Everything you run, on chain and off
The Vault is your single source of truth. Every asset, who owns it, and which controls apply. Nothing gets checked that isn't here, and nothing here goes unchecked.
The all-in-one security platform
for digital-asset teams.
Connect your stack, on-chain and off. We monitor 200+ controls
and alert you when one fails.
WonderlandHey Alice, checking on Wonderland?
4 controls need you today.
Security posture
11 of 18 controls complete
61%
Next up
What moved
One platform, your whole stack.
Cloud, repos, domains, devices, signer keys, smart contracts, and more.
Watched around the clock.
GitHubAmazonGoogle Cloud
WorkspaceCloudflareVercel
Safe1PasswordOkta
SlackNotionAnd more
Connect once, read-only
Link your accounts and DARC pulls the evidence itself. Nothing to configure, and we never get write access.
PassingMS-1.02
No single key can drain or freeze a multisig
Losing one key still leaves a quorum
Require every signer to approve
200+ controls that explain themselves
Each one says what it protects, what to do, and what not to do. Pass or fail comes from evidence, not a checkbox.
Your inbox3 new
A signer joined Treasury SafeOn-chain · 3 of 5 signers, was 2 of 3 · just nowCriticalReopens MS-1.02
Branch protection weakenedGitHub · darc/monorepo · 2 hours ago
A certificate you did not ask forDNS · wonderland.xyz · yesterday
Reaching the security ownerWas this expected?
Know the moment something changes
A new signer, a weakened branch, a certificate you did not ask for. Every change lands in your inbox. Critical ones also reach you on Slack, Telegram, email or a call.
+ 13 moreMary11 of 11
Signed the security policy
Full-disk encryption on
Signs nothing from chat alone
Security that reaches every teammate
Each person passes their own controls, signs the security policy, and has incident runbooks ready before something goes wrong.
darc.trust.wonderland.xyz
VERIFIED BY DARCTrust CenterRequest accessOverviewControlsEvidenceThird Parties
Certifications ALL ACTIVE
D1DARC-1CERTIFIED
Controls 98 PASSING
Key managementAccess controlMultisig governanceIncident response
Your own trust center
Publish your certifications, controls and live evidence on a public page. Send partners, exchanges and auditors the link instead of another security questionnaire.
Your code gets audited.
Your operations don't.
OpSec failures cost 6× more than code exploits: $4.8B+ stolen since 2024 through key compromise, social engineering, and insider access.
$1.43B
Bybit
A fake signing screen got signers to approve a hidden transaction.
MS-1.06Signers verify calldataSigners verify the real transaction on clear-signing hardware, so a swapped screen is caught.
$285M
Drift
A long social-engineering con got council members to pre-sign an admin handover.
MS-1.06Signers verify calldataSigners verify what a transaction really does, so a disguised handover is refused.
$570K
Curve
The registrar's nameserver was compromised, hijacking DNS to a cloned frontend that inserted a malicious approval.
FD-1.01MFA on registrar and DNSMFA on registrar and DNS blocks the common account takeover and the domain stays a monitored asset, though a breach inside the registrar sits beyond any customer's control.
Every breach starts in
one of these 13 places.
Each domain is a way digital-asset teams actually get compromised, with the controls that close it.
- Governance & ComplianceNo one owns security until something breaks.Discover
- Key ManagementOne leaked key is the whole treasury.Discover
- Multisig GovernanceA multisig is only as strong as its sleepiest signer.Discover
- Access ControlThe contractor who left in March can still log in.Discover
- Secure DevelopmentAttackers don't exploit your code. They commit to it.Discover
- Smart Contract OpsAudited once. Changed twelve times since.Discover
- Incident ManagementHour one of a hack is not the time to write the plan.Discover
- Treasury ManagementMillions moved on the strength of a Slack message.Discover
- On-Chain MonitoringThe exploit was visible on-chain before anyone looked.Discover
- Supply Chain SecurityYou're one npm install away from compromise.Discover
- Frontend & DNS SecurityThe contracts were fine. The DNS wasn't.Discover
- Physical SecurityA seed phrase in a desk drawer.Discover
- Individual SecurityA compromised laptop or chat account is an org-wide incident.Discover
- Read the standard
Thirteen domains, 200+ controls.
Every control, what it protects and how it is checked.
Thirteen domains, 200+ controls.
Every control, what it protects and how it is checked.
Pick your level of coverage.
Save 20%
Core
$1,000 / month, billed yearly
- DARC-1 certification
- 83 control framework
- 20 user seats
- Team portal with role-based views
- Real time control monitoring
Pro
$2,000 / month, billed yearly
- Everything in Core
- DARC-2 certification
- SEAL certification included
- 242 control framework
- 50 user seats
Enterprise
Custom
- Everything in Pro
- Unlimited seats
- Full dependency mapping
- Custom controls for your stack
- Priority response
FAQ
The questions every security team asks us.
All data is encrypted in transit (TLS) and at rest, in an isolated AWS account with a private database, using a separate encryption key per organization held in a dedicated key management service. Sensitive labels go further: they are end-to-end encrypted in your browser with keys DARC never holds, so no one at DARC can read them.
Yes. Organizations that complete all required controls within the DARC platform are awarded SEAL certification.
DARC is built and operated by Wonderland, a protocol engineering and digital asset operations firm, and the certification standard was developed in collaboration with SEAL (Security Alliance). Our team comes from security backgrounds and applies the same controls to DARC that we require of our clients.
Digital asset companies are targeted by well-resourced attackers, and most security failures come from operational gaps rather than smart contract bugs. DARC gives you continuous verification of your opsec controls against a standard developed with SEAL, so you know your posture is sound at all times and can prove it to partners, counterparties and auditors.
They're already looking.
What will they find?
Every incident on this page was preventable. See where your team stands before someone else checks.