CertiK

When information is compromised, you can recover it. When value is compromised, the loss may be irreversible. Digital assets have fundamentally changed the stakes of network security. The internet moved data, but blockchains moved value. That distinction is the bedrock of everything we build at CertiK. When we founded CertiK in 2017, we believed security had to start from the first line of code, while security and compliance had to extend across the full lifecycle. Formal verification gave us a rigorous technical foundation. As the digital asset ecosystem grew, our work expanded to include security auditing, continuous monitoring, risk intelligence, AI-driven security, and compliance. This evolution is the thinking behind CertiK’s refreshed brand. The digital economy needs a continuously operating risk management system that helps identify risk, supports proactive governance, and gives regulators, institutions, and innovators greater confidence to participate. Our long-term goal is to build a global risk management and trust platform for the digital economy. The internet era was built on networks that moved information. The next era will depend on infrastructure that allows value to move securely. That is what we mean by building the trust infrastructure for the digital economy.

When an AI system investigates a transaction and acts on it, who is accountable? Agentic AI is taking on more security and compliance work. See what this shift means for financial institutions, and the governance it requires.

As the Web3 world gathers in Singapore for TOKEN2049, a key challenge in security discussions remains: your team can't manually review every alert, trace every fund and watch every chain in real time. Agentic AI is starting to do that work. See what it means for Web3 security, and which controls matter as AI takes on more.

Using the adversarial-testing methodology behind CertiK’s Chain Scan initiative, our researchers independently uncovered five resource-exhaustion vulnerabilities in Besu, the Java-based Ethereum execution client hosted by LF Decentralized Trust. The findings, including two rated Major, affected P2P, consensus, WebSocket RPC, and HTTP JSON-RPC surfaces. Under affected configurations, they could exhaust node memory or thread capacity, potentially disrupting node availability or consensus processing. This was proactive, independent security research—not a client engagement. Our researchers deployed a private, multi-node Besu testnet and deliberately introduced adversarial conditions to observe how the live network responded. All five findings were responsibly disclosed to the Besu team with reproducible proof-of-concept harnesses. Following coordinated disclosure, they were patched in Besu v26.7.1. The research demonstrates what Chain Scan is designed to do: continuously stress blockchain infrastructure under hostile conditions to uncover availability and resource-exhaustion risks that may not surface through code review alone. Read the full research to see what we found, how we found it, and why availability is a critical security property for blockchain infrastructure: https://lnkd.in/dX8vQWzG

Learn how the now-public CertiK AI Auditor combines AI reasoning, structured analysis, and continuous improvement to deliver dependable security scanning for Web3 and beyond.