Cross-chain bridges have become the most popular solution to support asset interoperability between heterogeneous blockchains. However, while providing efficient and flexible cross-chain asset transfer, the complex workflow involving both on-chain smart contracts and off-chain programs causes emerging security issues as we highlighted in a recent <a href="https://halborn.com/what-is-a-cross-chain-bridge-and-how-are-bridges-hacked/">blog post</a>. Last year, there were a dozen severe attacks against cross-chain bridges, causing billions of dollars of losses.<h2>Bugs in Cross-Chain Bridges</h2><a href="https://halborn.com/what-is-a-cross-chain-bridge-and-how-are-bridges-hacked/">Cross-chain bridges</a> are applications that act as intermediaries between users on different blockchains. Users lock various tokens on different blockchains to the bridge, and the bridge takes responsibility for validating these locked tokens, performing cross-chain trading logic like deposit or swap, and unlocking target tokens to users.Cross-chain bridge bugs are software errors that affect the functionality and security of cross-chain bridges. These bugs can potentially be exploited by malicious actors to steal assets or data that is being transferred between different blockchain networks.There are many different types of cross-chain bridge bugs, and the type of bug will depend on the specific software and technology that is being used.&nbsp;<h3>Some of the most common types of cross-chain bridge bugs include:</h3><ul><li>Vulnerabilities in smart contract code, which can be exploited by hackers to gain unauthorized access to the network and steal assets.</li></ul><ul><li>Inconsistencies between on-chain and off-chain components, which can cause the bridge to malfunction or become unresponsive.</li></ul><ul><li>Bugs in the bridge&#8217;s transaction validation logic, which can allow invalid or malicious transactions to be processed.</li></ul><ul><li>Security vulnerabilities in the bridge&#8217;s software or infrastructure, which can be exploited by hackers to gain access to the network or disrupt its operations.</li></ul><h2>How to Avoid Cross-Chain Bridge Bugs</h2>To prevent cross-chain bridge bugs from occurring, it is important for developers to carefully test and audit their code to ensure that it is free from vulnerabilities. This can help protect users&#8217; assets and data, and can also help to maintain trust and confidence in the cross-chain bridge technology.To mitigate these vulnerabilities, it is important for users to carefully research and evaluate cross-chain bridges before using them. This should include looking for signs of strong security and reliability, as well as considering the potential risks and rewards of using a particular bridge.By taking these steps, users can help to ensure that they are using a reliable and secure cross-chain bridge solution for their needs. This can help to protect their assets and data, and can also help to support the growth and development of the broader blockchain ecosystem.At Halborn, we’re always happy to help you review your source code for these types of errors and more. To talk to one of our blockchain experts about cross-chain bridge source code reviews or any other Web3 security topics, drop us a line at halborn@protonmail.com.

Cross-Chain-Bridge-Bugs-A-Growing-Problem.jpg

Web3 security firm Halborn provides an overview of the most common types of bugs affecting cross-chain bridges.

Cross-Chain Bridge Bugs: A Growing Problem

In October 2022, Halborn appointed its first Chief People Officer: Laura Cooper. Laura will be spearheading all things related to People including Workforce Planning and Strategy, Talent Acquisition, Performance, Development, Culture and Engagement.&nbsp;Based in New Jersey, Laura started her career as an Attorney before transitioning to HR on Wall Street for Salomon Brothers, Samsung and NICE Systems. In 2017 she transitioned from large global corporate to the dynamic VC startup space and continued her trajectory into the world of crypto and Web3.We sat down with Laura for a quick interview on her new role as CPO at Halborn.&nbsp;<ul><li>What does being a Chief People Officer mean to you?&nbsp;</li></ul>So many amazing things, and in terms of the company, it means I have the privilege of working with the executive team to ensure the business moves forward and thrives while creating the best experience for the dedicated employee population who work here. It means that I have the privilege of standing as a champion of our culture, mission and vision.<ul><li>Why did you choose to come work for Halborn?</li></ul>I knew Halborn from my previous CPO role. Halborn helped us protect ourselves and our clients with spectacular work that showed us risks and threats we otherwise wouldn’t know we had. I was so impressed with the company as well as the co-founders Rob Behnke and Steve Walbroehl. The elite nature of the engineers who work here, the invaluable products and services Halborn offers to the market were all significant drivers in the decision.&nbsp;<ul><li>You’ve gone from martech to fintech to Web3. What interests you the most about the world of Web3?&nbsp;</li></ul>Web3 is changing the way we interact in many fundamental ways, but especially in business. I love the freedom that Web3 brings. The Web3 networks are permissionless where users and providers don&#8217;t need centralized controlling organizations. It’s so different from how we used to operate, always with central parties and middle organizations. I love being part of this disruptive and innovative world.<ul><li>What are some of the challenges you think you’ll face when recruiting offensive security engineers?&nbsp;</li></ul>It’s an extremely competitive market and the need for strong offensive security engineers is never going to go away. The risks are always advancing and changing so we have to be just as agile in finding the talent to meet those challenges. My goal is to help Halborn maintain the elite cyber security it provides as well as become the absolute best place to work for offensive security engineers.<ul><li>What’s one of the best kept secrets of HR professionals?&nbsp;</li></ul>So much of what we do is deeply confidential, but HR professionals are always driving the business forward. Most people see only 25% of what we do for an organization because the other 75% is beneath the surface.&nbsp; We do so much more than the organization overtly sees. So, I’m afraid I have to answer that what happens with People has to stay with People!<ul><li>What are some of the talents or skills you look out for when hiring in tech?&nbsp;</li></ul>What I look for is the ideal combination between what people do (their experience) and how people do it (their behavior). Great teammates for Halborn are not only very strong in their experience, they also are wonderful to work with. Friendly, accountable, curious and autonomous are some of the great traits of our team.&nbsp;<ul><li>Have your personal passions ever influenced your approach to work?&nbsp;</li></ul>Yes, I studied philosophy in college and am a huge follower of the principles of Marcus Aurelius, Seneca, and others who wrote extensively on how to live and work in harmony with the people around you and, at the same time, push yourself to your fullest potential. The four Stoicism tenets of Wisdom, Temperance, Courage and Justice are things I practice every day both personally and at work.To connect with Laura Cooper, find her <a href="https://www.linkedin.com/in/lauracoopersphr">on LinkedIn</a>. If you’re interested in working for Halborn, check out our <a href="https://halborn.com/careers/">Careers</a> page.

Laura-Cooper-CPO-Halborn.jpg

Laura Cooper sits down to discuss her new role as Chief People Officer at blockchain security firm Halborn.

Introducing Laura Cooper, Halborn’s New Chief People Officer

Halborn is excited to announce the launch of its blockchain and smart contract security VM (Virtual Machine): <a href="https://www.ziion.org/">ZIION</a>.ZIION is a blockchain security VM that is open-source (free to use!), end-to-end, pre-compiled, multi-architecture, and multi-protocol.&nbsp;<div class="wp-block-image"><figure class="aligncenter is-resized"><img decoding="async" loading="lazy" src="https://lh3.googleusercontent.com/YVAj1z64cmZm6JG1wridATdSQEC_JzgVoKbzjnypTQRI9rX2eZs1Y0-mrCC0gpI0-JMNbceNeocyj2gDSG90HhslaVd--Ey0_9Jo6IraMUi-CeE9l_i7vG4aPVf7wTMULis8PrRbaIGj9t5gmgs_AW0" alt="" height="466"/></figure></div>“Kali Linux is a great tool for pen testers and auditors,” says Halborn co-founder Steve Walbroehl, “but it’s not really equipped for the security needs of blockchain development. That’s why our best-in-class blockchain security engineers at<a href="https://twitter.com/halbornsecurity"> </a>Halborn built ZIION, a true turnkey VM with all the tools needed to securely build and develop in Web3.”&nbsp;With a goal to simplify blockchain development and security testing, security engineers can build on top of Bitcoin, Ethereum, Solana, Polygon, and more. ZIION features 100+ tools, utilities, dependences, and packages.&nbsp;ZIION features:<ul><li>Protocol tools</li><li>EVM tools &amp; fuzzers</li><li>Rust tools &amp; fuzzers</li><li>VCCodium extensions</li></ul>Made by blockchain security engineers for blockchain security engineers, ZIION is a security VM that caters exclusively to Web3 developers.&nbsp;Find out more about ZIION at <a href="https://www.ziion.org/">ZIION.org</a> or <a href="https://www.ziion.org/download">download ZIION</a> today.

ZIION-Open-Source-Smart-Contract-Security-VM.jpg

Cybersecurity firm Halborn announces the launch of its blockchain and smart contract security VM (Virtual Machine): ZIION.

Halborn Launches ZIION, an Open Source Web3 Security Testing and Development VM

On July 19, 2022, Halborn announced via an exclusive <a href="https://www.bloomberg.com/news/articles/2022-07-19/blockchain-security-startup-raises-90-million-despite-crypto-winter">in Bloomberg</a> the completion of a $90 million Series A funding round, the first external funding in our firm’s history.&nbsp;Global growth investor Summit Partners led the Series A round, with participation from Castle Island, Digital Currency Group, Brevan Howard, Third Prime, Sky Vision Capital, and Fenwick.&nbsp;In addition to the Bloomberg exclusive, the funding announcement was featured in Fortune, TechCrunch, WSJ PRO Venture Capital, SiliconANGLE and Miami Inno.&nbsp;Profitable since inception, co-founders Steven Walbroehl and Rob Behnke bootstrapped Halborn into a world-class Web3 security firm. Today, Halborn is growing rapidly, serving over 250 clients focusing on Layer 1 blockchains, infrastructure providers, financial institutions, and application and game developers. Some of Halborn&#8217;s most notable clients include Solana Foundation, Avalanche, and Figment.In a <a href="https://www.globenewswire.com/en/news-release/2022/07/20/2482710/0/en/Blockchain-Security-Firm-Halborn-Raises-90M-Series-A-Led-by-Summit-Partners.html">press release</a> about the funding announcement, co-founder Walbroehl stated: &#8220;With security vulnerabilities dominating the crypto news headlines, and over $1.5 billion in financial losses from DeFi hacks in 2022 to date, the demand for Web3 security is only growing. Funding from this Series A will be used to <a href="https://halborn.com/careers/">expand our global team of offensive security engineers</a> and build our Halborn Labs division, accelerating our robust pipeline of SaaS security products.&#8221;&nbsp;Today, over 100 of the best and brightest security engineers from around the world are part of Halborn’s elite security advisory.&nbsp;<h2>Quotes from some of our investors:&nbsp;</h2><h3>Summit Partners</h3><blockquote class="wp-block-quote">Summit has a long history of partnering with innovative cybersecurity leaders focused on protecting against both monetary and data breaches in a constantly evolving and ever-expanding threat landscape. We believe the stakes and costs are even higher in Web3, given the decentralized development of and the dollars controlled by Web3 applications.In a very short time, Halborn has established itself as a globally recognized brand in blockchain security working across Web3 and Web2 environments. The Halborn team has earned a reputation for tackling complex projects and has an impressive record of identifying high-profile vulnerabilities and breaches. <cite>Matt Hamilton, Managing Director @ Summit Partners</cite></blockquote><h3>SkyVision Capital</h3><blockquote class="wp-block-quote">As the cryptocurrency industry continues to evolve with innovative protocols being built in the Gamefi and DeFi sectors, there needs to be an emphasis of Cybersecurity to protect all stakeholders and most importantly community members. SkyVision Capital (SVC) is excited to support Halborn, an experienced cybersecurity company that focuses on smart contract auditing to mitigate potential exploits and hacks. We look forward to seeing the growth of Halborn as the blockchain sector continues to grow in the bear and bull market.<cite>Patrick Wu, Partner @ SkyVision Capital</cite></blockquote><h3>Castle Island Ventures</h3><blockquote class="wp-block-quote">Cybersecurity is a critical infrastructure category that will unlock greater participation in the public blockchain industry. We are thrilled to invest behind the team at Halborn as they make this market more accessible.Halborn has established a leadership position working with the leading centralized and decentralized groups in the blockchain industry. We are thrilled to be partnering for their next phase of growth.Cybersecurity risk has historically been a great reason to avoid launching products in the blockchain industry. Halborn is changing this risk/reward equation and in doing so expanding the addressable market for public blockchain technology. We are thrilled to partner with Halborn as they expand their product offering.<cite>Matthew Walsh, Founding Partner @ Castle Island</cite></blockquote><h3>Third Prime</h3><blockquote class="wp-block-quote">Third Prime is focused on investing in market leaders in the most important areas of crypto. With Halborn, we&#8217;ve clearly hit the mark. The team, track record and technology are unparalleled and we&#8217;re excited to partner with them as they secure the most important companies in this space.<cite>Wes Barton, Managing Partner @ Third Prime </cite></blockquote>

Halborn.jpg

On July 19, 2022, Halborn announced the completion of a $90 million Series A funding round led by Summit Partners.

Web3 Security Firm Halborn Raises $90M Series A Led by Summit Partners

On August 16 at approximately 9:30 AM EST, a vulnerability in Stader’s NearX smart contract was exploited. The Stader team along with Halborn quickly contained the exploit, protecting most funds.&nbsp;The loss was estimated at ~165k NEAR and was limited to the Dex’s. The ~2.5Mn $NEAR staked on the Stader dapp remained safe with validators. Stader has demonstrated strong leadership and commitment to its users by announcing to fully reimburse users for their losses on the LPs. Please find more details here: <a href="https://twitter.com/stader__near/status/1559992693471604736">https://twitter.com/stader__near/status/1559992693471604736</a>The technical nuances that led to the exploit are as follows:When reading from storage, NEAR creates a snapshot that is loaded to runtime memory.&nbsp;When NEAR attempts to load the same variable into runtime memory it creates a copy.&nbsp;Stader’s smart contract was written with the assumption that the runtime variable would always point to the same object in memory (not a copy).&nbsp;Because of this, when a token transfer was executed with sender and receiver being the same user, it resulted in two variables corresponding to the balances. Both were associated with the sender, however, one’s balance was reduced and the other’s was increased. Then both variables were saved to the storage; however, the increased balance was saved last, overwriting the previously saved decreased balance. The attacker was then able to generate tokens out of thin air.&nbsp;Here is the <a href="https://blog.staderlabs.com/stader-near-incident-report-08-16-2022-afe077ffd549">full incident report from Stader Labs</a>.&nbsp;This was one of the rare occurrences where we worked with a memory storage assumption, and discovered otherwise during the post-mortem and the fix. As soon as the attack was discovered, Halborn and Stader worked together to identify the root cause, halt the contract, and deploy a fix. We have audited this fix and are confident that this exploit cannot happen again.As a cybersecurity firm dedicated to cutting-edge technology in the wild world of web3, we stand behind our record of quality research and capabilities.&nbsp; That said, security is an art and we take full responsibility for not finding this truly impressive exploit.&nbsp; One of Halborn’s core values is Kaizen, a Japanese concept around continual learning and improvement.&nbsp; NEAR is a new, exciting ecosystem and we strive to continue our research and only improve our auditing capabilities within it. For more info on Stader Labs, visit:TG:<a href="https://t.me/staderlabs_near_official"> https://t.me/staderlabs_near_official</a>Twitter:<a href="https://twitter.com/stader__near"> https://twitter.com/stader__near</a>Main Discord:<a href="https://discord.gg/asBqz79Hv9"> https://discord.gg/asBqz79Hv9</a>

Stader-Labs-NearX.jpg

On August 16, a vulnerability in Stader’s NearX smart contract was exploited. Cybersecurity firm Halborn provides an update on what happened.

Stader Labs NearX Update

Ferran Celades, a security researcher at Halborn, discovered and reported a vulnerability in how the Secure Cadence update to Cadence manages resources, during the Halborn-Dapper Labs audit engagement.&nbsp; In some cases,&nbsp; Cadence, the smart contract programming language of Flow blockchain, inappropriately allowed the access and use of destroyed resources.<h2>Background</h2>Cadence has the concept of resources, which are single-use types that can only exist in a single location at a time.&nbsp; After the resource is declared and created, it must be either moved or destroyed after use.If resources aren’t properly moved or destroyed, they are considered “lost”.&nbsp; If a lost resource exists within a program, then it will not be allowed to execute.&nbsp; Also, attempts to use a destroyed reference will also block the program’s execution.References in Cadence can point to resources and allow access to fields and call functions on that object.&nbsp; If a reference points to a destroyed resource, it will be unwrapped to that resource and the program will not allow execution.<h2>Bypassing Resource Protections with Optionally-Typed References</h2>With the Secure Cadence milestone in June 2022, it is possible to create references to optional variables.&nbsp;These optional variables are checked to see if they hold a value — i.e. are not nil — and then unwrapped to the underlying value.If a value is present, a reference to the value is created; if not, nil is returned.&nbsp;&nbsp;However, when a resource was destroyed, the interpreter did not invalidate references to it, making it possible to access fields and call functions on a destroyed resource.The proof of concept that we submitted to the Cadence team, shown below, demonstrates this issue: It retrieves an item from a dictionary, creates an optional reference, and, in this case, the reference r1 is a key to the dictionary.&nbsp; The variable ref still holds a valid reference to the resource even after the resource and dictionary have been destroyed, allowing access to the resource that should no longer exist.<img decoding="async" loading="lazy" src="https://lh5.googleusercontent.com/hZObUDxtJmKpiPTXPKFoDwdeVQr_ZvElXjRT1oMpmACSh7nw9yS0A1RyQ5GTvnq6TiNxX4ls6RGSm9YSgxfgCwr0u7rMRkVvC67pSBtZVS-SHvgrLIWui3nMKSCppggy1drJYwL3YPV8gsRdY9g" height="941"><h1>Patching the Vulnerability</h1>The Cadence interpreter has been updated so that when a reference to an optional is created, the type of the inner value is checked. If it is a resource, it is tracked throughout its lifetime. Once the referenced resource is destroyed, also all references to it are invalidated,&nbsp;so they cannot be accessed anymore.

Halborn-Appoints-New-Field-CISO-Paul-Merugu.jpg

A security researcher at Halborn has discovered and reported a vulnerability in how the Secure Cadence update to Cadence manages resources.

Halborn Discovers High-Impact Vulnerability in Cadence (Flow)

We’re excited to announce the appointment of <a href="https://www.linkedin.com/in/davidschwed">David L. Schwed</a> as Chief Operating Officer at Halborn.Schwed most recently served as the Global Head of Digital Assets Technology for BNY Mellon, the world&#8217;s largest custodian bank, where he was responsible for integrating the IT strategy for BNY Mellon’s digital asset offerings across the enterprise.&nbsp;Schwed has more than 21 years of information technology, information security, and risk management experience. He has worked in the financial services sector at a senior level for BNY Mellon, Merrill Lynch, Salomon Smith Barney, Citigroup, and Galaxy Digital. He also holds various industry leading certifications in cryptocurrency, cybersecurity, and IT audit. He was also the founding director and professor of the cybersecurity Master&#8217;s program for the Katz School of Science and Health at Yeshiva University where he is currently their practitioner-in-residence.&nbsp;&nbsp;Schwed is a member of the New York Bar and graduated Magna Cum Laude from Hofstra University School of Law where he was an associate editor of the Hofstra Law Review.On why he chose to join Halborn as the blockchain security firm’s new COO:<blockquote class="wp-block-quote">&#8220;Security is integral to the success of the Blockchain ecosystem and there is no better organization than Halborn when it comes to Web 3 security.I’ve known the Halborn team for many years and, as a former client of Halborn, I know first hand how amazing our engineers are. It was a no-brainer when the opportunity presented itself to join as their COO.&#8221;<cite>David L. Schwed</cite></blockquote>

Blockchain security firm Halborn announces the appointment of David L. Schwed as its new Chief Operating Officer.

Halborn Appoints New COO David L. Schwed

We’re excited to announce the appointment of <a href="https://www.linkedin.com/in/david-chaskin-931223/">David Chaskin</a> as Chief Financial Officer at Halborn.Chaskin is a highly accomplished accounting and financial management executive with more than 25 years of experience in finance and operations management within startups and global, multi-billion dollar organizations.&nbsp;On what attracted him to Halborn, Chaskin says:<blockquote class="wp-block-quote">I have always been a big believer in blockchain technology and feel we are only at the beginning of what it can become. While I was in the interview process, co-founder Rob Behnke asked for a couple of recommendations. One was my old CEO at Element, who now is a Managing Partner at a VC firm that invests in digital asset ecosystem companies. When I told him about Halborn, the first thing he said was “Can you introduce me to them?” That, combined with the exceptional talent at Halborn, was all I needed to hear to know that Halborn was the place for me. </blockquote> Halborn continues to be one of the fastest growing companies in the Web3 security space, with over 250 clients and over 100 of the best and brightest security engineers in its fully remote workforce. If you’re a security expert looking to join our team, visit our <a href="https://halborn.com/careers/">Careers</a> page or our <a href="https://www.linkedin.com/company/halborn">LinkedIn</a> and get in touch!

Elite blockchain security firm Halborn announces the appointment of David Chaskin as Chief Financial Officer.

Halborn Appoints New CFO David Chaskin&nbsp;

The Security Research Team at Halborn has discovered a critical vulnerability affecting many major cryptocurrency wallets. Wallets that were affected include MetaMask, Brave, Phantom, and xDefi, who have remediated the issue.&nbsp;Under the right conditions, the vulnerability &#8211; which we code-named “Demonic” &#8211; can expose a crypto wallet user’s secret recovery phrase which can in turn be used to reconstruct their private key, allowing attackers to access billions of dollars worth of cryptocurrencies and NFTs held in browser extension wallets.You can view the full technical details and remediation recommendations on the <a href="https://halborn.com/disclosures/demonic-vulnerability">Demonic Vulnerability announcement page</a>. Refer to the <a href="https://medium.com/@danfinlay/d437d4250863">MetaMask Blog Post</a> and <a href="https://phantom.app/blog/demonic-vulnerability">Phantom Blog Post</a> for more useful information from their teams.Due to the severity of the vulnerability and the number of impacted users, technical details were kept confidential until a good faith effort could be made to contact affected wallet providers.&nbsp;&nbsp;Now that the wallet providers have had the opportunity to remediate the issue and migrate their users to secure recovery phrases, Halborn is providing in-depth details to raise awareness of the vulnerability and help prevent similar ones in the future.<h2>How does it work?</h2>Browser extension cryptocurrency wallets that use an input field for a <a href="https://en.bitcoin.it/wiki/Seed_phrase">BIP39 mnemonic</a> can cause the secret recovery phrase to be stored on-disk in plain text where an attacker that has physical or logical access to the device can retrieve it and gain access to the wallet.<h2>Who is affected? What should they do?</h2>Users: Users who have imported their browser based crypto wallet using a secret recovery phrase may be impacted.&nbsp;The risk is present if all of the following conditions were met:<ul><li>The hard drive was unencrypted</li><li>The Secret Recovery Phrase was imported into a browser extension wallet using a device that is no longer in the user’s possession or is logically compromised</li><li>The user used the “Show Secret Recovery Phrase” checkbox to view the seed phrase on-screen during import</li></ul><figure class="wp-block-image"><img decoding="async" src="https://lh5.googleusercontent.com/rkLgf6cWm-fAI8Z-AbIFWooSuKBriVeawJ2B5HCovo1kklDXndADA7E4QogOM4siHty-TiFalokZ-n6909FFpb18J-pKyhGEWwjuijN7eZ6BCXwNeb3MKPrZdmP1wTvgs1Z-mqUW72nJle7o8g" alt=""/></figure>It is recommended that users who believe they may be affected migrate to a new set of accounts. MetaMask has prepared <a href="https://metamask.zendesk.com/hc/en-us/articles/4867408571803">instructions on how to migrate</a> for their users.&nbsp;Rotating passwords/keys and the use of a hardware wallet in conjunction with the browser based wallet can also provide increased security for users. Enabling local disk encryption is another best practice which mitigates this issue.Desktop application cryptocurrency wallets and web based wallets may be prone to similar issues but due to the disparity of offerings we have not investigated that in depth.Wallet Providers: Wallet Providers who believe they may still be susceptible to the vulnerability are strongly encouraged to follow the mitigation suggestions outlined on the Demonic Vulnerability Disclosure page.Have concerns, want to learn more, or have a bug you’d like to disclose? Please reach out to us at <a href="mailto:disclosures@halborn.com">disclosures@halborn.com</a>.Halborn is hiring! If you’re someone who can help make our products and this industry more secure, consider <a href="https://www.linkedin.com/company/halborn/jobs/">joining our team</a>.

Vulnerability Affecting Crypto Wallet Browser Extensions Demonic Halborn MetaMask

Vulnerability-Affecting-Crypto-Wallet-Browser-Extensions-1.jpg

On June 15 2022 Halborn revealed the discovery of a critical vulnerability affecting crypto wallets MetaMask, Brave, Phantom, and xDefi.

Halborn Discovers Critical Vulnerability Affecting Crypto Wallet Browser Extensions

Halborn is thrilled to announce the appointment of Paul Merugu as the new Field CISO to spearhead our ambitious scaling and product development plans following our recent acquisition of <a href="https://www.globenewswire.com/news-release/2022/01/27/2374424/0/en/Blockchain-Cybersecurity-Firm-Halborn-Acquires-Web3-Automation-Startup.html">Web3 automation startup Abyss Consulting</a> and the launch of our new Research and Development division, Halborn Labs.Paul Merugu is a cybersecurity industry expert with over 15 years of experience working across multiple industries including banking, financial services, healthcare, insurance, hospitality, retail and technology. He has held senior positions at Ernst &amp; Young Consulting and CA Technologies where he worked as a trusted security adviser to various Fortune 500 companies and successfully delivered several large security programs. He has a background in computer science and specialized in security architecture. He’s an engineer at heart who loves to dig into complex cyber security problems and solve them with modern technology.&nbsp;&nbsp;“Halborn is one of the best blockchain and DeFi security companies in the world,” said Merugu. “I am incredibly excited to work with the impressive roster of security talent at Halborn to develop a full stack offering of security services and products for DeFi, Web3, NFTs and smart contract platforms.”&nbsp;Halborn Co-Founder and CISO Steven Walbroehl echoes Merugu’s excitement: “Paul’s appointment as the Field CISO takes the Halborn’s cybersecurity growth trajectory to a new horizon. His undoubtable tech, management and people skills will be a strong asset to scale and expand Halborn’s security services and products in the near future.”Halborn has been one of the fastest growing companies in the Web3 space, with over 150 blockchain companies as clients and a staggering 1,150% YoY growth rate. If you’re a security expert looking to join our team, visit our <a href="https://halborn.com/careers/">Careers</a> page and get in touch!

Blockchain cybersecurity firm Halborn announces the appointment of security expert Paul Merugu as new Field CISO.

Halborn Appoints New Field CISO Paul Merugu

In a <a href="https://www.globenewswire.com/news-release/2022/01/27/2374424/0/en/Blockchain-Cybersecurity-Firm-Halborn-Acquires-Web3-Automation-Startup.html">press release</a> distributed yesterday, Halborn announced their first acquisition: Web3 automation startup <a href="https://www.abyss.io/">Abyss Consulting</a>. The acquisition of Abyss, a former collaboration partner of ours, has accelerated the launch of our new Research &amp; Development division called Halborn Labs.&nbsp;By combining our end-to-end cybersecurity services with Abyss Consulting&#8217;s rapid prototyping, Halborn can now turn its portfolio of security product concepts into fully realized and market-ready tools that make the world of Web3 safer.With our first acquisition, our elite blockchain security team now benefits from the added expertise of Abyss Consulting&#8217;s custom automation services, including automated testing, custom workflows, and proprietary systems designed to reduce company overhead.&nbsp;Abyss Consulting Co-Founders Everett Carney and Sean O´Leary will be leading Halborn Lab’s product development and rapid prototyping units.For more information on the acquisition, read our <a href="https://www.globenewswire.com/news-release/2022/01/27/2374424/0/en/Blockchain-Cybersecurity-Firm-Halborn-Acquires-Web3-Automation-Startup.html">press release</a>.&nbsp;

Blockchain security firm Halborn acquires Abyss

Halborn-acquires-Abyss.jpg

Blockchain cybersecurity firm Halborn announces their first acquisition: Web3 automation startup Abyss Consulting.

// Blog

Halborn

Articles