Research
Security research,
published openly.
Reports, open methodologies, and articles from our researchers. It's how we think out loud about protecting Web3, in public.
The State of Web3 Security 2022 – Q2 2026
Four and a half years of data: 25,706 published audit findings from 22 firms, and 237 real-world exploit incidents worth US$8.62 billion in losses. Built with rekt.news, updated quarterly.
TRACE. Threat modelling for organisations without a perimeter.
Threat actors, Roles, Assets, Critical invariants, Edges. One method, applied across protocols, systems, and organisations. We built it through our Web3 work, but it fits any team that no longer has a clean security perimeter.
Articles
From our researchers
The audit gap, updated: Q2 2026 joins four years of data, and the quiet quarter ends
Our Web3 security dataset now runs through 30 June 2026: 25,706 audit findings, 237 incidents, US$8.62B in losses. Q1 looked like a rotation in attacker behaviour. Q2 ended that theory.
July 28, 2026 TRACEThe TRACE paper is out
Our threat modelling methodology, written up as a paper: why perimeter-era methods miss the failures that actually happen, and what TRACE does instead.
June 25, 2026 Operational securityMost Web3 losses don't start in the code
A perfectly audited contract won't help you if the deployer key leaks. Here's what an operational security review actually looks at.
June 4, 2026 ResearchThe State of Web3 Security 2022 – Q1 2026: six key findings
What 23,818 audit findings and 218 exploit incidents tell us about where Web3 actually loses money.
May 28, 2026 TRACEIntroducing TRACE: threat modelling without a perimeter
Why we built our own threat modelling methodology, what the five model objects are, and why it works beyond Web3.
May 20, 2026Looking for our audit reports?
Every final audit report is transparently published to our GitHub repository.
Published audit reports