TW / Independent
Independent security research / Digital

Audits &
Research.

We investigate where digital systems lose their security guarantees. DeFi, crypto and malware — with traceable evidence, not sweeping claims.

Discuss an audit ↗Read the research ↗
Scope / Context / Evidence

Where does
your risk begin?

The security objective defines the review. Select a domain to explore the questions that belong to it.

Evidence over hypeDeFi / Crypto / MalwareScope → Analysis → Report → Retest
Public review record

Research you can inspect.

Every entry states its review record, method, result and limit. Counts come directly from the published archive; private findings and raw samples are excluded.

20public reports
14malware case studies
5DeFi reviews
4open-source tools
Services

The attack surface.
The whole context.

Security audits

A bounded review of protocols, contracts and the systems around them.

  • Agree scope and security objectives
  • Prioritise risks and substantiate findings
  • Remediation and retesting within agreed scope

Defensive malware research

Understand mechanisms without distributing them as attack tools.

  • Analyse behaviour and trust boundaries
  • Evaluate drainer patterns with nuance
  • Derive detection and prevention approaches

Research & technical due diligence

Separate technical substance from marketing.

  • Review architecture and dependencies
  • Make evidence and uncertainty explicit
  • Write understandable decision support
Research standard

A good report also shows
what it cannot prove.

An audit is a time-bounded investigation with a defined scope, not a security guarantee. The journal separates methodology, public tools and substantiated results. Private findings and client details remain private.

Explore the research journal →
DeFi / Research Audits

Five projects.
Documented results.

Assessment of our historical review records. The named projects did not commission these reports as client audits.

ScopeDispositionLimit
STRATO: lending, bridge and balance review ↗

STRATO upquark: lending, CDP, SaveUSDST, classic and yield vaults, pools, oracles, bridge and MetalForge/TokenFactory.

Lending: historical High. Bridge: Medium overall. Critical not established.
Present state and any fixes were not checked. Code examples are defensive models, not STRATO source code.
Low at the snapshot. Medium only conditionally.
The conclusion depends on the evidenced operating state.
Accounting confirmed. Critical not confirmed.
No atomic state snapshot; a relevant strategy source remained unresolved.
Bitflow: accounting and reserve loss assessed separately ↗

Clarity accounting and actual value flows

Accounting bounded. Critical candidate rejected.
The reviewed hypothesis did not support a confirmed Critical.
Titan Locker V2.1: candidate rejected ↗

Locker V2.1, runtime binding and prior-audit comparison

V2.1: no new validated finding.
Candidate rejected; not a full reassessment of the system.
Malware research / 14 case studies

Loader. Stealer.
Ransomware. Evidence chains.

The corpus ranges from original binary analysis to source-bound reconstruction with pinned companion code. Every report separates architecture, runtime observation, detection, attribution and unresolved questions.

ACR Stealer ↗HijackLoader ↗Trigona ↗2CLoader ↗BlueLoader ↗
●Observed

Accessible artifacts and documented interfaces.

◐Interpreted

Similarity does not automatically establish common origin.

○Unresolved

Inaccessible behaviour remains unconfirmed.

Research Audits

Review records
and results.

All audits ↗
Malware AnalysisThreatLabz-Bericht und Begleitwerkzeug, Stand 30. September 2026 · 3 code examples

2CLoader: evasion layer, payload chain and detection points

Technical source review of the configurable Windows loader: resource format, layered decryption, anti-analysis, execution paths, persistence and defensible detection signals.

↗

Start a conversation

Discuss your project.

Start a conversation