It seems unexpected large outflows from @binance hot wallets. @cz_binance https://t.co/QLIncTt0T0
PeckShield
Blockchain security firm providing smart contract audits, penetration testing, and real-time exploit tracking
3.8/ 5
Our score
Good
Services
Smart contract auditsPenetration testingMonitoringIncident response
Languages & ecosystems
EVMSolidityEthereumBNB Chain+1
Publishes audit reports
Yes
Notable clients
PancakeSwapSushidYdXParaSwap
What is PeckShield?
PeckShield is a blockchain security and smart contract auditing company founded in 2018. The firm conducts protocol code audits and tracks live onchain security incidents through its PeckShieldAlert research arm.
Leadership and team background
PeckShield was established in 2018. The firm is headquartered in China and operates internationally. Its technical staff includes security researchers from institutions such as Tsinghua University, UC Berkeley, and ETH Zurich, alongside veterans who previously consulted or worked for technology firms including Alibaba, Baidu, Tencent, and Qihoo 360.
Security services and operational mechanics
The firm delivers security assessments through manual code inspection and automated vulnerability discovery tools. Key services include smart contract audits, protocol-level code reviews, penetration testing for decentralized applications, and simulated attack assessments against Web3 infrastructure. Through its threat monitoring division, PeckShield tracks transaction flows, decompiles unverified contract logic, and monitors admin-key compromises across networks such as Ethereum, Arbitrum, Base, Blast, Berachain, and Tron. Its contact channel for institutional reviews and assessments operates via [email protected].
Track record and notable audits
PeckShield established its research track record early in 2018 by identifying the Ethereum BatchOverflow vulnerability. The team has audited major decentralized finance protocols, including decentralized exchanges like ParaSwap, Sushi, dYdX, and PancakeSwap. For PancakeSwap, the firm reviewed Cross-chain Farming in September 2022, Exchange V3 in March 2023, and MasterChef V3 in April 2023. Through PeckShieldAlert, the firm tracked 55 security exploits totaling $766.49M in losses during September 2026, monitoring major incidents including the $387M Bitget loss and the $320M LiquidNetwork incident.
Risks and structural trade-offs
Smart contract security audits assess code at a fixed point in time and on specific Git commits. Future contract upgrades, governance parameter adjustments, unverified interaction logic, or compromised administrative keys remain operational risks that an audit cannot prevent.
Best for:DeFi protocols requiring smart contract auditsWeb3 developers needing infrastructure penetration testingTeams seeking live on-chain exploit tracking
Pros and cons
Pros
- Established track record in blockchain security since 2018
- Discovered foundational vulnerabilities including the 2018 BatchOverflow flaw
- Audited prominent protocols including PancakeSwap, Sushi, ParaSwap, and dYdX
- Publishes real-time threat intelligence and on-chain exploit tracking
Cons
- No publicly standardized pricing schedule or turnaround timelines
- Audits cover single code snapshots and do not guarantee immunity from later exploits
- Does not operate a public native bug bounty platform
Our review
3.8/5
Good
PeckShield offers respected threat monitoring and smart contract auditing for major DeFi protocols, but custom quote pricing and non-standardized timelines require project teams to negotiate terms individually.
Founded in 2018, PeckShield conducts Web3 vulnerability research and smart contract security reviews. The China-based firm operates globally with researchers drawn from institutions such as Tsinghua University, UC Berkeley, and ETH Zurich. Its core business centers on smart contract auditing, penetration testing, and onchain threat intelligence.
PeckShield's track record includes early vulnerability disclosures, such as discovering Ethereum's BatchOverflow vulnerability in 2018. Over the years, the firm has conducted security reviews for decentralized exchanges and protocol architectures, including PancakeSwap (covering MasterChef V3 in April 2023 and Exchange V3 in March 2023), ParaSwap, and Sushi. Alongside manual code reviews, the team monitors onchain incidents via PeckShieldAlert, tracking hacks and exploit losses in real time. In September 2026, its threat monitoring logged 55 hacks totaling $766.49M in ecosystem losses.
Despite its technical profile, engaging PeckShield involves several trade-offs:
- Audits evaluate code only at a specific point in time, meaning subsequent contract upgrades or external logic shifts fall outside the original assessment scope.
PeckShield suits DeFi protocol teams seeking manual code review and post-deployment alert visibility.
Specs
| Services | Smart contract audits, Penetration testing, Monitoring, Incident response · unverified |
|---|---|
| Languages & ecosystems | EVM, Solidity, Ethereum, BNB Chain, Arbitrum · unverified |
| Publishes audit reports | Yes · unverified |
| Notable clients | PancakeSwap, Sushi, dYdX, ParaSwap · unverified |
| Bug bounty platform | No · unverified |
| Live monitoring | Yes · unverified |
Not disclosed by the provider: Pricing, Typical turnaround, Formal verification.
Data from the provider's website and public sources. Fees and availability change; confirm on the official site before you sign up.
Key features
Smart contract audits
Combines manual code analysis with automated vulnerability scanning to inspect smart contracts, decentralized exchanges, wallets, and blockchain protocols.
Penetration testing
Executes simulated attacks against decentralized application frontends, smart contract interfaces, and back-end blockchain infrastructure.
Threat monitoring and alert feed
Tracks live hacks, flash-loan exploits, abnormal outflows, and bridge compromises across Ethereum, Arbitrum, Base, Tron, and other chains.
Vulnerability research
Investigates zero-day flaws, accounting mismatches in DeFi vaults, and token-standard execution errors.
Fund flow tracing
Traces exploiter transactions, cross-chain bridge hops, and cross-chain bridge hops to document stolen funds.
Inside PeckShield
Smart Contract and Protocol Auditing
Provides manual review and automated code analysis to detect logical bugs and security vulnerabilities across contracts, wallets, and decentralized exchanges.
Penetration Testing
Executes simulated attacks and vulnerability evaluations across blockchain protocols and application infrastructure.
PeckShieldAlert
Monitors onchain activity to alert the community and protocols about live hacks, suspicious token mints, and exploit transactions.
User reviews
No user reviews yet. Have you used PeckShield? Share your experience below.
FAQ
What services does PeckShield offer?
PeckShield provides smart contract audits, protocol penetration testing, automated vulnerability analysis, and real-time threat intelligence.
Which notable protocols has PeckShield audited?
The firm has audited PancakeSwap, ParaSwap, Sushi, and dYdX, including PancakeSwap's MasterChef V3 in April 2023.
What is PeckShieldAlert?
PeckShieldAlert is the firm's threat monitoring service that identifies and tracks onchain exploits, bridge drains, and crypto hack metrics.
Latest from PeckShield on X
It seems @Polymarket UI may be compromised. Do NOT interact on the site for now. https://t.co/UP7asoZMdS
It seems @bitget hot wallet potentially hacked w/ >$178m @BitgetSupport https://t.co/iefRifYanv https://t.co/uydFGSz3xy
Looks like the @summerfinance_ LazyVault_LowerRisk_USDC vault has a share price accounting issue that may be manipulated by donating to SiloManagedVault
Hi @mapprotocol, you may want to take a look: huge amount 1,000,000,000,000,000 of $MAP0 were minted:
https://t.co/gTl5TGRC9a https://t.co/er6yh1Mh8b
https://t.co/gTl5TGRC9a https://t.co/er6yh1Mh8b
Recent public posts from @peckshield, shown as published. Not reviewed or endorsed by CryptoReview.
Alternatives to PeckShield
Web3 security firm with 117,000+ vulnerabilities detected since its 2018 founding
Smart contract audits · Formal verification +3Publishes audit reportsFormal verification