Certik

CertiK is a blockchain security company based in New York. It checks the code behind crypto projects for bugs before they launch, a service called a smart contract audit. It also runs Skynet, a public site that gives crypto projects a security score.

Two professors founded CertiK in 2017: Ronghui Gu of Columbia and Zhong Shao of Yale. The firm says it has served over 5,500 clients and is worth over $2 billion. Its backers include Binance, Sequoia and Goldman Sachs, per its about page.

In October 2026 CertiK took a new slogan: "The Trust Layer for Digital Value". It marks a push past audits into work for banks and regulators.

What is a CertiK audit and how does it work?

A CertiK audit is a paid review of a project's smart contracts that ends in a public report. Security engineers read the code by hand, automated and AI tools scan it, and the team can add formal verification on request. Formal verification means using maths to prove the code always behaves as intended, rather than only testing some cases.

The report sorts each finding by severity, from critical down to informational, and recommends a fix. The project then fixes what it chooses to. Anything it leaves unfixed stays in the final report, with the team's reason, per CertiK's audit page. The audit then appears on Skynet.

CertiK lists more than 6,200 audited projects and over 1,200 formally verified ones on that page as of October 2026. It does not publish prices or set timelines. You request a quote, and the cost depends on how much code there is and how complex it is.

Read the report, not the badge. An audit tells you what CertiK checked, in which version of the code, and which issues the team left open. "Audited by CertiK" on its own tells you none of that.

CertiK Skynet scores and token scans

Skynet is CertiK's free public rating site. It gives each listed project a security score out of 100 and a letter rating from AAA down. Audits, including ones by other firms, feed into the score. CertiK's homepage reports about 1.8 million monthly Skynet users. Skynet also offers a Token Scan tool that flags common scam patterns in a token contract.

A Skynet score is not the same as a CertiK audit. Solana's Skynet page shows a 95.50 score (AAA) built from ten audits by third parties. The page marks the network itself as "Not Audited By CertiK". A high score is a starting point for your own research, not a safety guarantee.

CertiK AI Auditor and agent tools

AI Auditor is CertiK's tool that uses AI to check code for bugs. It went public in April 2026 after months of use inside the firm. Several AI models scan the code at once. A second step then weeds out false alarms. In CertiK's own test on real hacks from 2026, it found the bug in about 89% of cases.

You use it while you build, before a full audit. It does not replace one. At launch CertiK also shared free add-ons that plug its security data into AI coding agents. Access began with a waitlist, and there is no public price.

CertiK Hunt bug bounties and audit competitions

CertiK Hunt is a site where projects pay outside hackers to find bugs. It opened on 1 July 2026 and is invite-only. It runs three kinds of contest: open-ended bug bounties, short audit contests, and AI security challenges.

Both sides are vetted. CertiK picks hackers by their past finds and name in the field. It also checks each project before it can post a bounty. In October 2026, stake.link posted a bounty of up to $250,000 there.

Compliance, proof of reserves and other services

CertiK also sells services to exchanges, banks and governments:

• Penetration testing: mock attacks on live systems, such as wallets and exchange websites.
• Proof of reserves: checking that an exchange holds the coins it says it holds.
• CertiK Compliance and CertiK Supervision: tools that screen for money laundering and help regulators watch firms. Both were named as core products in the October 2026 rebrand.
• Licence advice for Dubai's VARA rules and the EU's MiCA and DORA rules.
• Speed tests: in October 2026 CertiK checked a Sui record of about 40 million transactions per second.

Work for governments grew in 2026. In September 2026, Kyrgyzstan's central bank signed a long-term deal with CertiK. CertiK will help keep the Digital Som safe. That is the state coin the country plans to launch. A month later CertiK said it had joined a Mastercard crypto partner group. CertiK also holds the SOC 2 and ISO 27001 security badges that big firms look for.

CertiK on Solana

CertiK audits Solana apps and studies Solana bugs, but it is one choice among several on the network. Its best-known Solana work is a fix in Solana's core code.

On 27 February 2026 CertiK shared a flaw it helped fix in big_mod_exp, a Solana function for maths on very large numbers. The fee for this function was set far too low. It was worked out in bytes when the real cost grows with bits. So the biggest calls used about 60 times the compute they paid for. An attacker could have used that to clog validators for very little money. The fee was fixed before anyone abused it.

CertiK also writes up Solana hacks. One example is its report on the DefiTuna exploit of 16 July 2026, which drained about $570,000. Its CertiKAlert account on X posts live hack warnings across chains.

Not every Solana finding has held up. In November 2023 CertiK called a bootloader issue in the Solana Saga phone critical. Solana Labs called the claim inaccurate, noting the feature is off by default and needs the owner to turn it on.

CertiK Hack3d crypto hack reports

Hack3d is CertiK's regular report on money lost to crypto hacks. It covers all chains. The press quotes it often.

• First half of 2026: $1.31 billion lost across 344 incidents, per the H1 report. Stolen wallet keys and phishing caused the most damage. Solana losses were about $315 million, most of it the $285 million Drift Protocol exploit in April 2026.
• Third quarter of 2026: $1.26 billion across 247 incidents. The $387.5 million Bitget hack was the largest, and September was the worst month of the year by incident count, as reported by Cointelegraph.

Is CertiK legit? Risks and criticism

CertiK is a real, large company, and its audits are real reviews. The fair criticism is about what an audit promises. A CertiK audit checks code at one moment. It does not vouch for the team, and projects can ignore its findings.

That gap has shown up in public. Several CertiK-audited projects were later rugged or drained by insiders. These include Merlin on zkSync in 2023, about $1.8 million days after its audit, and Swaprum on Arbitrum, about $3 million. CertiK's response was that it had flagged centralisation risks and cannot force teams to act on them. Reddit threads and a low Trustpilot rating show the same doubt among retail users.

CertiK's own conduct has been questioned too. In June 2024 CertiK researchers used a Kraken deposit bug to withdraw about $3 million before reporting it. CertiK called this testing. Kraken called it extortion. CertiK returned the funds after a public dispute.

For users, the practical risk is overtrust. CertiK never holds your funds, so the risk is in the projects it reviews. Before you deposit, check what the report covered, whether critical findings were fixed, and who can still change the contract.

Who should use CertiK?

CertiK suits teams that need an audit name that big players know. Think of a project hoping to list on a large exchange, raise money from funds, or deal with regulators. Exchanges and banks also use its proof of reserves and compliance tools.

It fits less well for a small team that builds only on Solana and has little money. A Solana expert firm may know the code better and cost less. If you are a crypto user, Skynet and Token Scan are free first checks. They don't replace reading the audit itself.

CertiK vs OtterSec, Neodyme and other alternatives

On Solana, the main rivals are smaller audit firms with deep roots in the network, such as OtterSec and Neodyme. Halborn and other firms that work on many chains compete with CertiK for the same big clients.

The choice is brand and range against depth. CertiK has the most products and the name exchanges and regulators know best. Solana experts tend to know more about how Solana stores data in accounts, where many Solana bugs hide. Many large Solana apps hire more than one auditor. That is a good rule for any project that holds a lot of user money.

CertiK and the CTK token

CertiK the company has no equity token. CTK is the token of Shentu Chain, a Cosmos-based blockchain that started as CertiK Chain and was later renamed. CTK pays fees, secures the network through staking and votes on governance.

Holding CTK gives you no share in CertiK the company or its audit revenue. If you are looking at a "CertiK price" chart, you are looking at Shentu's CTK token.