CertiK Becomes a Trust Layer as the Audit Paradox Deepens

A Rebrand That Reads Like a Confession

On October 13, a token that three security firms had reviewed, CertiK among them, was drained within hours of a suspected bridge exploit and shed roughly 92 percent of its value in a single day. Five days earlier, CertiK had stood on a stage in Singapore and told the industry it was no longer just an auditor.

Autheo’s THEO token had passed security reviews by Halborn, CertiK and Avelar Labs before an exploit on its Hyperlane-built bridge minted 19 million unauthorized tokens on Base and sent the price from about $0.08 to around $0.006, according to TechReport. The attacker swapped the fresh supply for roughly 700.8 ETH, a figure the outlet flagged as still unconfirmed on-chain. Autheo told holders not to buy, sell, or bridge THEO while it investigates, and said no remediation plan had been announced. The project had launched on mainnet only five months earlier.

The timing was awkward, and it was also the whole story in miniature. At TOKEN2049 Singapore in early October, CertiK rebranded itself as “The Trust Layer for Digital Value,” a phrase meant to signal that a company founded to read smart-contract code now sells something larger: compliance, monitoring, risk visibility, and reassurance for banks and the regulators who watch them, per the announcement carried on the Chainwire wire. The rebrand is a bet on where the industry is going. It is also, read a certain way, an admission about where the losses already are. In 2026, the money is mostly not leaving through the code that auditors read.

That gap between what audits cover and where funds actually vanish is what security researchers have started calling the audit paradox, and CertiK’s own data is the best evidence for it. The firm now reports that crypto security incidents cost users and companies close to $2.7 billion in the first nine months of 2026, across 658 incidents, with about $420.4 million frozen or returned, per a summary of its figures published by Atlas21. The vast majority of that total did not come from the bugs a classic audit is designed to catch.

What CertiK Announced in Singapore

The headline change is a sentence. CertiK’s positioning moved from Web3 security auditor to “The Trust Layer for Digital Value,” wrapped in a broader mission the company describes as building the trust infrastructure for the digital economy. The substance sits underneath that slogan, in the way CertiK now splits its offering into platform products and hands-on services, and in who it says those offerings are for.

Chief Business Officer Jason Jiang framed the shift around convergence. “Digital assets are changing how value moves. Institutions offering digital asset services and the regulators overseeing them need security, compliance, and risk visibility to work together,” he said in the TOKEN2049 announcement. “Our brand upgrade reflects how CertiK has evolved to support those needs, and our ambition to serve as the trust layer for digital value.” The company said it now contributes technical input to digital-asset policy discussions in the United States, Hong Kong, Singapore, and the United Arab Emirates, a detail that matters as much as the slogan.

CertiK put hard numbers on its scale at the same event: more than 5,500 clients across over 150 countries and regions, more than 119,000 code vulnerabilities identified, and over $600 billion in digital assets secured, again per the Chainwire release. The lineup below is the clearest map yet of what the firm sells after the rebrand, and how far it has drifted from a single pre-launch code review.

Who CertiK Is, and How It Got Here

CertiK did not start in crypto. It grew out of academic work on formal verification, the practice of using mathematical proofs to show that software behaves exactly as specified. Co-founders Ronghui Gu, an associate professor at Columbia University, and Zhong Shao, chair of computer science at Yale, built CertiKOS, an operating-system kernel whose core was formally verified, before turning the same toolkit on smart contracts. The company was founded in 2018 in New York and took its name from the idea of a certified kernel.

The money followed the pedigree. CertiK raised more than $240 million over several rounds and carried a roughly $2 billion valuation out of a 2022 Series B, with Binance as its first and largest backer alongside Coinbase, SoftBank, Insight Partners, Tiger Global and others, as CoinDesk reported when it examined how the firm rebuilt trust ahead of a possible listing. That lineage gives CertiK something most audit shops lack: brand recognition strong enough that a project can advertise an audit as a marketing asset, and a logo that retail buyers treat as a seal of approval.

It also gives the firm a credibility problem that the rebrand is partly designed to solve. CertiK is the most visible name in a service category that has no licensing body, no mandatory standards, and no regulator that signs off on who is allowed to call themselves an auditor. A badge from CertiK means a specific engagement happened, at a specific scope, at a specific point in time. It has never meant a protocol is safe, and the firm has spent 2026 producing the numbers that prove it.

The Audit Paradox, in CertiK’s Own Numbers

Start with the quarter. CertiK’s Q3 2026 tally put industry losses at about $1.26 billion across 247 incidents, up almost 54 percent from the second quarter, as Yahoo Finance reported from the firm’s data. September alone accounted for the bulk of it. CertiK logged $766,451,111 in losses for the month, with $270,610,532 frozen or returned, the highest monthly total and incident count of the year, according to The Crypto Times. Two incidents made up more than 92 percent of the month.

The important part is not the headline figure. It is the shape. When CertiK broke September down by attack type, the classic smart-contract bug landed dead last. Reentrancy, the textbook finding that generations of auditors cut their teeth on, accounted for about $2.2 million. The categories that dominated, third-party service compromise and invalid signature handling, are failures of operational infrastructure and signing workflows, not the on-chain logic an audit reads line by line.

Ronghui Gu has said the quiet part out loud all year. Looking at the first half, he told Forbes that “attackers are getting more return by going after key management, multisig governance, and operational infrastructure than by hunting for bugs in code.” He added a line that should unsettle anyone who treats an audit as a finish line: “A project gets audited once before deployment, passes, and then never revisits that code again. The danger window doesn’t close after launch.” A protocol, in his words, can pass a flawless code audit and still lose millions to a compromised admin key.

The half-year data told the same story. Across the first six months of 2026, wallet compromise alone cost about $444 million over 33 incidents, averaging more than $13 million per event, by far the costliest category CertiK tracks, Gu told Forbes. Two April incidents, the Kelp DAO and Drift Protocol thefts, accounted for close to 44 percent of all first-half losses between them, and both were operational and infrastructure failures rather than classic contract bugs. The pattern that defined September was visible months earlier; the rebrand is CertiK catching up to its own telemetry.

Bitget: The Code Held, the Money Left

If you want a single event that explains why CertiK rebranded, look at Bitget. On September 24, the exchange lost roughly $351.6 million across 19 transfers, with more than $170 million swapped into ETH mid-attack, the largest single theft from a centralized exchange this year. Chief executive Gracy Chen was blunt about the mechanism in comments to CoinDesk: “The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out. Private key compromise has been ruled out.”

No smart contract failed. No private key leaked. The attacker turned the exchange’s own signing workflow against it, the digital equivalent of slipping forged withdrawal slips through a bank’s teller window while the vault keys stay safe. Bitget said its User Protection Fund, which it puts above $464 million, covered the full loss, meaning the drain erased roughly three quarters of that buffer in one afternoon. There is nothing in that chain of events that a pre-launch code audit would have caught, because none of it lived in code a protocol ships.

CertiK did not audit Bitget, and it is careful to present itself here as a monitor and commentator rather than the exchange’s auditor. Esme Pau, who leads capital markets and policy at the firm, called the breach “one of the most substantive centralised exchange exploits of 2026” and “another wake-up call for the digital-assets industry” in remarks carried by Insurance Journal via Bloomberg. Bitget was itself among the exchanges that helped Bybit recover after its own record theft in February 2025; this time the help ran the other way.

Bitget sits at the top of a list where code is the exception, not the rule. Of 2026’s five largest losses, which together total about $1.57 billion, only one, the Liquid Network incident, was a genuine code bug in the traditional sense. The rest were operational compromises, admin-key failures, or undisclosed. Note that CertiK’s own tally books Bitget at $387.5 million, a bit above the roughly $351.6 million CoinDesk and the exchange confirmed as drained; the two figures use different accounting, and both are worth citing rather than quietly merged.

The Liquid Network case, the one genuine code bug in that group, is the instructive mirror image of Bitget. A flaw in the sidechain’s proof-validation software let an attacker mint unbacked coins, roughly $318.7 million worth, but because the failure lived in transparent on-chain logic, a white-hat was able to return the bulk of the funds, as CoinDesk reported. Bitget was the opposite: the code was never the problem, the money moved through a private backend system, and almost none of it is coming back. Code that breaks in the open can sometimes be undone; trust that breaks inside a closed system usually cannot.

Audited Three Times, Exploited Anyway

The Bitget lesson is that even a well-run exchange can be robbed through its plumbing. The THEO incident this month makes a sharper point: even multiple audits, CertiK’s included, do not guarantee the perimeter a project actually ships. Autheo’s token had cleared reviews from three firms before 19 million unauthorized tokens appeared on Base through its bridge, per TechReport. The exploited component was the cross-chain bridge, which is exactly the kind of moving part that lives at the edge of, or outside, a typical contract audit’s scope. An audit that is sound can still leave the bridge, the oracle, the admin multisig, or the vendor integration uncovered.

THEO was not the only mid-October reminder. On October 14, the crypto casino Gamdom traced an incident to an unauthorized connection on an automation server, with losses pegged at $4.2 million, above its initial $3 million estimate, per Cryptopolitan. That is an operations failure, not a contract bug. The same week, the gaming blockchain WEMIX relaunched its CertiK-run bug bounty, offering vetted researchers up to $10,000 for a single critical flaw, as Finance Magazine reported, a reset that arrived less than two years after two breaches of its own. Continuous bounties and monitoring are precisely the after-launch coverage Gu says the one-and-done audit lacks.

None of this is new, only larger. CertiK has carried audited-yet-exploited cases for years: the Swaprum project ran off with around $3 million in a rug pull despite a CertiK review, as DL News noted at the time, and the Merlin DEX was drained by its own developers not long after it had earned a high security rating. An audit confirms that reviewed code did what it was supposed to on the day it was read. It cannot vouch for the intentions of the team holding the keys, nor for the parts of the stack the engagement never touched.

From Auditor to Operator

The most consequential line in the rebrand is not the slogan. It is the appearance of Proof of Reserves and Validator Services on the menu. Those are not reviews of someone else’s system; they are operational roles. Proof of Reserves puts CertiK in the business of attesting that a custodian’s assets back its liabilities, a job closer to an accounting firm’s than a code auditor’s. Validator Services goes further still, putting CertiK’s own infrastructure into the live operation of networks it might also be asked to assess.

That move toward running infrastructure, not just grading it, is where a fresh conflict hides. An auditor that also operates validators, or that attests to the reserves of a client paying for other services, has to manage the same independence questions that haunt any firm selling both assurance and operations. The industry has seen this pattern before in a friendlier form: OpenZeppelin, the audit shop whose libraries secure a large share of Ethereum contracts, was bought by S&P Global in 2026, a deal we covered in our look at the auditor S&P Global just acquired. Security assurance is consolidating into financial infrastructure, and CertiK wants to be a pillar of it rather than a vendor to it.

The phrase Jiang kept returning to, serving institutions and the regulators who oversee them, cuts both ways. Selling risk dashboards to a bank is one thing. Selling supervision tools to the authority that regulates that bank, while also taking fees from the firms being supervised, is a harder balance to hold. CertiK is not doing anything improper by pursuing both; it is simply moving into a position where its incentives are more tangled than a one-off code review ever made them.

The State-Actor Era

There is a reason the losses keep landing in operational infrastructure rather than contract logic: the people doing the stealing have changed. The most capable adversaries in 2026 are not freelance exploit hunters probing for a reentrancy bug. They are organized groups, several of them state-linked, who treat key management, employee devices, and vendor integrations as the soft targets they are.

Blockchain analytics firm Elliptic estimates that operators with suspected North Korean links stole more than $1 billion across over 51 incidents in 2026, and it assessed a North Korean connection as highly likely in the Bitget case while tying roughly $286 million of the Drift Protocol theft to the same operators, per the figures summarized by Atlas21. Bitget’s own leadership said the attack infrastructure matched patterns associated with North Korean groups, as covered by Startup Fortune, though formal attribution remains open.

What happens after the theft is as telling as the theft itself. The Bitget funds were moved quickly through cross-chain routes, and the vast majority slipped beyond reach before anyone could freeze them, a now-familiar laundering playbook for state-linked crews. The closest precedent is the February 2025 Bybit theft, the largest in crypto history at roughly $1.46 billion, which investigators tied to the same North Korean operators and which also bypassed the smart contract entirely, reaching signers through a poisoned developer workflow, as BleepingComputer detailed. It was the same off-code class as Bitget. The adversary has standardized on attacking the humans and the pipes, and the defense has to follow.

Against adversaries like these, the line of defense that matters is key management and operational security, not clever contract code. It is the same lesson the Bitcoin world keeps relearning about a very different threat: as we argued in our piece on why quantum computers will not out-mine Bitcoin, the real exposure is almost always the keys, not the cryptography or the consensus. A firm that wants to secure digital value in 2026 has to defend the humans, the vendors, and the signing systems around the code, which is more or less what CertiK is now promising to do.

Serving the Regulators Who Don’t Yet Regulate You

Here is the strange thing about CertiK selling supervision tools to regulators: in the United States, there is no regulator that defines what a smart-contract auditor is. Neither the SEC, the OCC, nor the Federal Reserve licenses, accredits, or inspects the firms that audit crypto code. Anyone can print the word audit on a report. That absence is exactly the gap CertiK’s institutional pitch is trying to fill, offering a private standard of trust where no public one exists.

The policy backdrop is shifting fast, which is why the timing is shrewd. The GENIUS Act, signed into law in July 2025, created the first federal framework for payment stablecoins and pulled a slice of crypto decisively into the regulated perimeter, as Skadden summarized. Washington’s agenda for the rest of the year is crowded, a calendar we tracked in our rundown of Washington’s next 90 days. As rules arrive, the demand for credible third-party attestation rises with them, and CertiK wants to be the name on those attestations.

It is also hedging its geography. CertiK named Hong Kong, Singapore, and the UAE alongside the US as venues where it feeds into policy, the same jurisdictions now building the clearest stablecoin and custody regimes outside America, a shift we described in our analysis of Asia becoming the third pole of stablecoin rules. A firm positioning itself as trust infrastructure wants to be embedded wherever the rules are being written, not just in one capital. The risk is subtle but real: an auditor that advises regulators on standards it also sells compliance against is shaping the market it profits from.

The Issuer-Pays Problem a Listing Can’t Fix

Hovering over the rebrand is a corporate ambition CertiK has not hidden. At Davos in January 2026, Gu said he wanted CertiK to become the first publicly listed Web3 cybersecurity firm. “We still do not have a very concrete IPO plan. But this is definitely the goal we are pursuing,” he told The Block. CertiK has signaled it holds more cash than it has raised, a rare profitability tell for a crypto company, which is part of what makes a multibillion-dollar listing plausible rather than aspirational.

An IPO would not solve the structural issue at the heart of the audit business, and might sharpen it. Audits run on an issuer-pays model: the project being audited chooses and pays the firm that grades it. That is the exact arrangement that let credit rating agencies stamp AAA on subprime mortgage bonds in 2008, because the banks issuing the bonds were the ones writing the checks. The difference is that rating agencies are at least registered and supervised; the big ones are SEC-recognized Nationally Recognized Statistical Rating Organizations, overseen by the agency’s Office of Credit Ratings. Smart-contract auditors have no such regime. A public listing adds disclosure and legal exposure, both genuine improvements, but it also stacks quarterly growth pressure on top of a model that already rewards volume over the uncomfortable no.

CertiK’s own history shows how that pressure can bite. In June 2024, its researchers exploited a bug in Kraken’s deposit system and withdrew around $3 million of the exchange’s funds, then, Kraken said, resisted returning the money without discussing a reward. Kraken security chief Nick Percoco did not mince words to CoinDesk: “This is not white-hat hacking, it is extortion.” CertiK framed it as legitimate research; the funds were returned, some routed through a mixer first.

The harder case is Huione. CertiK audited a stablecoin contract tied to Huione, a Cambodian marketplace that Elliptic later called the largest illicit online marketplace ever assembled. When the link surfaced, CertiK apologized, telling DL News: “We sincerely apologise to the community. CertiK does not support or condone any of the activities undertaken by Huione,” and said it had listed the token at its lowest risk score with a warning after the client refused further verification. The US Treasury later designated Huione a primary money-laundering concern under Section 311 of the Patriot Act, in a Federal Register notice. An audit, these cases show, is a statement about code, not about the character of the people shipping it.

Fighting AI With AI

CertiK AI Auditor, listed among the rebrand’s core products, is the firm’s answer to a problem it also helped document: artificial intelligence is making both code and attackers cheaper and faster. CertiK launched the tool in April 2026, claiming an 88.6 percent cumulative exact hit rate against 35 real-world incidents from the year, tuned for low false-positive noise, as reported by Chainwire. It is pitched as a complement to human auditors, handling baseline detection, pre-audit triage, and continuous monitoring rather than replacing judgment.

A month later CertiK added an AI Skill Scanner that scores the behavior of third-party AI-agent skills before they are installed, grading them from 0 to 100 with a pass, warn, or fail verdict and flagging risks such as unauthorized data access and autonomous fund movement, per Crypto News. The reason that product exists is the same reason the losses moved off-code. As Gu put it to Forbes, “an AI agent with wallet access is essentially a new kind of privileged key holder, except its decision-making can be manipulated through inputs in ways a human might catch and a poorly guardrailed agent won’t.” The threat surface is no longer a contract; it is a decision-maker that can be talked into signing.

The honest caveat is that automation cuts both ways. The same models that triage vulnerabilities can write insecure code at scale and iterate on exploits the way a human attacker would. CertiK’s bet is that machine-speed defense is the only credible response to machine-speed offense, and that a human still has to decide what the machine’s findings mean. That is a reasonable bet. It is not a guarantee, and the firm is careful not to sell it as one.

What an Audit Can and Cannot Promise

Strip away the rebrand and the core truth is unchanged: an audit is a time-stamped, scoped opinion about a specific body of code, not a warranty on a living system. It can meaningfully reduce the odds of a logic bug shipping. It cannot stop a backend server from being compromised, a signer’s laptop from being poisoned, an admin key from being stolen, or a bridge outside its scope from being drained. Those are the failure modes that produced nearly all of 2026’s losses, which is why the smartest reading of the rebrand is that CertiK is selling the coverage an audit never provided.

For anyone using a CertiK badge, or any auditor’s badge, as a signal, a few habits separate informed trust from blind faith:

• Read the scope, not the logo. An audit covers named contracts at a named commit. Bridges, oracles, upgrade keys, and off-chain infrastructure are often excluded.
• Check the date. Code audited once at launch and never revisited carries a danger window that stays open, in Gu’s phrase, long after the report is filed.
• Ask who holds the keys. Most 2026 losses were key management and operational failures. A clean audit says nothing about multisig hygiene or admin-key custody.
• Treat continuous monitoring and an active bug bounty as more reassuring than a one-time pass. The WEMIX reset is the model, not the exception.
• Remember who paid. Under issuer-pays, the audited project chose the auditor. That does not make the work wrong, but it is context worth holding.

What to Watch Next

The rebrand lands in a market that is calm on the surface and jumpy underneath. Bitcoin traded around $82,350 on October 16, firm despite a run of strong inflation data, per Fortune. Prices are not the story here; the story is whether trust can be productized faster than attackers can route around it.

Three things will tell you whether CertiK’s bet is working. First, the Bitget post-mortem: a detailed account of how a backend system was turned against an exchange’s own signing workflow would do more for the industry than any slogan, and CertiK is well placed to help write it. Second, the October and fourth-quarter numbers: September was the worst month of 2026, and if the off-code pattern holds, it vindicates the pivot while indicting the old audit-only model. Third, the IPO: a public filing would force CertiK to disclose exactly how it makes money, which would finally let outsiders judge whether the issuer-pays conflict is being managed or merely managed around.

The most useful way to read the rebrand is as a diagnosis the whole industry should share. CertiK is telling its clients that the code is rarely the problem anymore, and that securing digital value means watching the keys, the vendors, the humans, and the live system long after the audit is filed. Whether a single firm can be trusted to sell that assurance to both the watched and the watchers is the question the next year, and a possible IPO, will answer.

Frequently Asked Questions

What is CertiK?

CertiK is one of the largest blockchain security firms, founded in 2018 in New York by academics Ronghui Gu and Zhong Shao. It began with smart-contract audits and formal verification and now also sells continuous monitoring, compliance tooling, penetration testing, proof of reserves, and validator services. In October 2026 it rebranded as The Trust Layer for Digital Value, positioning itself for institutions and regulators as well as crypto projects.

Did CertiK audit Bitget before the September 2026 hack?

No. CertiK did not audit Bitget. The firm commented on the roughly $351.6 million September 2026 theft as a security monitor, not as the exchange’s auditor. Bitget said the attack came through a compromised backend system that spoofed transfer data and triggered its own authorization workflow, and that private-key compromise was ruled out, so it was not a smart-contract failure an audit would have caught.

Does a CertiK audit mean a crypto project is safe?

No. A CertiK audit is a scoped, time-stamped opinion on specific code at a specific commit, not a guarantee of safety. Most 2026 losses came from operational failures, compromised keys, backend systems, and bridges that often sit outside an audit’s scope. A clean audit reduces the risk of a code bug but says nothing about key management or what happens after launch.

What does CertiK’s Trust Layer for Digital Value rebrand mean?

The rebrand marks CertiK’s shift from a Web3 code auditor to a broader security, compliance, and risk provider for financial institutions, regulators, and enterprises. It reflects the reality that in 2026 most crypto losses happened off-code, in operational and infrastructure failures, so CertiK is selling monitoring, compliance, and risk tools alongside its audits.

Is CertiK planning an IPO?

CertiK has said it wants to become the first publicly listed Web3 cybersecurity firm, a goal CEO Ronghui Gu described at Davos in January 2026, but the company has not set a concrete timeline. It carried a roughly $2 billion valuation from a 2022 funding round and has signaled it holds more cash than it has raised.

By Anneke de Vries, security desk editor at HOGE Wire, covering crypto audits, exchange security, and on-chain forensics.