🇮🇹 Rome, we're here!
Come meet the CertiK team tomorrow at @AIBC_World Rome, November 3–5.
📍 Find us at Booth H7-7028 to connect with our team.
See you there! https://t.co/XlbXfCXtPe
CertiK
Web3 security firm with 117,000+ vulnerabilities detected since its 2018 founding
3.8/ 5
Our score
Good
Services
Smart contract auditsFormal verificationPenetration testingBug bounty platform+1
Languages & ecosystems
EVMEthereumSuiXRP Ledger+2
Publishes audit reports
Yes
Notable clients
OKXFireblocksLedgerSui+2
What is CertiK?
CertiK assesses smart contracts, blockchain protocols, decentralized applications and digital asset firms. Its site reports over 117,000 vulnerabilities detected and $532 billion in market capitalization evaluated as of October 2026. Security assessments rely on formal verification, manual code review, attack simulation and ongoing monitoring.
Company and founders
Computer science professors Ronghui Gu of Columbia and Zhong Shao of Yale founded the company in 2018. Gu serves as chief executive officer, while Shao is co-founder. The firm grew from academic formal verification research, a mathematical technique that rigorously proves whether software behaves according to specified properties. It holds SOC 2 Type II compliance alongside ISO 27001 certification.
Security and compliance products
Code Security Audits evaluate smart contracts and blockchains across multiple languages by pairing formal proofs with manual inspection to deliver remediation guidance. Penetration testing probes Web3 applications, APIs and off-chain infrastructure with simulated attacks. CertiK reports hardening more than 5,000 APIs and securing over 500 applications.
Skynet generates automated risk assessments for crypto projects and exchanges. It tracks over 21,000 projects across 100 ecosystems and attracts 1.8 million monthly active users. SkyInsights handles transaction monitoring and AML risk analytics. Other offerings provide proof-of-reserves audits and advisory work for VARA, DORA and MiCA mandates.
Track record
CertiK verified HyperEnclave core components, and a related paper was accepted at ASPLOS '24. Under an Ethereum Foundation grant, it delivered Better Rocq tactics, and it completed formal verification of TON consensus logic. Sui awarded CertiK a $600,000 bounty for finding a critical vulnerability capable of taking down the network. CertiK independently verified Sui performance benchmarks that reached 40.68 million peak transactions per second.
Risks and limitations
Audits evaluate code at a single commit. Subsequent modifications can introduce bugs. Fast deadlines can restrict audit thoroughness. Formal proofs rely entirely on initial assumptions, so audited code can still suffer exploits. Skynet ratings offer automated evaluations rather than eliminating smart contract and operational risks.
Founders
Prof. Ronghui GuFounder & CEO
Prof. Zhong ShaoCo-Founder
Best for:Protocol security assessmentsSmart contract formal verificationWeb3 penetration testingCrypto compliance and monitoring
Pros and cons
Pros
- Formal verification and manual review for code audits
- 117,000+ vulnerabilities detected as of October 2026
- Penetration testing covers applications, APIs and off-chain systems
- Skynet monitors 21,000+ projects across 100+ ecosystems
- SOC 2 Type II compliant and ISO 27001 certified
Cons
- Audit conclusions apply to the reviewed code and defined scope
- Later upgrades can introduce vulnerabilities after an audit
- Rushed audit timelines can limit testing depth
- Formal proofs depend on specifications and stated assumptions
- Monitoring and ratings do not remove protocol or infrastructure risk
Our review
3.8/5
Good
CertiK provides formal verification and on-chain monitoring; an audit covers the reviewed code and scope.
Founded in 2018 by computer science professors Ronghui Gu of Columbia University and Zhong Shao of Yale University, CertiK is a Web3 security company. Its technical foundation centers on formal verification, mathematical proof techniques, and automated tooling alongside manual code reviews. By October 2026, the firm reported assessing over $532 billion in market capitalization and logging more than 117,000 detected vulnerabilities across protocols such as TON, SEI, the XRP Ledger, and the Sui Network.
The company provides smart contract audits, penetration testing, bug bounty operations, monitoring, and compliance services. Teams can commission penetration testing across off-chain infrastructure and APIs, access bug bounty operations via CertiK Hunt, or deploy real-time threat monitoring through its Skynet platform. It holds SOC 2 Type II compliance and ISO 27001 certification and offers regulatory advisory covering MiCA, DORA, and Dubai VARA compliance.
- An audit report examines only the designated commit hash or version evaluated, meaning subsequent upgrades require fresh evaluations.
- Formal verification uses specified properties, while CertiK also offers manual review and penetration testing.
Specs
| Services | Smart contract audits, Formal verification, Penetration testing, Bug bounty platform, Monitoring · unverified |
|---|---|
| Languages & ecosystems | EVM, Ethereum, Sui, XRP Ledger, TON, Sei · unverified |
| Publishes audit reports | Yes · unverified |
| Notable clients | OKX, Fireblocks, Ledger, Sui, TON, Bitget Wallet · unverified |
| Formal verification | Yes · unverified |
| Bug bounty platform | Yes · unverified |
| Live monitoring | Yes · unverified |
Not disclosed by the provider: Pricing, Typical turnaround.
Data from the provider's website and public sources. Fees and availability change; confirm on the official site before you sign up.
Key features
Smart contract audits
Reviews smart contract and blockchain code using formal verification, manual analysis and remediation guidance. CertiK reports 90,000+ security audit findings.
Formal verification
Mathematically checks whether code behaves according to defined specifications, including work on TON consensus and HyperEnclave components.
Penetration testing
Simulates attacks across Web3 applications, APIs and off-chain infrastructure. The service reports 500+ applications secured and 5,000 APIs hardened.
Skynet monitoring
Rates and monitors projects, exchanges and wallets in real time across 21,000+ projects and 100+ ecosystems.
Bug bounty platform
CertiK Hunt hosts vulnerability disclosure programs, including a WEMIX program with a maximum reward of $10K.
Compliance analytics
SkyInsights provides transaction monitoring, AML and risk analytics, with 300M+ address labels and support for 15 chains.
Proof of reserves
Provides independent verification and auditing of cryptocurrency reserves for digital asset businesses.
Inside CertiK
Code Security Audits
Security assessments of smart contract and blockchain code use manual review and formal verification. The service identifies vulnerabilities and recommends remediations before deployment.
Penetration Testing
Simulated cyberattacks targeting Web3 applications, APIs, and off-chain infrastructure. CertiK reports hardening over 5,000 APIs and securing more than 500 applications through this process.
Skynet Rating
A real-time evaluation and monitoring system for Web3 projects. It provides continuous data across thousands of Web3 projects.
SkyInsights
A crypto compliance and anti-money laundering analytics platform for digital asset service providers. It delivers transaction monitoring and risk intelligence across hundreds of millions of address labels.
Proof of Reserves Audit
Independent verification and auditing of cryptocurrency reserves for digital asset businesses.
CertiK screenshots
What users say about CertiK
Mentions are limited to passing references regarding industry threat reports without direct reviews or substantial critique.
Based on 3 Reddit posts and comments from the last 12 months, checked Oct 20, 2026. These are posts by users on other sites, not reviews submitted on CryptoReview.
User reviews
No user reviews yet. Have you used CertiK? Share your experience below.
FAQ
Who founded CertiK?
Computer science professors Ronghui Gu of Columbia and Zhong Shao of Yale launched the company in 2018. Gu is the Chief Executive Officer.
What services does CertiK provide?
CertiK provides smart contract and blockchain audits, formal verification, penetration testing, bug bounty programs through CertiK Hunt, and Skynet on-chain monitoring. It also delivers regulatory advisory services for MiCA, DORA, and VARA compliance.
Does CertiK publish audit reports publicly?
Yes, CertiK publishes completed audit reports for public review, outlining findings, severities, and developer remediation. CertiK publishes completed audit reports for public review.
Does CertiK have a token?
It operates as an independent security company providing software and auditing services.
Latest from CertiK on X
A new chapter begins. 🇦🇪
CertiK is expanding to Dubai!
This marks an important step in our continued global growth and commitment to supporting the digital asset ecosystem across key markets.
We're excited to deepen our presence in the region and build what's next. https://t.co/DwbjJcWqLl
CertiK is expanding to Dubai!
This marks an important step in our continued global growth and commitment to supporting the digital asset ecosystem across key markets.
We're excited to deepen our presence in the region and build what's next. https://t.co/DwbjJcWqLl
The response to the recent Binance security incident demonstrates the strength of industry-wide cooperation.
We applaud the swift action taken by stablecoin issuers and ecosystem partners, helping freeze approximately $3 billion in affected assets, nearly 48% of the estimated impact.
Our preliminary assessment also provides encouraging evidence of Binance’s financial resilience. Its historical Proof of Reserves data shows more than 1:1 coverage of major assets, while its substantial financial resources and commitment to covering the incident’s impact provide further confidence.
We are encouraged by Binance’s decisive response, continued transparency, and progress toward recovery.
CertiK stands ready to support Binance as recovery and security efforts continue.
We applaud the swift action taken by stablecoin issuers and ecosystem partners, helping freeze approximately $3 billion in affected assets, nearly 48% of the estimated impact.
Our preliminary assessment also provides encouraging evidence of Binance’s financial resilience. Its historical Proof of Reserves data shows more than 1:1 coverage of major assets, while its substantial financial resources and commitment to covering the incident’s impact provide further confidence.
We are encouraged by Binance’s decisive response, continued transparency, and progress toward recovery.
CertiK stands ready to support Binance as recovery and security efforts continue.
That's a wrap on Merge Madrid! 🇪🇸
Three days of conversations, new connections, and insights into the future of digital assets.
From institutional adoption to security and compliance, these topics took center stage throughout the event.
Thanks to @mmerge_io and everyone who stopped by our booth.
Three days of conversations, new connections, and insights into the future of digital assets.
From institutional adoption to security and compliance, these topics took center stage throughout the event.
Thanks to @mmerge_io and everyone who stopped by our booth.
The hunt is growing, and so is the talent behind it! 🏹
We're welcoming a new wave of security researchers to CertiK Hunt!
Our growing community brings together skilled researchers dedicated to uncovering vulnerabilities and making Web3 a safer place.
Welcome aboard! https://t.co/dlba3XJx01
We're welcoming a new wave of security researchers to CertiK Hunt!
Our growing community brings together skilled researchers dedicated to uncovering vulnerabilities and making Web3 a safer place.
Welcome aboard! https://t.co/dlba3XJx01
Recent public posts from @CertiK, shown as published. Not reviewed or endorsed by CryptoReview.
Alternatives to CertiK
Blockchain security firm providing smart contract audits, penetration testing, and real-time exploit tracking
Smart contract audits · Penetration testing +2Publishes audit reportsEVM · Solidity +3