Red Teaming in 2026: Why Halborn Breaks In Before Hackers Do

The night the code worked and the money still vanished

On 21 February 2025, Bybit approved what looked like a routine transfer between two of its own Ethereum wallets. The exchange used a multisignature setup, so several authorized people had to sign off. Each of them looked at the transaction on screen, saw a familiar destination, and approved it. Within minutes, roughly $1.5 billion in ETH was gone, in what remains the largest cryptocurrency theft ever recorded, according to the US Federal Bureau of Investigation.

Not one line of Bybit’s smart-contract code was broken. The signers had been shown a forgery. Forensic teams traced the loss to a supply-chain compromise of Safe{Wallet}, the multisig interface Bybit relied on: attackers had slipped malicious JavaScript into the front end so that, for a handful of targeted wallets, the screen displayed a harmless transaction while the logic underneath rerouted the funds, as SlowMist and other responders documented. The signatures were real. The approvals were informed consent handed to a lie. The FBI attributed the operation to the North Korean cluster it tracks as TraderTraitor, part of the activity widely known as Lazarus.

That is the defining lesson of the current hacking cycle. A smart-contract audit answers exactly one question: is this code correct? It does not ask whether your signers can be tricked, whether your build pipeline can be poisoned, whether an engineer can be socially engineered over six months, or whether one misconfigured node can be turned against the whole system. Answering those questions means hiring someone to behave like the attacker, before the attacker shows up. That practice is called red teaming, and the crypto security firm that has built its identity on thinking like the adversary is Halborn.

To understand why offensive security has moved from a niche add-on to the center of the conversation, it helps to start with what it is, how it differs from the audit most protocols already buy, and why the same signing surfaces that failed at Bybit keep failing. The mechanics of shared signing, from classic setups to newer MuSig2 and FROST schemes, are only ever as strong as the humans and interfaces wrapped around them.

What offensive security actually means

Most security work is defensive: build walls, watch logs, patch holes, respond after something trips an alarm. Offensive security inverts the posture. Instead of waiting to be attacked, defenders commission a controlled attack on themselves to find the gaps first. Halborn, which markets itself as an offensive-first shop, defines the field in a company explainer as a framework that advocates proactive techniques to target cybercriminals and actively mitigate their attacks, rather than simply absorbing them.

Halborn frames the aggressive end of that posture around what it calls the Three A’s: Annoyance, Attribution, and Attack. Annoyance means wasting an intruder’s time and resources, for instance by seeding fake directories and dummy data that lead nowhere. Attribution means unmasking the attacker, using techniques such as web beacons embedded in files a thief might exfiltrate, so the intruder learns their identity is exposed. Attack, the most contested tier, describes actively striking back, an option that raises legal questions and is generally reserved for law enforcement rather than private firms. For most engagements, the value lives in the earlier stages: modeling the adversary well enough to see what they would see.

The distinction that matters for a protocol treasurer or an exchange security chief is simple. Defensive security asks whether you are following best practices. Offensive security asks whether those practices survive contact with a motivated, funded, creative opponent who does not care about your org chart. In 2026, the most creative opponents are nation-state teams with eight-figure budgets and years of patience, so the bar for a useful simulation has risen accordingly. A firewall rule that stops a script kiddie is not the same defense as one that slows a group willing to spend six months befriending your staff.

Audit, penetration test, red team: three different questions

The three services get lumped together in marketing, but they answer different questions and carry different assumptions. An audit reviews a defined codebase for correctness. A penetration test probes a specific target, an app, a wallet, a cloud environment, to see whether it can be broken within a set scope. A red team engagement is broader and quieter: it emulates a real adversary trying to achieve an objective, stealing funds or seizing admin control, across whatever path the organization exposes, including its people and its vendors. The table below sketches the differences.

Read that table next to the Bybit timeline and the point lands: the exploited path, a poisoned vendor interface deceiving human signers, sits squarely in the red team column and nowhere near the audit column. Audits remain necessary; they catch the most common class of on-chain bug, and skipping one is negligence. They are simply the wrong instrument for the losses that now dominate the ledger.

Assume breach: emulating the attacker you actually face

Modern offensive work starts from an uncomfortable premise borrowed from military exercises and enterprise security alike: assume breach. Rather than testing whether an attacker can get in, the team assumes someone already has, then measures how far they can go and how quickly anyone notices. This is the logic behind threat-led testing, where the simulated adversary is not generic but modeled on a specific group’s known behavior.

The shared vocabulary for that modeling is the MITRE ATT&CK framework, a public catalog of the tactics and techniques real intrusion sets use, from initial access through persistence, lateral movement, and exfiltration. A crypto red team emulating TraderTraitor, for example, would not just fuzz a contract; it would rehearse the group’s documented playbook: fake recruiter outreach, malware-laced coding tasks, deepfake video calls, and patient compromise of a developer’s laptop or a vendor’s build system. The goal is not to prove that a determined nation-state can eventually win, everyone concedes that; it is to shorten the distance between compromise and detection, and to remove the cheap wins that make an operation profitable.

That framing explains why offensive security has eclipsed the checklist. A checklist verifies controls in isolation. An assume-breach exercise tests whether those controls, and the people operating them, hold together under a coordinated, realistic assault. It is the difference between confirming that your smoke detectors have batteries and lighting a controlled fire to see whether anyone actually evacuates.

Halborn, the offensive-first firm

Halborn was founded in 2019 by Steven Walbroehl and Rob Behnke, two practitioners who came out of offensive and application-security backgrounds rather than blockchain marketing. The firm bootstrapped for roughly three years before raising outside money, then closed a $90 million Series A led by Summit Partners in July 2022, its first external funding, with participation from Castle Island, Digital Currency Group, Brevan Howard, Third Prime, Sky Vision Capital, and Fenwick.

The offensive DNA is not a slogan. Walbroehl, now co-founder and chief technology officer, authored the SANS Institute’s blockchain and smart-contract security course and spent years in penetration testing and web application security before crypto. Halborn’s current service menu splits into advisory and assurance work and includes advanced penetration testing of web apps and cloud infrastructure, full-scope red team exercises, smart-contract and layer-one assessments, and, more recently, AI red teaming. Its published client references include Coinbase, Polygon, and Solana, and the team is fully remote.

What sets the firm apart from the pure audit shops is sequence. A code auditor reads what the developers wrote and looks for mistakes. Halborn’s roots are in starting from the attacker’s side of the wire and working inward, an orientation that shaped its most famous piece of research and still frames how it talks to clients: not what did you build, but how would I take it from you.

Rab13s, the disclosure that proved the model

In March 2022, while reviewing the Dogecoin codebase, a Halborn team led by senior offensive security engineer Hossam Mohamed found a set of critical flaws. The most serious, which the firm nicknamed Rab13s, lived in the peer-to-peer networking layer that many chains share, not in any single application. A crafted consensus message could crash a node, and enough crashed nodes could open the door to a 51% attack. Because so many blockchains are forks of the same code, the same bug rippled outward: Halborn ultimately warned that more than 280 networks were affected, including Litecoin and Zcash, with more than $25 billion in assets exposed, as CoinDesk reported when the firm went public in March 2023.

Dogecoin, Litecoin, and Zcash patched before disclosure; many smaller forks did not, which is why Halborn held back technical detail. The Rab13s advisory is a textbook example of offensive research: it did not wait for an exploit, it hunted for the class of flaw an attacker would want, at the layer an attacker would target, across the whole ecosystem rather than a single client. That is the practical difference between checking a box and thinking like the adversary, and it is the capability protocols are really buying when they hire an offensive team rather than a checklist vendor.

The human layer is the new perimeter

If 2022 was the year of bridge exploits and 2023 the year of oracle games, 2025 and 2026 are the years the attacker stopped fighting the code and started conning the people. The clearest case is Drift Protocol. In April 2026, attackers drained about $285 million from the Solana-based exchange in roughly twelve minutes, the second-largest exploit in Solana’s history after the 2022 Wormhole bridge, according to TRM Labs.

The vulnerability was not in a contract. As Chainalysis detailed, the crew ran a six-month social-engineering campaign, posing as a quantitative trading firm and cultivating Drift insiders in person at a conference, then used Solana’s durable-nonce feature to get Security Council signers to unknowingly pre-sign transactions that eventually handed over admin control. Once in charge, they whitelisted a worthless token as collateral and borrowed real assets against it. Every signature was valid. Every human was fooled.

This is where offensive security overlaps with the oldest attack in the book. Social engineering, deepfaked video calls, coercion, and even physical wrench attacks on key holders are now first-class threats, and they sit entirely outside what a code audit can see. Steven Walbroehl, co-founder and chief technology officer of Halborn, put the trend bluntly to Cointelegraph: “Hackers are using AI to create highly personalized, context-aware attacks that bypass traditional security awareness training.” The threat is not only external: North Korean operatives have repeatedly talked their way into crypto payrolls as remote engineers, turning the hiring pipeline itself into an attack path. A red team that never sends a phishing email, never probes the interview process, and never tests whether staff can be manipulated is testing the wrong perimeter.

Why the biggest losses never touch a smart contract

The pattern is not anecdotal. In its report on the first half of 2026, TRM Labs recorded a record 207 hacks but a sharp drop in dollars lost, to about $972 million, down more than half year over year. The split is the whole story: infrastructure and operational compromises made up only around 15% of incidents but roughly 76% of the money, while more than a hundred smaller smart-contract exploits drove the incident count without moving the total much. North Korea-linked groups accounted for around $643 million, about two-thirds of the half-year’s losses.

Chainalysis told the same story for the full year 2025: about $3.4 billion stolen, with Bybit alone accounting for roughly 69% of it and North Korean actors for the majority, as reported in December 2025. The costliest attacks keep arriving through keys, interfaces, vendors, and people, not through Solidity. The table gathers the marquee cases.

The Kelp DAO breach is the purest example. In April 2026, attackers minted 116,500 unbacked rsETH, worth about $292 million, by feeding a false message to a cross-chain bridge that trusted a single verifier, after compromising internal nodes and flooding external ones with traffic. Halborn’s own post-mortem stresses the point a code review would never surface: the contracts did what they were written to do. The failure lived in the configuration and the infrastructure around them. The same logic applies to the signing surfaces exchanges expose; the shift toward account abstraction and EIP-7702 widens what a red team must probe, because every new way to authorize a transaction is a new way to be tricked into one.

Inside a red team engagement

A serious engagement follows a lifecycle that looks a lot like a real intrusion, run under contract. It begins with reconnaissance: open-source intelligence on employees, infrastructure, code repositories, and vendors. Next comes initial access, often through the human layer, a spear-phishing message, a fake job offer, a malicious dependency. From a foothold, the team establishes command and control, escalates privileges, and moves laterally toward the objective, whether that is a signing key, an admin multisig, or a deployment pipeline. Throughout, the operators document not just what they achieved but what the defenders saw and when.

The deliverable is not a list of bugs. It is a narrative: here is how we got in, here is how long we had before anyone noticed, here are the three places a small change would have stopped us. For a crypto organization, the crown jewels are usually the same, private keys, multisig signers, upgrade authority, and oracle inputs, so the objective is defined around them. A mature program repeats the exercise, because defenses that held last year may not hold against this year’s tactics, and because the point is to measure the defenders, not just the walls.

One structural caveat matters: a red team is only worth the money if there are defenses to test. A startup with no monitoring and no incident-response plan learns more, and more cheaply, from a penetration test and a code audit. Red teaming pays off once an organization has something to defend and genuinely wants to know whether its response actually works, rather than whether it looks good on a slide.

The best programs do not stop at the report. A follow-up known as purple teaming puts the attackers and the defenders in the same room, replaying each step so the blue team can build detections for the exact techniques that worked, after which the red team retests to confirm the gap is closed. That feedback loop is where the value is recovered: an engagement that only proves a break-in is expensive theater, while a cycle that measurably shortens detection time from days to minutes changes the outcome of the next real attack. For a business holding customer funds, the gap between noticing a compromise in twenty minutes and noticing it in twenty hours can be the gap between a scare and an insolvency.

Authorization is the whole game

The line between a red team and a crime is a signed piece of paper. Everything an offensive team does, phishing staff, cracking passwords, exfiltrating data, would be illegal without explicit, written authorization defining the scope, the rules of engagement, the permitted techniques, and the deconfliction process for when a simulated attack trips a real alarm. Get that wrong and the same actions become intrusion or extortion.

Crypto has already seen the boundary blur. In June 2024, the audit firm CertiK exploited a bug in Kraken’s systems and withdrew about $3 million before returning it, framing the episode as research. Kraken’s chief security officer, Nick Percoco, did not accept the framing, telling CoinDesk: “This is not white-hat hacking, it is extortion.” The dispute is a useful cautionary tale: what separates legitimate offensive security from an attack is not the technique but the mandate. It is also why reputable firms insist on narrow scopes, named points of contact, and a kill switch, and why organizations should be wary of anyone who tests first and asks permission later.

AI on both sides of the wire

Artificial intelligence has become both a weapon and a target, and offensive security now has to cover both. On the attacker’s side, generative models write more convincing phishing lures, clone voices, and drive the deepfake video calls that helped compromise firms across 2025 and 2026. Walbroehl’s warning about context-aware attacks that defeat traditional awareness training is really a warning that the economics of social engineering have collapsed in the attacker’s favor: what once took a skilled operator hours now takes a model seconds, at scale. The most cited example is a wave of fake job interviews and investor calls in which operators used real-time face and voice synthesis to pass as recruiters or partners, a tactic security teams now have to assume in any unsolicited video meeting.

On the defender’s side, AI systems are themselves new attack surfaces. As protocols wire large language models into trading bots, support desks, and increasingly into autonomous on-chain agents that hold funds and make decisions, the prompts, tools, and permissions those agents expose become exploitable. This is why Halborn and others now sell AI red teaming as a distinct line: adversarial testing that tries to jailbreak a model, poison its inputs, or abuse an agent’s access to move money it should never touch. The attack surface of a 2026 crypto business is code plus people plus models, and a red team that ignores any one of the three leaves a door open.

The regulatory gap: nobody makes you get red-teamed

Here is the part that surprises people coming from traditional finance: in the United States, no regulator requires a crypto protocol to be red-teamed, penetration-tested, or even audited. The Securities and Exchange Commission’s cybersecurity rules, adopted in 2023, require public companies to disclose material cyber incidents within four business days of judging them material and to describe their risk-management processes annually, as summarized by Gibson Dunn. But that is a disclosure regime, not a testing mandate, and it binds registrants, not a DeFi protocol run by an anonymous team.

Some corners of US finance do face testing rules. New York’s Department of Financial Services requires covered institutions to run annual penetration testing under its Part 500 cybersecurity regulation. But those rules bind licensed financial firms, not smart contracts. And the SEC’s broader posture under chair Paul Atkins, laid out in his 2025 Project Crypto remarks, is aimed at token classification and market structure, not at setting code-review or offensive-testing standards. In practice, whether a crypto project gets attacked by friendlies before enemies is a business decision, policed by reputation and, increasingly, by the compliance demands of exchanges and counterparties rather than by law.

The contrast with Europe is sharp. The EU’s Digital Operational Resilience Act now requires the most significant financial entities to undergo threat-led penetration testing, essentially regulator-mandated red teaming built on the European Central Bank’s TIBER-EU framework, on live production systems at least every three years, with the first cycles due by January 2028, as financialregulations.eu explains. As tokenized assets pull banks and asset managers into crypto, that mandate is quietly becoming a reason offensive security is scaling. The pattern to watch is regulation catching up to the threat model that private firms already price in.

What it costs, and what you actually buy

Offensive security is priced on expert time, and the numbers reflect scarcity. A smart-contract audit runs from about $5,000 for a simple token to more than $250,000 for a complex multi-chain system, with most DeFi reviews landing between $25,000 and $100,000, according to Sherlock’s 2026 market reference. Top private firms bill roughly $2,000 to $5,000 or more per researcher per day; a rushed timeline adds 20% to 50%, and an emergency turnaround of under a week can more than double the bill. Penetration tests and red team engagements, which run longer and lean on senior operators, sit at the higher end.

The uncomfortable truth is that price does not guarantee safety. Cetus, Balancer, and Kelp DAO were all reviewed, some many times over, and drained anyway. What a budget buys is a lower probability of the common failures and, in the case of red teaming, honest evidence about how an organization behaves under attack. It does not buy immunity, and any firm that promises otherwise is selling something other than security.

Quality is also hard to shop for because nobody grades the graders. There is no licensing board for smart-contract auditors or crypto red teamers, and no equivalent of the accounting profession’s oversight regime, so a buyer cannot lean on a certificate the way they can with a financial audit. What fills the gap is reputation: the public post-mortems a firm publishes, the disclosures it is credited with, the clients willing to be named, and the war stories that circulate among security engineers. That is a thin form of accountability, and it is a large part of why the same handful of firms keep appearing on protocol homepages while newer entrants struggle to be trusted with a treasury.

Red teaming goes to Wall Street

The demand curve is bending toward institutions. In September 2024, Halborn named Jacques Boschung, a former Dell and Kudelski Security executive, as chief executive, with co-founder Rob Behnke moving to executive chairman and president and Walbroehl remaining chief technology officer, an appointment Summit Partners framed around the next digital transformation of financial services. Boschung said he was “thrilled to join Halborn at such a pivotal moment,” and the pivot is unmistakable: from securing crypto-native protocols toward validating custody, tokenization, and treasury systems for banks and asset managers entering the space.

That is where the regulatory and commercial threads converge. DORA is pushing European financial entities toward mandatory threat-led testing; tokenization is pulling regulated institutions on-chain; and the losses of 2025 and 2026 have made clear that the expensive attacks come through people and infrastructure, exactly the surface offensive security exists to test. The same discipline that once probed a DeFi contract for a reentrancy bug is now being asked whether a global bank’s crypto desk can survive a nation-state con. The wallets and smart accounts at the center of that desk, from institutional custody to the module-based smart-account designs gaining ground in 2026, are only as safe as the last time someone hostile actually tried to break them.

Halborn’s bet, and the bet of the whole offensive-security field, is that the market has finally internalized the Bybit lesson: an audit tells you your code is probably correct, and a red team tells you whether that even matters. In a year when clean code lost more money than buggy code, the second answer is the one worth paying for.

Frequently Asked Questions

What is the difference between a smart-contract audit and a red team engagement?

An audit reviews a defined codebase to check that it is correct and free of known bug classes. A red team engagement emulates a real attacker trying to achieve an objective, such as stealing funds or seizing admin control, across the whole organization, including its people, vendors, and infrastructure. The audit asks whether the code is correct; the red team asks whether a determined adversary can win anyway. The Bybit and Drift thefts, where valid code was subverted through humans and interfaces, show why both are needed.

What is Halborn known for in crypto security?

Halborn is a blockchain security firm founded in 2019 by Steven Walbroehl and Rob Behnke, known for an offensive-first approach spanning penetration testing, red teaming, incident response, and audits. Its signature research is the 2022 to 2023 Rab13s disclosure, a peer-to-peer networking flaw affecting more than 280 blockchains including Litecoin and Zcash, with over $25 billion in assets exposed. It raised a $90 million Series A led by Summit Partners in 2022 and named Jacques Boschung CEO in 2024.

Why do audited crypto projects still get hacked?

Because audits check code, and most of the largest 2025 and 2026 losses did not come from code. TRM Labs found that in the first half of 2026, infrastructure and operational compromises caused about 76% of the money stolen while making up only around 15% of incidents. Bybit ($1.5 billion), Kelp DAO ($292 million), and Drift ($285 million) were drained through poisoned interfaces, single-verifier misconfigurations, and long social-engineering campaigns that a code audit is not designed to catch.

Is a crypto red team legal?

Yes, when it is authorized. Everything an offensive team does, from phishing staff to exploiting systems and exfiltrating data, is legal only under explicit written authorization that defines scope, rules of engagement, and a deconfliction process. Without that mandate, the same actions are crimes. The 2024 dispute between CertiK and Kraken, where Kraken’s security chief called the firm’s fund-holding “extortion,” shows how quickly the line blurs when authorization is unclear.

Does US law require crypto firms to be red-teamed?

No. No US regulator mandates red teaming, penetration testing, or even smart-contract audits for crypto protocols. The SEC’s 2023 rules require public companies to disclose material cyber incidents, and New York’s NYDFS Part 500 requires licensed financial firms to run annual penetration tests, but neither binds a DeFi protocol. In the EU, by contrast, the Digital Operational Resilience Act will require threat-led penetration testing for significant financial entities, with first cycles due by January 2028.

By Anneke de Vries, security desk, HOGE Wire.