Industry
Offensive Security for Crypto & Digital Assets.
Exchanges, custodians, stablecoin issuers and cryptoasset firms move value that can’t be called back. The Swarm attacks your whole organisation the way a real adversary would, across keys, people, code and cloud, so you know what holds before funds move.
THE THREAT.
What would an attacker take from you first?
Most crypto theft doesn’t start by breaking code. In early 2025, private key breaches at centralised services accounted for 88% of stolen funds, and one of the most effective tactics was getting fake hires inside crypto firms (source: Chainalysis). Your attack surface spans the blockchain, through bridges, into cloud configs, developer workflows and your own community.
On-chain there’s no chargeback. Funds move in minutes, withdrawals freeze, and users, partners and the FCA all want answers. You need proof that your keys, people and infrastructure hold, before anyone tests them for real. That’s what the Swarm gives you.
They want your keys.
Hot wallets, signing flows and the infrastructure around them. Whoever controls signing controls the funds, and a transfer can’t be reversed.
They want to join your team.
A fake candidate, a compromised contractor, a recruiter message to an engineer. An insider with access is the shortest route to privileged systems.
They want your users’ trust.
Account takeovers, support impersonation, a hijacked community channel. One incident and users withdraw, partners pause and regulators ask questions.
We attack the paths to your keys.
Attackers watch your commits, scan for leaked keys and wait for the weekend. They chain a message to a developer, an over-permissioned cloud role and a signing process under pressure until they reach the funds. The Swarm works the same way.
Keys and signing
Hot wallets, signing approvals and the devices, rooms and people around them. We test whether someone could reach, trick or bypass the process that moves funds.
People and hiring
Fake candidates, compromised contractors and recruiter approaches to engineers. We test whether an outsider could talk, apply or phish their way into privileged access.
Developer workflows
Repos, CI/CD pipelines, packages and the secrets that leak into them. We test the routes from a developer’s laptop to production.
Cloud and infrastructure
Exposed admin panels, over-permissioned cloud roles and container platforms. We find the misconfiguration that turns one foothold into control of the estate.
Exchange and wallet apps
Web and mobile apps, APIs, login and withdrawal flows. We go after the routes to account takeover and unauthorised withdrawals.
Community and support
Discord and Telegram admins, support desks and social accounts. We test whether an attacker could impersonate your team or take over the channels your users trust.
We know that real attack surfaces don’t come in neat categories. If yours doesn’t fit above, tell us what you’re working with.
The only way to be confident is to face a real attacker.
We become the threat. CovertSwarm gives your exchange, custodian or crypto team a team of elite ethical hackers, augmented by agentic tools, that thinks, acts and strikes like a real attacker.
We attack every route to your keys: a message to a developer, a stranger at your office door, an over-permissioned cloud role. Like a real attacker, we stay fixed on an objective, all within safe boundaries agreed in your Attack Thesis.
Our attacks run in cycles, not on a fixed schedule, and keep pace with your commits, not a quarterly audit cycle. So does your evidence: proof of what held and what broke, every cycle, not one report a year. It complements your audits and supports the evidence your board, partners and the FCA ask for.
Let’s find out.
Constant pressure.
We attack every route to your crown jewels: a call to your service desk, a stranger at a branch door, a weak mobile banking API. Like a real attacker, we stay fixed on an objective, all within safe boundaries agreed in your Attack Thesis.
Continuous attack cycles. No fixed scopes.
Vendors, products and staff change between annual pen tests. Our attacks run in cycles, not on a fixed schedule, and keep pace. So does your evidence: proof of what held and what broke, every cycle, not one report a year. It complements your annual pen test and supports what examiners ask for.
Human experts, augmented by AI.
The Swarm is a team of elite ethical hackers. Agentic tools map your endpoints and third-party connections fast, so humans spend their time chaining weaknesses. You get direct access to the team attacking your brand via Slack.
How it works for crypto & digital assets
Your subscription starts with your Attack Thesis: what matters most, and what adversaries would target first.
It starts with what an attacker would want from you. Could a new contractor reach signing infrastructure? Could a message to a developer lead to a leaked deploy key? Could support be talked into resetting a high-value account?
We agree the objectives and guardrails before anything runs.
Recon
We gather intelligence about your organisation, and prepare to attack key objectives, using both open-source and agentic methods.
New assets enter scope as they emerge.
Qualified findings, not a stream of alerts.
Last cycle's findings direct the next.
OSINT + Agentic reconnaissance
Attack
Based on intelligence or strategic goals, we build and execute custom Attack Plans. We chain weaknesses and exploit every route.
Custom built plans target your actual risk
Chained across digital, physical and social
Led by humans with agentic capability
Point the Swarm at your priorities
Remediate
We notify your team about discovered risks in real-time and provide guided remediation. Get evidence of what held, and what needs work.
You're notified while the risk is live
Guidance in Slack and Jira
Findings inform the next attack cycle
Direct access to the Swarm
Want to know what an attacker would find, before your examiners ask?
What a Finding Looks Like
Example: Cloud platform finding
Critical
Finding
Starting from a free trial account, a Swarm operator pulled a custom container from a public registry into the platform, then used the API to run it with a privileged security context.
Impact
Escape to the underlying node, then a service account token able to read secrets across the whole Kubernetes cluster, including kube-system. Separately, a sales demo yielded credentials to the company's Google Workspace.
Remediation
Block pulls from untrusted registries, deny privileged containers by policy, and scope service account tokens so no workload can read cluster-wide secrets.
Board impact
A free trial built to win customers handed an attacker the environment's secrets. In a crypto business, secrets like these can include the credentials that move funds.
Technical impact
External registry pulls were allowed, privileged containers could be requested through the API, and a pod's service account had cluster-wide secret read access. Container escape led to full control of the demo environment.
Want the full picture?
The full range of offensive security the Swarm runs: every discipline, how they connect, and what each one tests.
No form fill required.
Proof your board and regulators can see.
UK crypto regulation is moving from MLR registration to full FCA authorisation, and the questions from banking partners, auditors and the FCA are already here. Every Swarm cycle produces evidence of what was attacked, what held and what was fixed.
| Obligation | What it asks for | How the Swarm supports it |
|---|---|---|
| FCA cryptoasset regime | Firms carrying on the new regulated cryptoasset activities need FCA authorisation. The application window runs from 30 September 2026 to 28 February 2027, and the regime commences on 25 October 2027. | Evidence of tested systems and controls to support your application and ongoing supervision. |
| MLR registration (current regime) | Until the new regime commences, cryptoasset firms register with the FCA under the Money Laundering Regulations. | As you move from MLR registration to full FCA authorisation, you’ll have evidence of how the systems protecting customer funds and data hold under real attack, ready for the step up. |
| MiCA and DORA (firms with EU operations) | Crypto-asset service providers authorised under MiCA also fall under DORA's digital operational resilience requirements, including resilience testing. | Continuous attack evidence to support resilience testing. |
| UK GDPR | Reportable personal data breaches notified to the ICO within 72 hours. | Evidence that the paths to customer data are tested against real attacks. |
Stories from the Swarm
These stories are real, but the names are deeply redacted. We'll tell you how we uncovered the threats no one else could see, and why constant cyber attack is the best way to outpace cyber threats.
Become a story well told. Contact us to discuss how Constant Cyber Attack™ will help you outpace cyber threats.
Frequently Asked Questions
Crypto penetration testing is a controlled attack on an exchange, custodian or cryptoasset firm by qualified ethical hackers, to find the weaknesses a real attacker would use to reach keys, funds or customer accounts. Continuous red teaming goes further, chaining weaknesses across people, code, cloud and signing processes the way real attackers do.
Most often through keys, people and infrastructure rather than smart contract bugs. In early 2025, private key breaches at centralised services accounted for most stolen funds, and fake hires were one of the most effective ways in (source: Chainalysis). That's why the Swarm tests the people and processes around your keys, not just your code.
Our focus is the attack surface around your code: keys and signing, people, developer workflows, cloud and your apps. A smart contract audit reviews the code itself, and the two work together.
No. Customer funds and production signing are never put at risk. Every attack runs within boundaries agreed in your Attack Thesis before anything starts.
All three. The Swarm attacks digital, social and physical routes, because real attackers move between a recruiter message, a support ticket and an unattended laptop in your office.
Firms carrying on the new regulated cryptoasset activities need FCA authorisation before the regime commences on 25 October 2027, and the application window closes on 28 February 2027. Evidence that your systems and controls hold under real attack is a strong foundation for your application and for supervision after it.
Looking for something specific?
Talk to us. We'd love to hear from you.
Stop testing.
Start knowing.
You'll know exactly where you stand, and you'll be able to prove it. To your board, your regulator, and yourself.
Transform to a proactive, continuous offensive security programme
Your budget is aimed at the risk that matters, not the one you were handed
You show the board what security prevented, not a request for more
Security clears the way for the business to move faster
You enter the boardroom in command
It starts with a 30-minute Attack Discovery call.
No access to your systems required.