Securing the code that moves money
The economy is moving on-chain. CoinSec finds and fixes the security risks in the smart contracts that run it.
1. Hack
Our AI attacks your smart contracts the way an adversary would, to find vulnerabilities.
2. Verify
A finding only counts once the exploit is proven, so you work on real risk, not noise.
3. Patch
You get the fix where the bug is, so vulnerable code never reaches production.
Supported and recognized in industry and academia
Grantee
1st place Hackathon, Dutch track
Top 3 Solana Demo Day
Cyber Verification Program
Research collaboration
Attackers now hunt your smart contracts with AI agents, around the clock. Traditional security wasn't built for that reality.
Frequency
Traditional security reviews your code every few months. Attackers hunt it after every change you deploy.
Speed
Traditional security takes weeks to review your code. Attackers go from finding a bug to exploiting it in minutes.
Discovery
Traditional security checks for known vulnerabilities. Attackers hunt for the ones nobody has seen yet.
To keep up, your defense has to be an attacker too: as frequent, as fast and as curious as theirs, so you catch the vulnerabilities before anyone can exploit them. That is what CoinSec does.
Three products. Pick the one that fits how you ship.
withdraw
missing signer check
init_vault
unchecked account owner
collect_fees
arithmetic overflow
close_account
re-initialisation
Pull request: require the vault authority to sign withdraw. Closes the proven exploit from the last push.
Every push
Exploit attached
Patch ready
You merge
High severity2 min ago
amm → vault: price used before update
Found by your dedicated attacker, trained on all four of your programs. The exploit crosses from the swap into the vault.
Before
Exploit
Patch for swap.rs
In this week's report
Pulse
For teams preparing a launch or an upgrade
A one-time audit, every finding proven. Submit your Solana program and get back a report with a working exploit beside every finding.
Every finding confirmed on a fork of the chain.
A report your team and your auditors work from.
Self-serve, no sales call.
Orbit
For teams that ship more often than they audit
Every change attacked, every fix a pull request. CoinSec watches your repository and attacks each change as it lands.
Runs on every push, not once a quarter.
The exploit it closes attached to every fix.
Nothing merges without your review.
Move37
For large protocols, foundations and exchanges
The exploit no auditor would have looked for. Named after AlphaGo's move 37, the move no human would have played.
Learns your programs, your invariants and your fund flows.
Finds the exploits that cross program boundaries.
For large protocols, foundations and exchanges. Scoped with you.
Frequently asked questions
Anything else, contact us.
Are you another LLM wrapper?
No. A language model is only one part of the system. On its own, it is good at spotting common vulnerability patterns but bad at confirming which ones are real, so you get many false positives. We have our own model, Move37, and actually run attacks on your smart contract on a mainnet fork. A finding is only confirmed when the exploit actually works. And Move37 goes after what no pattern catches: the zero-days, the exploits nobody has seen before.
Why attack my own code?
Because that is what the attacker side does. A scanner tells you a line looks risky; an attack tells you whether money can actually leave. Attacking your code before it ships is the only way to know which findings matter, and it is far cheaper to learn that from us than from an exploit on mainnet.
Does it replace a manual audit?
It covers what an audit can't: every change between audits, and the ones you'd never have audited at all. For a major launch, run both. CoinSec partners with tier-1 audit firms for projects that want a manual audit as well, and the report it produces gives those auditors a head start.
Can't I just build this with a Claude skill?
CoinSec only reports a proof of exploit when the attack actually moves funds on a mainnet fork, and that is decided by checking the balances before and after the attack, not by a model's opinion. That matters most for logic bugs, which often cost protocols the most: the damage only shows up when the contract actually runs, step by step. On top of that, CoinSec learns from every exploit it confirms, right away. A general model only learns about a new exploit when its maker retrains it, which can take months.
Does it fit into my existing workflow?
Yes. Pulse is a one-off: point it at a repository and get a report. Orbit connects to your GitHub repository, attacks each change as it lands, and opens a pull request with the fix and the exploit it closes. Nothing merges without your review.
Isn't your AI another security risk for us?
Your smart contract is attacked on a mainnet fork, in an isolated environment, and never deployed. The exploits never touch mainnet. Findings go to your team and nobody else. We run the attacker on your behalf; what it learns about your protocol is used to protect your protocol.
Are you adding more work to my plate?
No. Your engineers have enough to do, so we do the two jobs that eat their week: working out which findings matter, and writing the fix. Findings arrive ranked by what they would cost you, each with a verified patch as a pull request. Your team reviews and merges, and the hours that used to go into investigating and patching go back into building.
What does your AI not cover?
Attacks that happen off-chain: a leaked private key, a compromised front end, social engineering. CoinSec covers the program itself and the way it moves funds. Keep your keys and your front end covered separately.