Halborn

• Name: Halborn
• URL: https://www.halborn.com/
• Category: blockchain security company / audit-publication and offensive-security operator / incident-response workflow shell
• Summary: Halborn belongs in companies/, not only projects/, because the useful question is not what one report did they ship? but which named operator is shaping audit publication, wallet/cloud review workflow, incident-response handling, and the broader security-services shell that downstream teams may treat as part of their live operating perimeter? The practical leverage sits in who scopes reviews, decides what gets published, packages red-team and incident-response work with contract audits, and accumulates cross-environment judgment that customers may reuse as a standing security function.
• What it does:
  • Performs smart-contract assessments, Layer 1 and protocol reviews, cloud and web penetration tests, red-team exercises, AI security work, and incident-response support for digital-asset systems
  • Maintains a large public PublicReports archive spanning Solidity, Solana, Move, CosmWasm, Substrate, wallet, node, infrastructure, and incident-response-adjacent work
  • Publishes first-party security material and tooling through its GitHub organization, including CTF content, Flow/Cadence security practices, and EVM-adjacent tools such as burp-eth
  • Packages wallet, infrastructure, red-team, and protocol-security workflow under one named company boundary rather than leaving them as unrelated one-off engagements
  • Positions itself as a crypto-native security operator rather than a general consultancy with a small blockchain side practice
• Key claims:
  • The homepage frames Halborn as a provider of digital-asset and blockchain security solutions and lists smart-contract assessment, Layer 1 assessment, code audit, web application penetration testing, cloud infrastructure penetration testing, red-team exercises, AI red teaming, and AI security assessment as core offerings
  • The public audit surface and GitHub profile show Halborn operating a broad report-and-research corpus rather than only closed customer work
  • The PublicReports repository exposes a wide taxonomy covering smart contracts, L1 audits, wallet and node reviews, cloud security, incident reports, and zero-knowledge work, which makes the company note more useful than a pretend product note
  • The visible service mix suggests Halborn can become part of a customer’s ongoing security workflow across contracts, infrastructure, wallets, and emergency response rather than acting only as a one-time reviewer
  • Taken together, the primary-source surface says the real control story is a company-run security and response shell: scope, report publication, incident handling, and the reuse of Halborn-authored methods and tooling across live crypto systems
• Whitepaper: No canonical standalone Halborn whitepaper or litepaper is the important artifact here. The clearest primary materials are the official site, audit surface, GitHub organization, and public PublicReports archive already captured in ../whitepapers/halborn-primary-sources-2026-04-30.md.
• Sources:
  • https://www.halborn.com/
  • https://www.halborn.com/audits
  • https://github.com/HalbornSecurity
  • https://api.github.com/users/HalbornSecurity
  • https://api.github.com/users/HalbornSecurity/repos?per_page=100
  • https://api.github.com/repos/HalbornSecurity/PublicReports
  • https://api.github.com/repos/HalbornSecurity/PublicReports/contents

Internal linkages

• Product-layer note collapsed into alias: halborn.
• Useful adjacent company reads: trail-of-bits, openzeppelin, ottersec, and chainsecurity.
• Useful contrast where the emphasis stays more on formal-methods tooling than a broad security-services shell: certora.

Protocol / company boundary

• There is no especially useful standalone Halborn protocol doing the analytical work here.
• The meaningful surface is a company-run review-and-response shell: public audit publication, offensive-security work, cloud and wallet assessment, incident handling, and the reusable security methods customers may adopt as part of their operating routine.
• That is why Halborn belongs in companies/: the practical question is which named organization is shaping review scope, publication norms, incident workflow, and cross-environment security judgment around live systems.

Control surface

• Practical leverage sits in scoping and publication choices, the breadth of security domains Halborn covers for clients, incident-response handling, and the way its public report corpus can become a de facto review baseline.

• The sticky dependency is workflow authority: once a team routes contract review, wallet testing, cloud validation, and emergency response through Halborn, the company becomes part of the real security-operating perimeter even without protocol admin keys.

• Read Halborn as a security-review and incident-response company first, not as a standalone protocol surface.

• Last reviewed: 2026-08-10 UTC