chain/v1/video.mp4 102 2026-11-06T21:02:03+00:00 https://guardian.security/blog/evmbench-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/evmbench-explained/v1/poster.jpg EVMbench Explained: What It Says About AI Auditors EVMbench, from OpenAI and Paradigm, tests AI agents on detect, patch and exploit tasks. This video explains what the 72.2% exploit and 41.5% patch scores mean and where the benchmark falls short. https://d1ryz0te1mu7pf.cloudfront.net/blog/evmbench-explained/v1/video.mp4 108 2026-11-06T20:31:43+00:00 https://guardian.security/blog/crypto-payment-webhook-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-payment-webhook-security/v1/poster.jpg Webhook Security Best Practices for Crypto Payments A guide for backend engineers on securing crypto payment webhooks: verify signatures, reject replays, credit each transfer once and confirm every deposit onchain before crediting. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-payment-webhook-security/v1/video.mp4 98 2026-11-06T20:44:39+00:00 https://guardian.security/blog/secrets-management-crypto-companies/ https://d1ryz0te1mu7pf.cloudfront.net/blog/secrets-management-crypto-companies/v1/poster.jpg Secrets Management Best Practices for Crypto Companies A short explainer on secrets management for crypto companies: centralize, scope and rotate secrets, choose between Vault and cloud secrets managers, and keep signing keys in an HSM, KMS or MPC system. https://d1ryz0te1mu7pf.cloudfront.net/blog/secrets-management-crypto-companies/v1/video.mp4 97 2026-11-06T20:48:22+00:00 https://guardian.security/blog/hsm-vs-kms/ https://d1ryz0te1mu7pf.cloudfront.net/blog/hsm-vs-kms/v1/poster.jpg HSM vs KMS for Crypto Signing Keys Cloud KMS or dedicated HSM for crypto signing keys? We compare curve support, FIPS 140-3 levels, tenancy, approval policy and cost, and show where MPC fits. https://d1ryz0te1mu7pf.cloudfront.net/blog/hsm-vs-kms/v1/video.mp4 106 2026-11-06T21:05:54+00:00 https://guardian.security/blog/stablecoin-linked-cards/ https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-linked-cards/v1/poster.jpg Stablecoin-Linked Cards: How They Work and Where They Break How stablecoin-linked cards move from wallet funding to authorization and settlement, and where they break: balance races, key custody, refunds and KYC. https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-linked-cards/v1/video.mp4 102 2026-11-06T20:48:57+00:00 https://guardian.security/blog/penetration-testing-requirements-by-regulation/ https://d1ryz0te1mu7pf.cloudfront.net/blog/penetration-testing-requirements-by-regulation/v1/poster.jpg Penetration Testing Requirements by Regulation: A Matrix Which regulations require penetration testing for crypto and financial firms, and how often. DORA, MiCA, NYDFS, VARA, MAS, SFC, HKMA, Kenya, PCI DSS, SOC 2, ISO 27001 and CCSS compared. https://d1ryz0te1mu7pf.cloudfront.net/blog/penetration-testing-requirements-by-regulation/v1/video.mp4 108 2026-11-06T21:15:22+00:00 https://guardian.security/blog/does-soc-2-require-penetration-testing/ https://d1ryz0te1mu7pf.cloudfront.net/blog/does-soc-2-require-penetration-testing/v1/poster.jpg Does SOC 2 Require Penetration Testing? SOC 2 does not mandate a penetration test, but a CC4.1 point of focus names one and buyers often ask for it. This video covers what auditors check, what a crypto pentest scope should include and when to test in a Type 2. https://d1ryz0te1mu7pf.cloudfront.net/blog/does-soc-2-require-penetration-testing/v1/video.mp4 99 2026-11-06T21:22:13+00:00 https://guardian.security/blog/soc-2-cost-crypto/ https://d1ryz0te1mu7pf.cloudfront.net/blog/soc-2-cost-crypto/v2/poster.jpg How Much Does SOC 2 Cost for a Crypto Company? What a first SOC 2 costs in 2026, using published Drata and Scrut figures, and why keys, wallets and onchain operations add to the cost for crypto companies. https://d1ryz0te1mu7pf.cloudfront.net/blog/soc-2-cost-crypto/v2/video.mp4 92 2026-11-08T18:02:20+00:00 https://guardian.security/blog/mdr-vs-incident-response-retainer/ https://d1ryz0te1mu7pf.cloudfront.net/blog/mdr-vs-incident-response-retainer/v1/poster.jpg MDR vs Incident Response Retainer: Which to Buy First MDR or an incident response retainer: what each covers, why onchain speed changes the math, and which a crypto team should buy first at each stage. https://d1ryz0te1mu7pf.cloudfront.net/blog/mdr-vs-incident-response-retainer/v1/video.mp4 103 2026-11-06T20:59:50+00:00 https://guardian.security/blog/cyber-insurance-questionnaire-crypto/ https://d1ryz0te1mu7pf.cloudfront.net/blog/cyber-insurance-questionnaire-crypto/v2/poster.jpg Answering a Cyber Insurance Questionnaire for Crypto Firms What a cyber insurance application asks, what crypto firms get asked on top, and how to answer honestly with dated evidence behind every answer. https://d1ryz0te1mu7pf.cloudfront.net/blog/cyber-insurance-questionnaire-crypto/v2/video.mp4 102 2026-11-08T17:17:04+00:00 https://guardian.security/blog/security-board-report-template/ https://d1ryz0te1mu7pf.cloudfront.net/blog/security-board-report-template/v2/poster.jpg Cybersecurity Board Report Template for Crypto Companies What a crypto company's security report to the board should include: a one-page template, onchain metrics like signer health and hot wallet exposure, and how NYDFS, SEC and NIST CSF 2.0 apply. https://d1ryz0te1mu7pf.cloudfront.net/blog/security-board-report-template/v2/video.mp4 106 2026-11-08T17:30:53+00:00 https://guardian.security/blog/bitlicense-requirements/ https://d1ryz0te1mu7pf.cloudfront.net/blog/bitlicense-requirements/v2/poster.jpg NYDFS BitLicense Requirements: Cybersecurity and Custody How Part 200 and Part 500 cybersecurity duties overlap for BitLicense holders, what the custody rules require, and the testing and custody evidence applicants should prepare. https://d1ryz0te1mu7pf.cloudfront.net/blog/bitlicense-requirements/v2/video.mp4 114 2026-11-08T17:39:21+00:00 https://guardian.security/blog/nydfs-third-party-service-provider/ https://d1ryz0te1mu7pf.cloudfront.net/blog/nydfs-third-party-service-provider/v1/poster.jpg NYDFS Third-Party Service Provider Rules for Crypto Vendors What NYDFS section 500.11 and the October 2025 third-party guidance require of regulated firms that use crypto custodians, wallet platforms and security vendors. https://d1ryz0te1mu7pf.cloudfront.net/blog/nydfs-third-party-service-provider/v1/video.mp4 107 2026-11-06T21:13:41+00:00 https://guardian.security/blog/sec-crypto-custody-proposal/ https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-crypto-custody-proposal/v1/poster.jpg SEC Crypto Custody Rule Proposal: What Advisers Need to Know A security-control reading of the SEC's October 2026 crypto custody proposal: adviser self-custody conditions, state trust company custodians, and the key controls to test before comments close December 7. https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-crypto-custody-proposal/v1/video.mp4 108 2026-11-06T21:20:21+00:00 https://guardian.security/blog/hkma-stablecoin-licence-requirements/ https://d1ryz0te1mu7pf.cloudfront.net/blog/hkma-stablecoin-licence-requirements/v2/poster.jpg HKMA Stablecoin Licence: Technical and Security Requirements A short explainer on the HKMA stablecoin licence: what the supervisory guideline expects for smart contract audits, mint and burn controls, air-gapped keys and resilience testing. https://d1ryz0te1mu7pf.cloudfront.net/blog/hkma-stablecoin-licence-requirements/v2/video.mp4 100 2026-11-08T17:26:11+00:00 https://guardian.security/blog/mas-trm-guidelines-checklist/ https://d1ryz0te1mu7pf.cloudfront.net/blog/mas-trm-guidelines-checklist/v2/poster.jpg MAS TRM Guidelines Checklist for Crypto and Fintech Firms A short guide to the MAS TRM Guidelines for crypto firms. It covers the binding Notices, one-hour incident reporting, DTSP licensing checks and a checklist of crypto examples for each chapter. https://d1ryz0te1mu7pf.cloudfront.net/blog/mas-trm-guidelines-checklist/v2/video.mp4 112 2026-11-08T17:23:05+00:00 https://guardian.security/blog/basel-cryptoasset-standard-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/basel-cryptoasset-standard-explained/v1/poster.jpg Basel Crypto Standard Explained: Groups 1a, 1b, 2a and 2b How Basel's SCO60 standard sorts crypto exposures into Groups 1a, 1b, 2a and 2b, the four Group 1 conditions, and the security evidence banks need to back up each classification. https://d1ryz0te1mu7pf.cloudfront.net/blog/basel-cryptoasset-standard-explained/v1/video.mp4 108 2026-11-06T20:58:21+00:00 https://guardian.security/blog/dora-article-30-contractual-requirements/ https://d1ryz0te1mu7pf.cloudfront.net/blog/dora-article-30-contractual-requirements/v2/poster.jpg DORA Article 30 Contractual Requirements: Vendor Clause Checklist A vendor-side checklist of DORA Article 30 contract clauses. It covers the nine terms every ICT contract needs, the six added for critical or important functions, and the subcontracting rules. https://d1ryz0te1mu7pf.cloudfront.net/blog/dora-article-30-contractual-requirements/v2/video.mp4 106 2026-11-08T17:02:04+00:00 https://guardian.security/blog/mixin-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/mixin-hack-explained/v1/poster.jpg The Mixin Hack Explained: A $200M Cloud Breach How an attack on Mixin Network's cloud provider involved about $200 million in September 2023, what it shows about key custody and vendors, and what to test. https://d1ryz0te1mu7pf.cloudfront.net/blog/mixin-hack-explained/v1/video.mp4 97 2026-11-07T01:40:55+00:00 https://guardian.security/blog/crypto-com-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-com-hack-explained/v1/poster.jpg The Crypto.com Hack Explained: 2FA Bypass, $34M How withdrawals passed without 2FA on 483 Crypto.com accounts in January 2022, what was lost, and how a WebApp pentest checks server-side 2FA on withdrawal flows. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-com-hack-explained/v1/video.mp4 107 2026-11-07T01:56:41+00:00 https://guardian.security/blog/3commas-api-key-leak-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/3commas-api-key-leak-explained/v1/poster.jpg The 3Commas Hack Explained: Leaked Exchange API Keys How exchange API keys stored by the trading bot platform 3Commas leaked in 2022, what the company confirmed, who reported which losses, and what an API pentest tests. https://d1ryz0te1mu7pf.cloudfront.net/blog/3commas-api-key-leak-explained/v1/video.mp4 97 2026-11-07T01:21:12+00:00 https://guardian.security/blog/thorchain-tss-exploit-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/thorchain-tss-exploit-explained/v1/poster.jpg The THORChain Signing Exploit Explained How a malicious validator drained about 0M from one THORChain vault on May 15, 2026, by leaking key shares through 864 failed signing rounds, and what the exploit teaches. https://d1ryz0te1mu7pf.cloudfront.net/blog/thorchain-tss-exploit-explained/v1/video.mp4 102 2026-11-07T01:55:32+00:00 https://guardian.security/blog/ledger-connect-kit-attack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/ledger-connect-kit-attack-explained/v1/poster.jpg The Ledger Connect Kit Attack Explained How a phished former employee's npm account let an attacker ship a wallet drainer through Ledger Connect Kit in December 2023, what it cost, and the release control lessons. https://d1ryz0te1mu7pf.cloudfront.net/blog/ledger-connect-kit-attack-explained/v1/video.mp4 94 2026-11-07T01:52:42+00:00 https://guardian.security/blog/cyberhaven-extension-attack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/cyberhaven-extension-attack-explained/v1/poster.jpg The Cyberhaven Chrome Extension Attack Explained How a phished OAuth grant let an attacker push a data-stealing Cyberhaven Chrome extension update, and what that path means for wallet extension teams. https://d1ryz0te1mu7pf.cloudfront.net/blog/cyberhaven-extension-attack-explained/v1/video.mp4 102 2026-11-07T01:46:03+00:00 https://guardian.security/blog/cow-swap-dns-hijack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/cow-swap-dns-hijack-explained/v1/poster.jpg The CoW Swap DNS Hijack Explained How an attacker took CoW Swap's cow.fi domain through the .fi registry in April 2026, the six-hour phishing window, the estimated .2M loss and what teams can learn. https://d1ryz0te1mu7pf.cloudfront.net/blog/cow-swap-dns-hijack-explained/v1/video.mp4 100 2026-11-07T01:25:37+00:00 https://guardian.security/blog/ronin-bridge-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/ronin-bridge-hack-explained/v1/poster.jpg The Ronin Bridge Hack Explained: $624M In March 2022, attackers took five of Ronin's nine validator keys and drained about $624M, and no one noticed for six days. This video covers how it happened and the OpSec lessons that follow. https://d1ryz0te1mu7pf.cloudfront.net/blog/ronin-bridge-hack-explained/v1/video.mp4 100 2026-11-07T01:54:25+00:00 https://guardian.security/blog/harmony-bridge-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/harmony-bridge-hack-explained/v1/poster.jpg The Harmony Bridge Hack Explained: 00M Lost Through Two Keys How two compromised keys drained about 00M from Harmony's Horizon bridge in June 2022, who was behind it, and what bridges and multisigs can learn about key custody. https://d1ryz0te1mu7pf.cloudfront.net/blog/harmony-bridge-hack-explained/v1/video.mp4 98 2026-11-07T01:35:54+00:00 https://guardian.security/blog/radiant-capital-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/radiant-capital-hack-explained/v1/poster.jpg The Radiant Capital Hack Explained: $50M How malware from a fake former contractor swapped the transactions three Radiant Capital signers approved in October 2024, draining about $50M, and the lessons for multisig signers. https://d1ryz0te1mu7pf.cloudfront.net/blog/radiant-capital-hack-explained/v1/video.mp4 99 2026-11-07T01:37:35+00:00 https://guardian.security/blog/liquid-network-exploit-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/liquid-network-exploit-explained/v1/poster.jpg The Liquid Network Exploit Explained How a cache bug in Elements, Liquid's node software, let an attacker mint about 4,000 unbacked L-BTC and peg out 3,996 BTC, with the timeline and the testing lessons. https://d1ryz0te1mu7pf.cloudfront.net/blog/liquid-network-exploit-explained/v1/video.mp4 98 2026-11-07T01:34:26+00:00 https://guardian.security/blog/cetus-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/cetus-hack-explained/v1/poster.jpg The Cetus Hack on Sui Explained: A Faulty Overflow Check How a faulty overflow check in the integer-mate math library let an attacker drain about $223M from Cetus on Sui, and how to test the libraries your contracts trust. https://d1ryz0te1mu7pf.cloudfront.net/blog/cetus-hack-explained/v1/video.mp4 98 2026-11-07T01:33:31+00:00 https://guardian.security/blog/truebit-exploit-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/truebit-exploit-explained/v1/poster.jpg The Truebit Exploit Explained: Legacy Code, $26M An integer overflow in Truebit's 2021 purchase contract let an attacker mint TRU for free and drain 8,535 ETH. This video covers how it happened and what to check in legacy contracts. https://d1ryz0te1mu7pf.cloudfront.net/blog/truebit-exploit-explained/v1/video.mp4 101 2026-11-07T01:33:45+00:00 https://guardian.security/blog/polymarket-third-party-script-attack/ https://d1ryz0te1mu7pf.cloudfront.net/blog/polymarket-third-party-script-attack/v1/poster.jpg The Polymarket Hack Explained: A Third-Party Script How a replaced third-party script on polymarket.com used logged-in sessions to sell positions and move funds in October 2026, and the controls that block or catch such a swap. https://d1ryz0te1mu7pf.cloudfront.net/blog/polymarket-third-party-script-attack/v1/video.mp4 102 2026-11-07T01:53:20+00:00 https://guardian.security/blog/predict-fun-docs-site-attack/ https://d1ryz0te1mu7pf.cloudfront.net/blog/predict-fun-docs-site-attack/v1/poster.jpg The Predict.fun Hack Explained: A Third-Party Docs Site How about 400,000 USDT left Predict.fun users' wallets in October 2026, why a third-party-hosted docs site is the preliminary lead, and what remains unconfirmed. https://d1ryz0te1mu7pf.cloudfront.net/blog/predict-fun-docs-site-attack/v1/video.mp4 103 2026-11-07T01:53:47+00:00 https://guardian.security/blog/resolv-usr-exploit-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/resolv-usr-exploit-explained/v1/poster.jpg The Resolv USR Exploit Explained How attackers reached Resolv's USR minting key through a contractor's GitHub credential, minted 80M unbacked USR and took about $25M, and the checks that limit a key-based mint. https://d1ryz0te1mu7pf.cloudfront.net/blog/resolv-usr-exploit-explained/v1/video.mp4 105 2026-11-07T01:57:58+00:00 https://guardian.security/blog/near-intents-exploit-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/near-intents-exploit-explained/v1/poster.jpg The NEAR Intents Exploit Explained How failed deposit notifications let an attacker withdraw $3.8M from NEAR Intents, why monitoring missed it for about 40 hours, and the checks that close the gap. https://d1ryz0te1mu7pf.cloudfront.net/blog/near-intents-exploit-explained/v1/video.mp4 99 2026-11-07T01:51:14+00:00 https://guardian.security/blog/cosmos-evm-exploit-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/cosmos-evm-exploit-explained/v1/poster.jpg The Cosmos EVM Exploit Explained: One Bug, Six Chains How a balance underflow in shared Cosmos EVM code was exploited on six chains in August 2026, three months after a public fix, and what Cosmos EVM chains should check. https://d1ryz0te1mu7pf.cloudfront.net/blog/cosmos-evm-exploit-explained/v1/video.mp4 93 2026-11-07T01:30:35+00:00 https://guardian.security/blog/ledger-ethereum-app-signing-flaw/ https://d1ryz0te1mu7pf.cloudfront.net/blog/ledger-ethereum-app-signing-flaw/v1/poster.jpg Ledger Ethereum App Signing Flaw Explained How a race condition in Ledger's Secure SDK let a host change what the device signed, how Ethereum app 1.22.2 fixed it, and what multisig signer teams should check. https://d1ryz0te1mu7pf.cloudfront.net/blog/ledger-ethereum-app-signing-flaw/v1/video.mp4 94 2026-11-07T01:24:42+00:00 https://guardian.security/blog/linux-kernel-cve-solana-validators/ https://d1ryz0te1mu7pf.cloudfront.net/blog/linux-kernel-cve-solana-validators/v1/poster.jpg Linux Kernel CVE-2026-98432: Why Solana Validators Were Warned Why Anza and the Solana Foundation warned validators about CVE-2026-98432, a 9.8-rated Linux kernel flaw in IPv4 TCP, plus the interim guidance and what operators should check. https://d1ryz0te1mu7pf.cloudfront.net/blog/linux-kernel-cve-solana-validators/v1/video.mp4 105 2026-11-07T01:19:02+00:00 https://guardian.security/blog/php2shell-vulnerability-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/php2shell-vulnerability-explained/v1/poster.jpg PHP2Shell Explained: Targeted Before the Patch PHP2Shell explained: two critical PHP flaws that allow unauthenticated remote code execution, how they work, how fast attackers moved, and what to patch now. https://d1ryz0te1mu7pf.cloudfront.net/blog/php2shell-vulnerability-explained/v1/video.mp4 105 2026-11-07T01:29:44+00:00 https://guardian.security/blog/axios-npm-attack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/axios-npm-attack-explained/v1/poster.jpg The axios npm compromise explained How two axios releases on March 31, 2026 installed a remote access trojan through a hijacked maintainer account, who was exposed in the three-hour window, and what teams should check. https://d1ryz0te1mu7pf.cloudfront.net/blog/axios-npm-attack-explained/v1/video.mp4 103 2026-11-07T01:29:47+00:00 https://guardian.security/blog/react2shell-cve-2025-55182-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/react2shell-cve-2025-55182-explained/v1/poster.jpg React2Shell (CVE-2025-55182) Explained React2Shell (CVE-2025-55182) let one unauthenticated request run code on servers using React Server Components. This video covers how it worked, who was exposed, the timeline and how to check your app. https://d1ryz0te1mu7pf.cloudfront.net/blog/react2shell-cve-2025-55182-explained/v1/video.mp4 106 2026-11-07T01:51:43+00:00 https://guardian.security/blog/tj-actions-changed-files-compromise/ https://d1ryz0te1mu7pf.cloudfront.net/blog/tj-actions-changed-files-compromise/v1/poster.jpg The tj-actions/changed-files Compromise Explained How stolen tokens let attackers repoint tj-actions/changed-files, a GitHub Action used in over 23,000 repositories, to leak CI secrets into build logs, and what to check now. https://d1ryz0te1mu7pf.cloudfront.net/blog/tj-actions-changed-files-compromise/v1/video.mp4 100 2026-11-07T01:09:32+00:00 https://guardian.security/blog/nextjs-middleware-bypass-cve-2025-29927/ https://d1ryz0te1mu7pf.cloudfront.net/blog/nextjs-middleware-bypass-cve-2025-29927/v1/poster.jpg Next.js Middleware Bypass (CVE-2025-29927) Explained How CVE-2025-29927 let one internal header skip authorization in Next.js middleware, which deployments were exposed, and how to check your app. https://d1ryz0te1mu7pf.cloudfront.net/blog/nextjs-middleware-bypass-cve-2025-29927/v1/video.mp4 107 2026-11-07T01:08:27+00:00 https://guardian.security/blog/openssh-regresshion-cve-2024-6387/ https://d1ryz0te1mu7pf.cloudfront.net/blog/openssh-regresshion-cve-2024-6387/v1/poster.jpg OpenSSH regreSSHion (CVE-2024-6387) explained A short explainer on regreSSHion, CVE-2024-6387. It covers the OpenSSH race condition that can give unauthenticated attackers root on glibc-based Linux, which versions are affected, what it meant for validators and what to check. https://d1ryz0te1mu7pf.cloudfront.net/blog/openssh-regresshion-cve-2024-6387/v1/video.mp4 106 2026-11-07T01:15:37+00:00 https://guardian.security/blog/solana-web3js-backdoor-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/solana-web3js-backdoor-explained/v1/poster.jpg The @solana/web3.js Backdoor Explained How a phished npm login let an attacker publish key-stealing @solana/web3.js versions 1.95.6 and 1.95.7, plus the timeline, loss estimates and the lessons for SDK teams. https://d1ryz0te1mu7pf.cloudfront.net/blog/solana-web3js-backdoor-explained/v1/video.mp4 107 2026-11-07T01:20:08+00:00 https://guardian.security/blog/chalk-debug-npm-attack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/chalk-debug-npm-attack-explained/v1/poster.jpg The chalk and debug npm compromise explained A phished maintainer account let attackers publish chalk, debug and other npm packages with a browser crypto-clipper on September 8, 2025. This video covers how the attack worked, how narrow the exposure was, and what teams should check now. https://d1ryz0te1mu7pf.cloudfront.net/blog/chalk-debug-npm-attack-explained/v1/video.mp4 101 2026-11-07T01:21:12+00:00 https://guardian.security/blog/bigone-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/bigone-hack-explained/v1/poster.jpg The BigONE Hack Explained: $27M, No Keys Leaked In July 2025, a supply chain attack altered BigONE's account and risk-control servers and drained about $27 million from its hot wallet. No private keys leaked. https://d1ryz0te1mu7pf.cloudfront.net/blog/bigone-hack-explained/v1/video.mp4 91 2026-11-07T01:41:43+00:00 https://guardian.security/blog/upbit-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/upbit-hack-explained/v1/poster.jpg The Upbit Hack Explained: A Solana Hot Wallet Drained How about 44.5 billion won left Upbit's Solana hot wallet in November 2025, the three unconfirmed explanations on record, and the lessons for exchange key custody. https://d1ryz0te1mu7pf.cloudfront.net/blog/upbit-hack-explained/v1/video.mp4 97 2026-11-07T01:55:54+00:00 https://guardian.security/blog/badgerdao-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/badgerdao-hack-explained/v1/poster.jpg The BadgerDAO Hack Explained: An Injected Script How a script injected into BadgerDAO's web app through unauthorized Cloudflare API keys drained 20M to 30M in 2021, and the checks that can catch it. https://d1ryz0te1mu7pf.cloudfront.net/blog/badgerdao-hack-explained/v1/video.mp4 93 2026-11-07T01:56:53+00:00 https://guardian.security/blog/curve-dns-hijack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/curve-dns-hijack-explained/v1/poster.jpg The Curve Finance DNS Hijack Explained How the August 9, 2022 Curve Finance DNS hijack sent users to a cloned site, what Curve and its registrar said, the 340 ETH loss, and what teams with a web front end should check. https://d1ryz0te1mu7pf.cloudfront.net/blog/curve-dns-hijack-explained/v1/video.mp4 99 2026-11-07T01:45:37+00:00 https://guardian.security/blog/lottiefiles-lottie-player-attack/ https://d1ryz0te1mu7pf.cloudfront.net/blog/lottiefiles-lottie-player-attack/v1/poster.jpg The Lottie Player Supply Chain Attack Explained How a stolen developer token put a wallet drainer into lottie-player 2.0.5 to 2.0.7 in October 2024, who was hit, and the frontend checks that catch it. https://d1ryz0te1mu7pf.cloudfront.net/blog/lottiefiles-lottie-player-attack/v1/video.mp4 107 2026-11-07T01:10:30+00:00 https://guardian.security/blog/swissborg-kiln-api-exploit-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/swissborg-kiln-api-exploit-explained/v1/poster.jpg The SwissBorg Hack Explained: A Compromised Staking API How a compromised Kiln staking API led to SwissBorg's reported loss of about 192,600 SOL in September 2025, what each company published, and what teams should check before signing. https://d1ryz0te1mu7pf.cloudfront.net/blog/swissborg-kiln-api-exploit-explained/v1/video.mp4 103 2026-11-07T01:19:04+00:00 https://guardian.security/blog/kraken-deposit-bug-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/kraken-deposit-bug-explained/v1/poster.jpg The Kraken Deposit Bug Exploit Explained: Nearly $3M How a Kraken UX change credited deposits before they cleared, letting accounts withdraw nearly $3M in June 2024, the dispute with CertiK, and what pentests check in deposit flows. https://d1ryz0te1mu7pf.cloudfront.net/blog/kraken-deposit-bug-explained/v1/video.mp4 97 2026-11-07T01:52:15+00:00 https://guardian.security/blog/ledger-2020-data-breach-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/ledger-2020-data-breach-explained/v1/poster.jpg The Ledger 2020 Data Breach Explained How one API key exposed Ledger customer data in 2020: the timeline, what leaked in December, the harm to customers, and what an API pentest checks. https://d1ryz0te1mu7pf.cloudfront.net/blog/ledger-2020-data-breach-explained/v1/video.mp4 97 2026-11-07T01:23:31+00:00 https://guardian.security/blog/xrpl-js-backdoor-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/xrpl-js-backdoor-explained/v1/poster.jpg The xrpl.js Backdoor Explained How a phished npm login let an attacker publish five xrpl.js versions that sent wallet seeds and keys to the attacker, with the timeline, the impact and the lessons for SDK release control. https://d1ryz0te1mu7pf.cloudfront.net/blog/xrpl-js-backdoor-explained/v1/video.mp4 100 2026-11-07T01:20:07+00:00 https://guardian.security/blog/trust-wallet-extension-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/trust-wallet-extension-hack-explained/v1/poster.jpg The Trust Wallet Extension Hack Explained How a Chrome Web Store API key, leaked in an attack Trust Wallet links to Sha1-Hulud, let an attacker ship a backdoored extension that drained 2,520 addresses. Also covers the controls that block that path. https://d1ryz0te1mu7pf.cloudfront.net/blog/trust-wallet-extension-hack-explained/v1/video.mp4 99 2026-11-07T01:57:48+00:00 https://guardian.security/blog/greedybear-fake-wallet-extensions/ https://d1ryz0te1mu7pf.cloudfront.net/blog/greedybear-fake-wallet-extensions/v1/poster.jpg GreedyBear: 150 Fake Crypto Wallet Extensions Explained How GreedyBear's 150 Firefox add-ons passed review as harmless tools, became fake MetaMask, TronLink and Rabby wallets, and stole about M. Includes checks for wallet teams. https://d1ryz0te1mu7pf.cloudfront.net/blog/greedybear-fake-wallet-extensions/v1/video.mp4 98 2026-11-07T01:50:12+00:00 https://guardian.security/blog/metamask-demonic-vulnerability-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/metamask-demonic-vulnerability-explained/v1/poster.jpg The MetaMask Demonic Vulnerability Explained How the Demonic vulnerability in MetaMask, CVE-2022-32969, let browsers save a recovery phrase to disk in plain text, how MetaMask fixed it and what wallet teams should test. https://d1ryz0te1mu7pf.cloudfront.net/blog/metamask-demonic-vulnerability-explained/v1/video.mp4 105 2026-11-07T01:54:52+00:00 https://guardian.security/blog/wintermute-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/wintermute-hack-explained/v1/poster.jpg The Wintermute Hack Explained: 60M In September 2022, a hot wallet key that was likely made with Profanity cost Wintermute about 60M. The key had been emptied of ether but was still a vault admin. This video covers how it happened and what to check on your own bot keys. https://d1ryz0te1mu7pf.cloudfront.net/blog/wintermute-hack-explained/v1/video.mp4 97 2026-11-07T01:40:52+00:00 https://guardian.security/blog/orbit-bridge-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/orbit-bridge-hack-explained/v1/poster.jpg The Orbit Bridge Hack Explained: $81.5M How about $81.5M left Orbit Bridge's Ethereum vault on December 31, 2023, the three unconfirmed explanations on record, and the signer checks any bridge team can run. https://d1ryz0te1mu7pf.cloudfront.net/blog/orbit-bridge-hack-explained/v1/video.mp4 102 2026-11-07T01:49:37+00:00 https://guardian.security/blog/is-usdc-safe/ https://d1ryz0te1mu7pf.cloudfront.net/blog/is-usdc-safe/v1/poster.jpg Is USDC Safe to Hold? Reserves, Freezes and Controls A short explainer on USDC risk: Circle's reserves and Deloitte examination, Circle's freeze and upgrade powers, the 2023 SVB depeg, and USDC's GENIUS Act and MiCA status. https://d1ryz0te1mu7pf.cloudfront.net/blog/is-usdc-safe/v1/video.mp4 109 2026-11-07T03:22:43+00:00 https://guardian.security/blog/usdc-vs-usdt-for-business/ https://d1ryz0te1mu7pf.cloudfront.net/blog/usdc-vs-usdt-for-business/v1/poster.jpg USDC vs USDT: Which Is Safer for Business? A side by side look at USDC and USDT for fintech treasury and product teams. It covers regulation, reserves, freeze policies, contract behavior, chains and redemption. https://d1ryz0te1mu7pf.cloudfront.net/blog/usdc-vs-usdt-for-business/v1/video.mp4 103 2026-11-06T23:43:37+00:00 https://guardian.security/blog/will-ai-replace-smart-contract-auditors/ https://d1ryz0te1mu7pf.cloudfront.net/blog/will-ai-replace-smart-contract-auditors/v1/poster.jpg Will AI Replace Smart Contract Auditors? What EVMbench, a BlockSec retest, Nethermind and Anthropic show about what AI agents find, miss and exploit, and why human auditors still matter. https://d1ryz0te1mu7pf.cloudfront.net/blog/will-ai-replace-smart-contract-auditors/v1/video.mp4 120 2026-11-06T23:29:30+00:00 https://guardian.security/blog/biggest-crypto-hacks-2026/ https://d1ryz0te1mu7pf.cloudfront.net/blog/biggest-crypto-hacks-2026/v1/poster.jpg The Biggest Crypto Hacks of 2026 So Far, Ranked The 15 largest crypto hacks of 2026 so far, ranked from DefiLlama data. Binance leads at about $6.36 billion, and most losses came through keys and signers, not contract code. https://d1ryz0te1mu7pf.cloudfront.net/blog/biggest-crypto-hacks-2026/v1/video.mp4 101 2026-11-06T23:13:33+00:00 https://guardian.security/blog/october-10-crypto-liquidation-cascade/ https://d1ryz0te1mu7pf.cloudfront.net/blog/october-10-crypto-liquidation-cascade/v2/poster.jpg Binance October 10 Crash: Pricing, Depegs and the Cascade How a tariff shock, own-book collateral pricing and auto-deleveraging combined in the October 10, 2025 crypto liquidation cascade, and what risk engines should learn from it. https://d1ryz0te1mu7pf.cloudfront.net/blog/october-10-crypto-liquidation-cascade/v2/video.mp4 97 2026-11-08T17:34:10+00:00 https://guardian.security/blog/bitfinex-hack-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/bitfinex-hack-explained/v1/poster.jpg Bitfinex Hack Explained: The 2016 Theft and the Recovery How about 119,754 BTC left Bitfinex's BitGo multisig wallets in 2016, how agents seized about 94,636 BTC in 2022, and the signing-policy lessons for multisig custody. https://d1ryz0te1mu7pf.cloudfront.net/blog/bitfinex-hack-explained/v1/video.mp4 99 2026-11-06T23:40:42+00:00 https://guardian.security/blog/equity-perps-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/equity-perps-explained/v1/poster.jpg Equity Perps Explained: How Stock Perps Work and Break Equity perps are perpetual futures on stocks, ETFs and indexes that trade around the clock. This video covers how they are priced when markets close, how they fail, and where they stand with US regulators. https://d1ryz0te1mu7pf.cloudfront.net/blog/equity-perps-explained/v1/video.mp4 112 2026-11-06T23:42:45+00:00 https://guardian.security/blog/auto-deleveraging-explained/ https://d1ryz0te1mu7pf.cloudfront.net/blog/auto-deleveraging-explained/v1/poster.jpg Auto-Deleveraging (ADL) Explained: How Perps Share Losses What auto-deleveraging is, when it triggers, how Binance, Hyperliquid, Lighter and GMX V2 rank positions, and where ADL logic fails in audits and live cascades. https://d1ryz0te1mu7pf.cloudfront.net/blog/auto-deleveraging-explained/v1/video.mp4 104 2026-11-07T03:21:52+00:00 https://guardian.security/blog/stablecoin-chains-security-comparison/ https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-chains-security-comparison/v1/poster.jpg Best Blockchains for Stablecoins: Security Compared A security comparison of stablecoin chains, including Ethereum, Tron, Arc, Tempo and Plasma, on finality, validators, freeze controls, bridge exposure and track record. https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-chains-security-comparison/v1/video.mp4 101 2026-11-06T23:44:20+00:00 https://guardian.security/blog/monad-vs-ethereum-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/monad-vs-ethereum-security/v1/poster.jpg Monad vs Ethereum: Contract Differences That Affect Security Monad runs Ethereum bytecode but does not behave identically. This video covers gas charged on the limit, repriced opcodes, EIP-7702 rules, finality and what to retest before porting. https://d1ryz0te1mu7pf.cloudfront.net/blog/monad-vs-ethereum-security/v1/video.mp4 106 2026-11-06T23:21:12+00:00 https://guardian.security/blog/glamsterdam-upgrade-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/glamsterdam-upgrade-security/v1/poster.jpg Glamsterdam Upgrade: What Changes for Ethereum Security Ethereum's Glamsterdam upgrade explained for security teams: ePBS, the proposed gas repricing that breaks old contract assumptions, its current status and what to check before mainnet. https://d1ryz0te1mu7pf.cloudfront.net/blog/glamsterdam-upgrade-security/v1/video.mp4 105 2026-11-07T03:17:21+00:00 https://guardian.security/blog/best-smart-contract-ctfs/ https://d1ryz0te1mu7pf.cloudfront.net/blog/best-smart-contract-ctfs/v1/poster.jpg Best Blockchain CTF Challenges for Aspiring Auditors The best blockchain CTFs for practicing smart contract hacking, from Ethernaut and Damn Vulnerable DeFi to the Paradigm and Remedy archives, ranked by difficulty. https://d1ryz0te1mu7pf.cloudfront.net/blog/best-smart-contract-ctfs/v1/video.mp4 99 2026-11-06T23:30:18+00:00 https://guardian.security/blog/biggest-crypto-bug-bounties/ https://d1ryz0te1mu7pf.cloudfront.net/blog/biggest-crypto-bug-bounties/v1/poster.jpg The Biggest Crypto Bug Bounties Ever Paid Wormhole's 0 million is the largest crypto bug bounty confirmed as paid. This video covers the top payouts, what the bugs were and what they have in common. https://d1ryz0te1mu7pf.cloudfront.net/blog/biggest-crypto-bug-bounties/v1/video.mp4 100 2026-11-07T03:20:44+00:00 https://guardian.security/blog/soc-2-vs-iso-27001-digital-assets/ https://d1ryz0te1mu7pf.cloudfront.net/blog/soc-2-vs-iso-27001-digital-assets/v1/poster.jpg SOC 2 vs ISO 27001 for Digital Asset Firms How SOC 2 and ISO 27001 differ for crypto firms, what US and EU buyers accept under bank guidance and DORA, the crypto controls each covers, costs, and which to get first. https://d1ryz0te1mu7pf.cloudfront.net/blog/soc-2-vs-iso-27001-digital-assets/v1/video.mp4 105 2026-11-07T03:23:46+00:00 https://guardian.security/blog/vara-license-cost/ https://d1ryz0te1mu7pf.cloudfront.net/blog/vara-license-cost/v2/poster.jpg VARA License Cost in Dubai: Fees, Capital and Compliance What a VARA license costs in Dubai: application and supervision fees from Schedule 2, paid-up capital floors, and the pentests and audits VARA requires. https://d1ryz0te1mu7pf.cloudfront.net/blog/vara-license-cost/v2/video.mp4 103 2026-11-08T17:44:26+00:00 https://guardian.security/blog/vara-penetration-testing-smart-contract-audit/ https://d1ryz0te1mu7pf.cloudfront.net/blog/vara-penetration-testing-smart-contract-audit/v1/poster.jpg VARA Penetration Testing and Smart Contract Audit Rules What VARA Rule I.E.1 requires for penetration testing and smart contract audits in Dubai, how often tests must run, who may test, and when VARA can order threat-led testing. https://d1ryz0te1mu7pf.cloudfront.net/blog/vara-penetration-testing-smart-contract-audit/v1/video.mp4 97 2026-11-06T23:26:02+00:00 https://guardian.security/blog/how-to-prepare-for-a-penetration-test/ https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-prepare-for-a-penetration-test/v1/poster.jpg How to Prepare for a Penetration Test: A Crypto Checklist A crypto team's checklist for pentest prep: scope and rules of engagement, test accounts, testnet funds and test keys, environments, monitoring, communication and handling results. https://d1ryz0te1mu7pf.cloudfront.net/blog/how-to-prepare-for-a-penetration-test/v1/video.mp4 102 2026-11-06T23:04:12+00:00 https://guardian.security/blog/pentest-executive-summary-example/ https://d1ryz0te1mu7pf.cloudfront.net/blog/pentest-executive-summary-example/v1/poster.jpg Pentest Executive Summary Example and Template What a pentest executive summary should say, shown with a worked example for a fictional crypto exchange, plus the common mistakes to avoid. https://d1ryz0te1mu7pf.cloudfront.net/blog/pentest-executive-summary-example/v1/video.mp4 86 2026-11-06T23:04:07+00:00 https://guardian.security/blog/web3-sdk-security-audit/ https://d1ryz0te1mu7pf.cloudfront.net/blog/web3-sdk-security-audit/v1/poster.jpg Web3 SDK Security Testing: How to Audit a Wallet SDK How to security test a web3 wallet or dApp SDK: transaction construction, key handling, RPC trust, dependencies and release control, with lessons from real npm compromises. https://d1ryz0te1mu7pf.cloudfront.net/blog/web3-sdk-security-audit/v1/video.mp4 101 2026-11-06T23:10:28+00:00 https://guardian.security/blog/offchain-automation-pentest/ https://d1ryz0te1mu7pf.cloudfront.net/blog/offchain-automation-pentest/v1/poster.jpg Offchain Automation Pentest: Keepers, Relayers and Bots What an offchain automation pentest covers for DeFi keepers, relayers and bots: key custody, signer sets, inputs and replay, cloud and alerting, with findings from Guardian's GMX and Avantis reviews. https://d1ryz0te1mu7pf.cloudfront.net/blog/offchain-automation-pentest/v1/video.mp4 105 2026-11-06T23:07:17+00:00 https://guardian.security/blog/security-trust-center-crypto/ https://d1ryz0te1mu7pf.cloudfront.net/blog/security-trust-center-crypto/v1/poster.jpg What Is a Security Trust Center? A Guide for Crypto Firms What a security trust center is, what crypto and fintech firms should publish or gate, what to keep off it, and how to keep it current for institutional buyers. https://d1ryz0te1mu7pf.cloudfront.net/blog/security-trust-center-crypto/v1/video.mp4 101 2026-11-07T03:18:29+00:00 https://guardian.security/blog/smart-contract-audit-grants-2026/ https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-audit-grants-2026/v1/poster.jpg Smart Contract Audit Grants and Subsidy Programs in 2026 A dated list of smart contract audit grants and subsidies active on November 6, 2026, covering Ethereum, Solana, Uniswap, Arbitrum, Stellar and auditor-funded grants, including Guardian's M program. https://d1ryz0te1mu7pf.cloudfront.net/blog/smart-contract-audit-grants-2026/v1/video.mp4 92 2026-11-06T23:30:27+00:00 https://guardian.security/blog/family-office-security-audit/ https://d1ryz0te1mu7pf.cloudfront.net/blog/family-office-security-audit/v1/poster.jpg Security Audit for a Family Office: A Crypto Checklist What a security audit for a family office holding crypto covers: custody, key ceremonies, signer devices, people, email and phone takeover, physical risk, vendors and incident plans. https://d1ryz0te1mu7pf.cloudfront.net/blog/family-office-security-audit/v1/video.mp4 105 2026-11-06T23:16:36+00:00 https://guardian.security/blog/handling-critical-bug-report-live-protocol/ https://d1ryz0te1mu7pf.cloudfront.net/blog/handling-critical-bug-report-live-protocol/v1/poster.jpg Vulnerability Triage for a Critical Bug in Live Contracts How a protocol should handle a critical bug report on live contracts: acknowledge, reproduce on a fork, contain quietly, fix privately, pay the reporter and disclose. https://d1ryz0te1mu7pf.cloudfront.net/blog/handling-critical-bug-report-live-protocol/v1/video.mp4 102 2026-11-06T23:41:30+00:00 https://guardian.security/blog/crypto-incident-reporting-requirements/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-incident-reporting-requirements/v2/poster.jpg Crypto Incident Reporting Requirements by Jurisdiction A side by side look at crypto incident reporting deadlines in the EU, UK, US, UAE, Asia and Africa: what starts each clock, how long it runs, and how to build one playbook. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-incident-reporting-requirements/v2/video.mp4 100 2026-11-08T17:13:49+00:00 https://guardian.security/blog/california-dfal/ https://d1ryz0te1mu7pf.cloudfront.net/blog/california-dfal/v2/poster.jpg California DFAL License: Who Needs One and What It Requires Who needs a California DFAL license after July 1, 2026, what SB 97 changed, and the security, custody and evidence requirements the DFPI expects from licensees. https://d1ryz0te1mu7pf.cloudfront.net/blog/california-dfal/v2/video.mp4 110 2026-11-08T17:39:23+00:00 https://guardian.security/blog/fca-crypto-authorisation-gateway/ https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-crypto-authorisation-gateway/v2/poster.jpg FCA Crypto Authorisation Gateway: Security Checklist The FCA crypto authorisation gateway closes February 28, 2027. This video covers the IT, operational resilience and key custody evidence the FCA's own application forms ask for. https://d1ryz0te1mu7pf.cloudfront.net/blog/fca-crypto-authorisation-gateway/v2/video.mp4 108 2026-11-08T17:03:16+00:00 https://guardian.security/blog/occ-crypto-guidance-controls/ https://d1ryz0te1mu7pf.cloudfront.net/blog/occ-crypto-guidance-controls/v1/poster.jpg OCC Crypto Guidance: Bank Activities and Expected Controls A letter by letter look at what the OCC lets national banks do with crypto, from IL 1170 to IL 1188, and the key, custody and sub-custodian controls examiners look for. https://d1ryz0te1mu7pf.cloudfront.net/blog/occ-crypto-guidance-controls/v1/video.mp4 89 2026-11-06T23:31:19+00:00 https://guardian.security/blog/occ-national-trust-charter-crypto/ https://d1ryz0te1mu7pf.cloudfront.net/blog/occ-national-trust-charter-crypto/v2/poster.jpg OCC Crypto Trust Charters: Who Holds One and What It Takes Which crypto firms hold or were approved for an OCC national trust charter, and the security, IT, people, capital and liquidity conditions the OCC attaches. https://d1ryz0te1mu7pf.cloudfront.net/blog/occ-national-trust-charter-crypto/v2/video.mp4 107 2026-11-08T17:32:35+00:00 https://guardian.security/blog/sec-token-taxonomy/ https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-token-taxonomy/v2/poster.jpg SEC Token Taxonomy: The Five Crypto Asset Categories The SEC's March 2026 interpretation sorts crypto assets into five categories. This video covers what each category means, when an investment contract attaches, and why admin keys and control facts matter. https://d1ryz0te1mu7pf.cloudfront.net/blog/sec-token-taxonomy/v2/video.mp4 104 2026-11-08T17:29:14+00:00 https://guardian.security/blog/ciro-digital-asset-custody-framework/ https://d1ryz0te1mu7pf.cloudfront.net/blog/ciro-digital-asset-custody-framework/v1/poster.jpg CIRO Crypto Custody Framework: Tiers, Limits and Evidence CIRO's Digital Asset Custody Framework explained: four custodian tiers capped from 100% to 40%, the 20% internal custody limit, and the security evidence behind tier placement. https://d1ryz0te1mu7pf.cloudfront.net/blog/ciro-digital-asset-custody-framework/v1/video.mp4 103 2026-11-06T23:18:57+00:00 https://guardian.security/blog/third-party-wallet-provider-rules-asia-pacific/ https://d1ryz0te1mu7pf.cloudfront.net/blog/third-party-wallet-provider-rules-asia-pacific/v1/poster.jpg Third-Party Wallet Providers: Asia-Pacific Rules Compared How Hong Kong, Japan, Australia and Pakistan now reach third-party wallet providers through code reviews, prior notification, custodian monitoring, SOC 2 Type II and audit rights. https://d1ryz0te1mu7pf.cloudfront.net/blog/third-party-wallet-provider-rules-asia-pacific/v1/video.mp4 102 2026-11-06T23:18:57+00:00 https://guardian.security/blog/tokenized-deposits-vs-stablecoins-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/tokenized-deposits-vs-stablecoins-security/v1/poster.jpg Tokenized Deposits vs Stablecoins: A Security Comparison A security comparison of tokenized deposits and stablecoins for banks: the legal claim, who holds the mint, freeze and upgrade keys, which chain carries them, and the attack surface. https://d1ryz0te1mu7pf.cloudfront.net/blog/tokenized-deposits-vs-stablecoins-security/v1/video.mp4 97 2026-11-06T23:28:16+00:00 https://guardian.security/blog/stablecoin-cross-border-payments-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-cross-border-payments-security/v1/poster.jpg Stablecoin Cross-Border Payments: Settlement and Security How a stablecoin cross-border payment corridor settles, from on-ramp to onchain transfer to off-ramp, and the security and compliance controls fintechs should own at each leg. https://d1ryz0te1mu7pf.cloudfront.net/blog/stablecoin-cross-border-payments-security/v1/video.mp4 103 2026-11-06T23:17:45+00:00 https://guardian.security/blog/permissioned-vs-permissionless-blockchain-banks/ https://d1ryz0te1mu7pf.cloudfront.net/blog/permissioned-vs-permissionless-blockchain-banks/v1/poster.jpg Permissioned vs Permissionless Blockchains for Banks A threat-model comparison of permissioned and public blockchains for banks, covering trust, threats unique to each model, Basel treatment, hybrid designs and how to choose. https://d1ryz0te1mu7pf.cloudfront.net/blog/permissioned-vs-permissionless-blockchain-banks/v1/video.mp4 96 2026-11-06T23:29:14+00:00 https://guardian.security/blog/bank-crypto-trading-security-architecture/ https://d1ryz0te1mu7pf.cloudfront.net/blog/bank-crypto-trading-security-architecture/v1/poster.jpg Banks Offering Crypto Trading: The Security Architecture A security reference architecture for banks offering crypto trading, covering custody, signing and policy, venue access, surveillance and reconciliation. https://d1ryz0te1mu7pf.cloudfront.net/blog/bank-crypto-trading-security-architecture/v1/video.mp4 91 2026-11-06T23:27:12+00:00 https://guardian.security/blog/crypto-as-a-service-for-banks/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-as-a-service-for-banks/v1/poster.jpg Crypto-as-a-Service for Banks: Build or Buy? Should a bank buy crypto as a service or build its own crypto stack? This video covers what stays with the bank, vendor diligence, New York approvals and a five-question decision framework. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-as-a-service-for-banks/v1/video.mp4 101 2026-11-06T23:23:12+00:00 https://guardian.security/blog/new-product-approval-digital-assets/ https://d1ryz0te1mu7pf.cloudfront.net/blog/new-product-approval-digital-assets/v1/poster.jpg New Product Approval for Digital Assets: Security Gates The security gates a bank should add to its new product approval process for digital assets, from threat models and key custody to audits, pentests and post-launch review. https://d1ryz0te1mu7pf.cloudfront.net/blog/new-product-approval-digital-assets/v1/video.mp4 96 2026-11-06T23:23:11+00:00 https://guardian.security/blog/tokenized-private-credit-risks/ https://d1ryz0te1mu7pf.cloudfront.net/blog/tokenized-private-credit-risks/v2/poster.jpg Tokenized Private Credit Risks: Where Onchain Credit Fails Tokenized private credit carries borrower credit risk plus the token's own risks: manager failures, lagging valuations, redemption gates, limited legal claims, and contract and key risk. https://d1ryz0te1mu7pf.cloudfront.net/blog/tokenized-private-credit-risks/v2/video.mp4 101 2026-11-08T17:42:34+00:00 https://guardian.security/blog/launch-own-blockchain-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/launch-own-blockchain-security/v1/poster.jpg Launching Your Own Blockchain: The Security Decisions A company that launches its own blockchain has to make four security decisions: consensus or sequencing, upgrade and pause keys, the bridge, and infrastructure and incident response. https://d1ryz0te1mu7pf.cloudfront.net/blog/launch-own-blockchain-security/v1/video.mp4 96 2026-11-06T23:24:13+00:00 https://guardian.security/blog/bitcoin-l2-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/bitcoin-l2-security/v2/poster.jpg Bitcoin L2 Security: Trust Models, Bridges and Exits A Bitcoin L2 is as secure as whoever can release its bitcoin. This video compares the trust models behind Liquid, Rootstock, sBTC, BitVM bridges and Lightning, covers their hidden emergency keys and gives a framework for scoring any layer. https://d1ryz0te1mu7pf.cloudfront.net/blog/bitcoin-l2-security/v2/video.mp4 99 2026-11-08T17:37:35+00:00 https://guardian.security/blog/move-smart-contract-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/move-smart-contract-security/v2/poster.jpg Move Smart Contract Security: Guarantees and Common Bugs What Move's resource safety and abilities prevent on Sui and Aptos, the logic, upgrade and bit-shift bugs that still ship, and how Guardian audits Move code. https://d1ryz0te1mu7pf.cloudfront.net/blog/move-smart-contract-security/v2/video.mp4 101 2026-11-08T17:24:35+00:00 https://guardian.security/blog/threat-model-example-defi/ https://d1ryz0te1mu7pf.cloudfront.net/blog/threat-model-example-defi/v1/poster.jpg Threat Model Example for a DeFi Lending Protocol A worked threat model for ExampleLend, a fictional DeFi lender. It covers assets, trust boundaries, STRIDE threats, attack paths and residual risk with named owners. https://d1ryz0te1mu7pf.cloudfront.net/blog/threat-model-example-defi/v1/video.mp4 95 2026-11-06T23:15:23+00:00 https://guardian.security/blog/dao-treasury-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/dao-treasury-security/v1/poster.jpg DAO Treasury Management: How to Secure a Community Treasury How a DAO should secure its treasury: split reserves from operating funds, set high signer thresholds, scope spending limits and Zodiac roles, revoke stale access and monitor every outflow. https://d1ryz0te1mu7pf.cloudfront.net/blog/dao-treasury-security/v1/video.mp4 98 2026-11-06T23:36:12+00:00 https://guardian.security/blog/crypto-key-rotation/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-key-rotation/v1/poster.jpg Key Rotation Best Practices for Crypto Teams When to rotate multisig signers, hot wallet keys, MPC shares and API keys, and how to do it onchain without downtime, based on NIST SP 800-57 and the SEAL runbook. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-key-rotation/v1/video.mp4 94 2026-11-06T23:37:13+00:00 https://guardian.security/blog/ai-trading-agent-security/ https://d1ryz0te1mu7pf.cloudfront.net/blog/ai-trading-agent-security/v1/poster.jpg AI Trading Agent Security: Threat Model and Controls How AI trading agents that hold keys get exploited through injection, stolen access, malicious tools and model errors, and the controls outside the model that contain them. https://d1ryz0te1mu7pf.cloudfront.net/blog/ai-trading-agent-security/v1/video.mp4 104 2026-11-06T23:37:29+00:00 https://guardian.security/blog/crypto-phishing-statistics/ https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-phishing-statistics/v1/poster.jpg Crypto Phishing Statistics 2026: Losses by Year and Method Crypto phishing losses by year and method from ScamSniffer, CertiK, Chainalysis and the FBI, covering Permit scams, address poisoning and the signing controls that stop them. https://d1ryz0te1mu7pf.cloudfront.net/blog/crypto-phishing-statistics/v1/video.mp4 113 2026-11-06T23:12:29+00:00 https://guardian.security/blog/nist-csf-2-controls-list-digital-assets/ https://d1ryz0te1mu7pf.cloudfront.net/blog/nist-csf-2-controls-list-digital-assets/v2/poster.jpg NIST CSF 2.0 Controls List With Digital Asset Mappings NIST CSF 2.0 lists outcomes, not controls: 6 functions, 22 categories and 106 subcategories. This video shows how Guardian maps those outcomes to keys, signing, contract upgrades and onchain monitoring. https://d1ryz0te1mu7pf.cloudfront.net/blog/nist-csf-2-controls-list-digital-assets/v2/video.mp4 104 2026-11-08T17:24:39+00:00 https://guardian.security/blog/audit-vs-attestation-vs-assurance-crypto/ https://d1ryz0te1mu7pf.cloudfront.net/blog/audit-vs-attestation-vs-assurance-crypto/v2/poster.jpg Audit vs Attestation vs Assurance: What Crypto Reports Prove How audits, attestations and assurance reports differ under AICPA and IAASB standards, what Circle's and Tether's reports prove, and why smart contract audits are not assurance. https://d1ryz0te1mu7pf.cloudfront.net/blog/audit-vs-attestation-vs-assurance-crypto/v2/video.mp4 102 2026-11-08T18:12:35+00:00 https://guardian.security/blog/exchange-listing-security-review/ https://d1ryz0te1mu7pf.cloudfront.net/blog/exchange-listing-security-review/v1/poster.jpg CEX Listing Requirements: What the Security Review Checks What exchanges and regulators check before listing a token, from admin powers and audit evidence to supply and bridges, and how token teams can prepare. https://d1ryz0te1mu7pf.cloudfront.net/blog/exchange-listing-security-review/v1/video.mp4 98 2026-11-06T23:17:45+00:00 https://guardian.security/testimonials/ https://guardian.security/careers/ https://guardian.security/roles/role-gsr-1/ https://guardian.security/roles/role-gsr-2/ https://guardian.security/roles/role-gsr-3/ https://guardian.security/roles/role-gsr-4/ https://guardian.security/roles/role-gfe-1/ https://guardian.security/roles/web2-security-engineer/ https://guardian.security/roles/account-executive/ https://guardian.security/roles/vp-of-operations/ https://guardian.security/team/ https://guardian.security/team/owen-thurm/ https://guardian.security/team/daniel-gelfand/ https://guardian.security/team/ashkan-khamsehpour/ https://guardian.security/grants/ https://guardian.security/ecosystem-partners/ https://guardian.security/referral-champions/ https://guardian.security/brand-kit/ https://guardian.security/work-with-us/ https://guardian.security/bounty-contest/ https://guardian.security/privacy/ https://guardian.security/terms/