Halborn

Halborn is an enterprise-grade blockchain and digital asset security firm that provides end-to-end cybersecurity services to financial institutions, Web3 protocols, and blockchain infrastructure providers. Founded in 2019 by ethical hacker Steven Walbroehl and entrepreneur Rob Behnke, the company bootstrapped to profitability before raising a $90 million Series A round in July 2022 led by Summit Partners, with participation from Brevan Howard, Castle Island Ventures, and Digital Currency Group. The firm employs over 100 offensive security engineers and practitioners globally.

What Halborn Does

Halborn offers two primary service categories: assurance and advisory.

Assurance services are the core of the business and include smart contract security assessments, blockchain Layer 1 audits, code security reviews, web application penetration testing, cloud infrastructure penetration testing, and red team exercises. The firm has published more than 4,000 security assessments across over 22 programming languages and blockchain execution environments, including Solidity (EVM chains), Rust and Anchor (Solana), Go and CosmWasm (Cosmos), Move (Sui and Aptos), and Algorand.

Advisory services extend beyond code review into organizational security posture. These include blockchain architecture assessments, custody and key management reviews, compliance readiness consulting aligned to regulatory frameworks such as MiCA, DORA, and VARA, technical due diligence for investors, and AI advisory for firms integrating artificial intelligence into financial infrastructure. The firm also offers AI red teaming and security assessment, a service category that has grown as blockchain projects increasingly incorporate AI-driven components.

Halborn reports protecting over $1 trillion in digital asset value across more than 800 clients, having disclosed five published zero-day vulnerabilities in the process.

Security Credentials

The firm holds ISO 27001:2022 and SOC 2 Type II certifications and aligns its internal practices to the NIST Cybersecurity Framework 2.0. Its practitioners hold professional credentials including CISSP, OSCP, and CISA designations. Halborn has also developed and published the Blockchain Vulnerability Scoring System (BVSS), a framework for standardizing the severity classification of vulnerabilities discovered in blockchain-specific contexts, analogous to the CVE/CVSS system used in traditional software security.

Relationship with Solana

Halborn has a well-established and ongoing relationship with the Solana ecosystem. The firm serves as a strategic security partner to the Solana Foundation and has conducted security work at both the core protocol and application layers.

At the protocol level, Halborn began reviewing the Solana Sealevel runtime starting with version 1.9 in early 2022. This engagement expanded into continuous review of validator code and SPL program updates prior to mainnet deployment, working with Solana Labs and later the Anza development team. During an audit of the SPL Token 2022 program, which introduced transfer fees, non-transferable tokens, and confidential transfers, Halborn identified two critical vulnerabilities. One allowed users to bypass transfer fee requirements, and the other allowed tokens marked as non-transferable to be moved in violation of their designated restrictions. Both were remediated in coordination with Solana Labs before the program reached production.

At the application layer, Halborn has audited more than 40 projects built on Solana spanning decentralized finance, infrastructure, and gaming. Publicly documented Solana-ecosystem audits include work for deBridge (cross-chain bridge Solana programs), Huma Finance (Solana lending programs), Solayer (restaking network on Solana), 21BTC on Solana (tokenized Bitcoin), and the 0x Project Solana settlement program. The Solayer engagement involved in-depth review of the restaking program logic and active support for remediating findings. The 21BTC audit resulted in no high or critical vulnerabilities, with Halborn providing ongoing risk identification support through launch.

Client Base and Market Position

Beyond Solana, Halborn's client list spans some of the most prominent names in digital assets and traditional finance intersecting with blockchain. Publicly referenced clients include Coinbase, Circle, Ripple, OKX, Grayscale, and Coinbase Asset Management, as well as custody providers such as Bank Frick and multiple central banks exploring blockchain-based infrastructure. The firm's positioning focuses on enterprise and regulated financial services rather than exclusively retail-facing DeFi protocols.

This institutional orientation is reinforced by the firm's compliance service offerings. Regulatory frameworks such as the EU Markets in Crypto-Assets regulation (MiCA) and the Digital Operational Resilience Act (DORA) impose new technical security requirements on financial entities operating in crypto markets. Halborn offers readiness assessments specifically structured around these frameworks, making it a natural partner for exchanges, custodians, and asset managers seeking to demonstrate regulatory compliance.

Audit Database and Transparency

Halborn maintains a publicly accessible database of its completed audits and reports at halborn.com/audits, alongside a separate reports section for broader security research and whitepapers. This transparency allows project teams, investors, and users to verify the existence and outcomes of Halborn engagements. Published audit reports typically include a full findings list, severity ratings, and remediation status.

Ecosystem Fit

For the Solana ecosystem specifically, Halborn occupies a significant position as one of the few security firms with both deep Solana-specific technical expertise and an auditable track record of protocol-level work. The combination of Sealevel runtime review experience, SPL program audit depth, and a formal relationship with the Solana Foundation means Halborn is frequently referenced when Solana-based projects disclose their security practices to users and institutional counterparties. Projects seeking credibility with sophisticated investors or exchange listing teams often cite a Halborn audit as part of their security posture.

The firm does not issue a native token, does not operate a protocol, and does not hold governance roles in projects it audits, maintaining an arms-length service-provider relationship that is standard practice for credible security auditors.