FREE ASSESSMENT

24/7 INCIDENT RESPONSE/UTC+8 06:18:02

ASSET SECURITY FOR WEB3 TEAMS

No security team?We become your security team

Exchange-grade asset protection for blockchain startups, covering employee devices, servers, wallets and signing flows, smart contracts, on-call and incident response. One team owns all of it.

Get a free security check

LIVE TELEMETRY

1hTarget time to take over an incident
6Layers of on-chain + off-chain defense
—Web3 security incidents in the last 30 days, ~— lost
SCANNER // ACTIVESCOPE // MULTI-CHAIN
LIVE: WEB3 SECURITY INCIDENTSDEFILLAMA

Source: DefiLlama hacks database, updated hourly

WHY

Most large thefts start off-chain

In the costliest recent incidents, attackers first took over an employee device, a signing interface, a third-party security product or an ops tool, then moved the funds. None of these are in scope for a contract audit.

LATEST2026-09

Bitget ~$388M

Attackers exploited a zero-day in third-party security products to get inside, used an employee identity to log in to a management platform that pushes tasks to servers, moved laterally to the wallet servers and forged withdrawal commands that bypassed risk controls. Private keys were never exposed and the contracts had no bugs. The funds left through internal tools.

  1. 01Zero-day in a third-party security product
  2. 02Employee identity used on the management platform
  3. 03Batch commands, lateral move to wallet servers
  4. 04Forged withdrawals bypass risk controls
2025-02~$1.5B

Bybit

The multisig signing interface was tampered with, so signers approved a different transaction from the one they saw.

2024-10~$50M

Radiant Capital

Malware on developer devices tricked multisig signers during routine operations.

2024-05~$300M

DMM Bitcoin

Attackers posed as recruiters to reach an employee of the wallet provider and got into the signing system.

Amounts are approximate, based on public reports.

COVERAGE

On-chain + off-chain, one team end to end

From employee laptops to on-chain contracts, we cover every point where funds could leak.

LAYER // 01

Employee devices & accounts

  • Know what runs on every laptop and who can get in
  • 2FA on email, exchange and cloud accounts
  • All access revoked on an employee's last day
LAYER // 02

Servers & cloud

  • Every exposed port and admin panel inventoried
  • Logins to key servers logged and traceable
  • No more keys scattered in code and chats
LAYER // 03

Wallets & signing

  • One person being phished cannot move the funds
  • Multi-party approval and real-content checks before signing
  • Hot/cold tiers, with hot wallets holding only what is needed
LAYER // 04

Contracts & on-chain monitoring

  • Audited before launch, watched after
  • Instant alerts on large moves and permission changes
  • Ability to pause fast on suspicious activity
LAYER // 05

Third parties & supply chain

  • Wallet vendors, plugins and dependencies reviewed
  • Know right away if a vendor incident affects you
  • Security check before onboarding new services
LAYER // 06

On-call & incident response

  • Someone takes over within 1 hour
  • Containment, forensics, tracing and comms
  • Regular drills to prepare for real incidents

CASE STUDIES

What we have done

Client names are anonymized for confidentiality.

CASE // 01 · QUANT MARKET MAKER

A quantitative trading market maker

Problem
Production servers were breached by attackers; the client needed to contain the incident and prevent another compromise.
What we did
Deployed CrowdStrike Falcon endpoint protection with detection and prevention policies tuned to the client's workloads, and put the production network and internal systems behind zero-trust access instead of direct exposure.
Result
More than a year of ongoing service with no fund-loss incidents.

SOLUTIONS

Built for teams like yours

Exchanges, protocols, market makers, OTC desks, wallets, funds and on-chain studios each need different protection.

01Centralized exchangesSpot and derivatives exchanges, and their wallet and risk teams→02DeFi & protocolsProtocols, ecosystem projects and token teams→03Quant & market makersQuant funds, market makers and trading-bot teams→04OTC & payment providersOTC desks, crypto payment and on/off-ramp providers→05Wallet providersSelf-custody, MPC and custodial wallet providers→06Funds & asset managersCrypto funds, family offices and treasury teams→07Airdrop & on-chain studiosMulti-account, multi-device on-chain operation teams→08Web3 startupsEarly teams without a dedicated security lead→

See solutions by customer type →

PLANS

Start with a free consultation

First find where money could leak, then decide on a long-term plan.

Free consultation

$030 min

A 30-minute call to decide which gap to close first. No pitch, no commitment.

Book a free consultation

Security assessment

$5kfrom / project

In 2–3 weeks, find where money could leak, with a prioritized fix list.

Learn more

Security Partner

$3kfrom / month

A fractional security team: monthly checks, support on critical operations, first responder on incidents.

Learn more

See full pricing & plan comparison →

PROCESS

From first call to ongoing protection

  1. 01

    Free 30-min call

    Your business, funds and biggest worries.

  2. 02

    Security assessment

    2–3 weeks to find and prioritize where money could leak.

  3. 03

    Fix it together

    We work through the fixes with your team and re-check each one.

  4. 04

    Ongoing protection

    Monthly checks, support on critical operations, first responder on incidents.

FREE TOOL

USDT Blacklist Check

Before you accept funds: check whether a TRON address has had its USDT frozen by Tether.

>_

What tainted USDT is and what to do →

ABOUT US

Focused on blockchain
security foundations

Based in Shenzhen, Musesec focuses on building and operating security foundations for blockchain companies. Our team comes from the security teams of leading exchanges, with years of hands-on experience in security engineering and incident response, and graduate degrees in information security and computer science. The same team handles everything from the initial build-out to day-to-day operations and on-call.

SECURITY ENGINEERINGSECURITY OPERATIONSCONTRACT AUDITINCIDENT RESPONSE

To verify an audit report, send its ID to team@musesec.com

EST.2019

FOUNDED
2019
HQ
SHENZHEN
FOCUS
BLOCKCHAIN SECURITY
COVERAGE
24 / 7

INCIDENT RESPONSE · ASSESSMENT

Fix the gaps before attackers find them

Reply within 24 business hours · team@musesec.com

Contact security team

CONTACT

Tell us about your situation

Leave your contact details and needs and we will get back to you soon. You can also reach us on WeChat.

WeChat QR
WeChat