A Proof of Reserves audit is typically relevant for about a month, while a SOC 2 Type II report remains valid for approximately a year. A smart contract audit, up to two years. Hacken's Q3 2026 Security & Compliance Report outlines the duration of security evidence. Supervisors are increasingly seeking proof that controls are effective in practice. The three financial supervisory authorities in the EU said annual penetration tests and compliance audits may no longer be enough as AI speeds up exploitation, and they encouraged continuous vulnerability scanning and dependency monitoring. The quarter's incident data points the same way. Most losses in Q3 stemmed from attack paths that crossed the boundary of the last review: a compromised supplier, a public fix not yet deployed, or a component the review did not cover. The report also includes: - A comparison of five cyber-resilience frameworks: EU DORA, NYDFS Part 500, MAS, VARA, and UAE CMA. - Updates on MiCA post-transition: the EU register expanded from 151 authorized firms on January 1 to 356 by September 30, with banks comprising 38 of the 66 additional firms added in Q3. - Six priorities for institutions preparing for 2027, along with compliance milestones through October 2027. Perspectives from @chainlink, @StellarOrg, @bluechip_org, @gosai_law and Europeum-EDIC operator of the @EU_EBSI. "An audit is evidence, not a safe harbor." — @kcgosai, Gosai Law Read the report to plan evidence refreshes, ongoing monitoring and 2027 priorities: hackenio.cc/q3-2026-report

Hacken Pulse: monthly security and compliance analysis for teams securing financial infrastructure. Incidents, institutional risk, regulatory deadlines. Get October’s Pulse straight in your inbox: Security: hackenio.cc/security_pulse Compliance: hackenio.cc/compliance_pulse

Investors review the group chart. Banks trace ownership through all entities. Regulators ask who controls the licensed entity and from which jurisdiction. Your structure should answer five key questions: • Revenue: which entity earns it. • IP: which entity owns the code and the brand. • Treasury: which entity holds the funds. • Token: which entity issues it and whether a foundation is required. • Control: who sits on each board and who votes. Already set up? Many engagements require only two or three changes, not a new structure. Hacken's Corporate Structure Advisory builds your structure around your business model and target regime, such as MiCA, VARA, ADGM, FCA, MAS, and others. Plan your structure proactively before your next review: hackenio.cc/corporate-struct…

Robinhood's stock tokens can look like ordinary ERC-20s in lending code, but treating them that way is a DeFi risk: the issuer still controls freezes, blocklists, and burns, and price feeds can go stale on weekends.

On 29 October, @catalyx_suite by @IntellectEU, C7, @Noves_fi, and Hacken will examine the five decisions institutions must settle before building on @CantonNetwork, and who should own each. • Who holds the key behind the institution’s party identity? • What does Canton’s privacy model guarantee by default, and what is left to the application designer? • Should infrastructure be self-operated or managed, and how does each option affect the ability to exit? • What should a security review verify before a Daml application is released? • Which records will exist when an auditor or regulator asks what happened? Reversing most of these decisions becomes costly once development is underway. Online panel | 15:00 UTC | 65 minutes, including Q&A Register here: hackenio.cc/canton_onboardin…

On @CantonNetwork, "who can see this contract?" sounds simple. It is actually three questions: who was told about it, who saw it and who is permitted to use it. Get the distinction wrong and your KYC provider could see the loan rate. Hacken's new research works through a loan example: • A KYC provider added as an observer on the loan sees every field, including the amount, rate and lender. • If the identity moves to a separate contract but is fetched inside the loan's Accept choice, every witness of Accept sees it. • A better approach is to fetch only a pass/fail attestation rather than the full identity record. To remove an observer, the contract must be archived and recreated, because Daml contracts are immutable. The Ledger API is not the boundary. Divulged copies remain in participant storage until pruning, and the receiving party's validator operator can read them. None of this shows up as a failing test. Full analysis, with a five-point Daml privacy audit checklist: hackenio.cc/auditing-daml-pr…

An EVM app can deploy to Robinhood Chain without changing a single line of code. That's where the risk begins.

Hacken is heading to Munich for the TUM Blockchain Conference 26, hosted by @tbc_munich, October 29–31. Our CEO and co-founder, Dyma Budorin (@buda_kyiv), will join a fireside chat at Digital Assets Day, hosted by @bundesblock: "Society 2035 - AI, Digital Assets & our Future Economic Backend." October 30 | 17:00–17:35 CET | Main Stage See you in Munich. #TUMBlockchainConference26

How did @tortuga_estate secure their tokenized real estate platform when each mint is signed on another chain? The tokens sit on EVM chains. The Internet Computer keeps the ownership ledger and approves every mint. If the two drift apart, they disagree on ownership. Hacken audited the two canisters behind it, from June to August 2026: one approves mints and burns, the other signs them with a split key (threshold ECDSA) and submits them on-chain. The review tested each one's logic and its assumptions about the other. ​ No Critical or High findings. 14 in total: 1 Medium, 11 Low, 2 Info. 7 fixed during the engagement, 7 accepted with rationale in the report. The token contract is only part of an RWA platform. The code that decides a mint needs the same scrutiny. Full case study: hackenio.cc/hacken-audits-to…

Plenty of exploited protocols have been audited. An audit reviews the in-scope code at a single commit. It usually doesn’t cover who holds the admin keys or whether the mainnet code is still the code that was reviewed. Both are worth proving before TGE. Details ↓