Bybit
$1.43BEthereum · Feb 2025
A fake signing screen got signers to approve a hidden transaction.
Preventable withMS-1.07Signers verify calldata
Signers verify the real transaction on clear-signing hardware, so a swapped screen is caught.
One place for every control
you can't afford to miss
Integrate›Defend›Certify›Monitor
Integrate your systems
GitHub···
AWS···
Vercel···
Safe···
0x3f9…a1c2treasury safe4/7 signersadded
0x9b2…77deops safe3/5 signersadded
Checking GitHub defenses
12 repos · live
0%
28 of 28 checks passed
SD-1.01Branch protection on production branches· running
SD-1.02Signed commits required· running
SD-1.03Automated secret scanning· running
AC-1.01MFA on all accounts· running
✓
DARC-2 CERTIFIED
+ SEAL certification
cert 0042 · share it with anyone
Connect your infra. AWS, GitHub, Google Workspace and beyond. DARC sees where you stand.
Integrate your systems
GitHub12 repos
AWS3 accounts
Vercel6 projects
Safe2 multisigs
Checking GitHub defenses
28 of 28 checks passed
SD-1.01Branch protection on production branches12/12 repos✓ pass
SD-1.02Signed commits required12/12 repos✓ pass
SD-1.03Automated secret scanning12/12 repos✓ pass
AC-1.01MFA on all accounts18/18 members✓ pass
✓
DARC-2 CERTIFIED
+ SEAL certification
cert 0042 · share it with anyone
Overall completion
92%
224 of 244 controls
DARC-2 · Activeaudit-readywatching 6 surfaces · live
224Passed4N/A3Failed5Review8Pending
Monitored surfaces
Frontend & DNS
4 domains
resolve to your servers
Dependencies
142 packages
pins unchanged
Multisig signers
4/7 · 3/5
signer set unchanged
Cloud infra
AWS 3 · GCP
configs steady
Source code
12 repos
branch protection on
On-chain
2 treasuries
outflows normal
By domain
- GV8/8
- KM7/8
- MS6/8
- AC14/15
- SD7/7
- SC5/7
4 integrations
Connect your infra. AWS, GitHub, Google Workspace and beyond. DARC sees where you stand.Your posture is tested against hundreds of controls. Every gap, exposed.Fix your findings, build your defenses, get certified. Proof your partners can verify.Then DARC keeps watching. A live dashboard, continuously monitoring. If anything drifts, you get notified.
The ThreatYour code gets audited.
Your code gets audited.
Your operations don't.
OpSec failures cost 6× more than code exploits: $4.8B+ stolen since 2024 through key compromise, social engineering, and insider access.
Real incidents below, mapped to the DARC controls that would have stopped them.
Zerion
$100KMulti-chain · Apr 2026
A fake meeting compromised a staff device and exposed internal hot-wallet keys.
Preventable withGV-1.08Social-engineering training
Training on the fake-meeting vector plus segregated keys and a rehearsed compromise protocol kept the damage capped.
KelpDAO / LayerZero
$292MCross-chain · Apr 2026
Poisoned infrastructure behind the bridge's single verifier approved a fake message.
Preventable withSY-1.06Cross-chain risk check
A cross-chain risk check flags a single-verifier bridge before you adopt it.
Drift
$285MSolana · Apr 2026
A long social-engineering con got council members to pre-sign an admin handover.
Preventable withMS-1.07Signers verify calldata
Signers verify what a transaction really does, so a disguised handover is refused.
Ronin
$624MEthereum · Mar 2022
One company controlled a 5-of-9 validator set, reached via a fake job offer.
Preventable withMS-1.08No single-entity threshold
No single entity can meet the threshold, so one breach can't move funds.
Curve
$570KEthereum · Aug 2022
The registrar's nameserver was compromised, hijacking DNS to a cloned frontend that inserted a malicious approval.
Preventable withFD-1.02MFA on registrar and DNS
MFA on registrar and DNS blocks the common account takeover and the domain stays a monitored asset, though a breach inside the registrar sits beyond any customer's control.
The DARC Standard & PlatformThe standard sets the bar.
The standard sets the bar.
The platform keeps you above it.
DARC connects to your infrastructure and keeps you measured against a battle-tested operational security baseline, continuously. The platform does the work: it tracks your controls, flags drift the moment it happens, and pushes new protections as threats evolve. The standard underneath it sets the bar; the platform makes sure you stay above it.
Continuous monitoring
DARC is not a one-time check. Through the platform, your code repository, cloud infra, DNS, multisig wallets, and more, are monitored every day. Continuous by default, wherever possible.
Always-current controls
When the threat landscape shifts, controls are added or updated for every subscriber. We see incidents across the industry firsthand. That intelligence becomes a control update before most teams have even heard of the attack.
Team Portal
The weakest link is deep in the team.
Every DARC plan includes a team portal. Security travels down to every team member, with their own controls and scope-specific training.
›_
Onboarding a new employee? Get them to your security baseline from day one, controls assigned, training queued, contracts ready to sign.
01
Personal control view
Each team member sees their own controls and exactly what's expected of them. No more buried, stagnant security policies that nobody reads.
02
Trainings
Modules on the most common crypto-native attack vectors, recruiting scams, wallet drainers, clipboard swaps, fake meeting links.
03
Contracts
Ready-to-sign templates drafted to satisfy DARC controls, NDAs, security policies, acceptable use, and key holder agreements.
Forged in Practice
Built with SEAL
The Security Alliance
01
Practitioner-built
Every control in the DARC framework was written and reviewed by Wonderland and SEAL practitioners with hands-on incident experience.
02
Battle-tested
SEAL is one of the leading security organizations in digital assets. Their emergency response team has protected billions in on-chain assets across the industry's largest incidents.
03
Certification included
DARC Pro and Enterprise also grant your team the SEAL certification. Two certifications, one process.
The DARC Standard
Every breach starts in one of these 12 places.
Each domain below is a way digital-asset teams actually get compromised, and the controls that close it. The platform measures you against all of them, continuously. The full catalog is open and public.
GVGovernance & ComplianceNo one owns security until something breaks.
No one owns security until something breaks.
A named owner, plain-language policy, and clean on/offboarding. Accountability in place before the incident, not after.
GV-1.01GV-1.02GV-1.03+15
See all 18 controls →KMKey ManagementOne leaked key is the whole treasury.
One leaked key is the whole treasury.
Encrypted storage, tested recovery, rotation schedules, and a written compromise protocol, ready before you need it.
KM-1.01KM-1.02KM-1.03+13
See all 16 controls →MSMultisig GovernanceA multisig is only as strong as its sleepiest signer.
A multisig is only as strong as its sleepiest signer.
Hardware wallets, independent verification per transaction, simulation, and a quorum you can actually reach in an emergency.
MS-1.01MS-1.02MS-1.03+21
See all 24 controls →ACAccess ControlThe contractor who left in March can still log in.
The contractor who left in March can still log in.
MFA everywhere, least privilege, quarterly reviews, and 24-hour offboarding. No orphaned credentials, no shared logins.
AC-1.01AC-1.02AC-1.03+34
See all 37 controls →SDSecure DevelopmentAttackers don't exploit your code. They commit to it.
Attackers don't exploit your code. They commit to it.
Branch protection, signed commits, secret scanning, and review gates on everything between dev and production.
SD-1.01SD-1.02SD-1.03+17
See all 20 controls →SCSmart Contract OpsAudited once. Changed twelve times since.
Audited once. Changed twelve times since.
Audit coverage that tracks reality, verified bytecode, timelocks, pause mechanisms, and re-audit triggers.
SC-1.01SC-1.02SC-1.03+15
See all 18 controls →IMIncident ManagementHour one of a hack is not the time to write the plan.
Hour one of a hack is not the time to write the plan.
Playbooks, contacts, and rehearsed drills, so your worst day runs on preparation, not improvisation.
IM-1.01IM-1.02IM-1.03+17
See all 20 controls →TMTreasury ManagementMillions moved on the strength of a Slack message.
Millions moved on the strength of a Slack message.
Verified payment flows, spend limits, and separation of duties on everything that touches funds.
TM-1.01TM-1.02TM-1.03+22
See all 25 controls →CMOn-Chain MonitoringThe exploit was visible on-chain before anyone looked.
The exploit was visible on-chain before anyone looked.
Continuous monitoring and alerting on the contracts, wallets, and privileged operations that matter.
CM-1.01CM-1.02CM-1.03+12
See all 15 controls →SYSupply Chain SecurityYou're one npm install away from compromise.
You're one npm install away from compromise.
Pinned dependencies, vetted vendors, and controls over all the code you didn't write.
SY-1.01SY-1.02SY-1.03+17
See all 20 controls →FDFrontend & DNS SecurityThe contracts were fine. The DNS wasn't.
The contracts were fine. The DNS wasn't.
Registrar locks, DNSSEC, and frontend integrity checks on the front door attackers actually use.
FD-1.01FD-1.02FD-1.03+17
See all 20 controls →PSPhysical SecurityA seed phrase in a desk drawer.
A seed phrase in a desk drawer.
Locked storage, clean-desk rules, controlled signing areas, and a verified hardware supply chain.
PS-1.01PS-1.02PS-1.03+8
See all 11 controls →Platform Plans
Pick Your Level of Coverage
Includes DARC-1 certificate
DARC Core
$1,000 / mo
$12,000 billed annually, save $3,000
- DARC-1 certification
- 85-control framework
- 20 user seats
- Team portal with role-based views
- Real-time control monitoring
Most popular
Includes DARC-2 certificate
DARC Pro
$2,000 / mo
$24,000 billed annually, save $6,000
Everything in DARC Core, plus:
- DARC-2 certification
- SEAL certification included
- 244-control framework
- 50 user seats
Includes DARC-2 certificate
DARC Enterprise
Custom
Contact us for a tailored quote
Everything in DARC Pro, plus:
- Unlimited seats
- Full dependency mapping
- Custom controls for your stack
- Custom dependency monitoring
- Priority response
Coming Soon
After DARC: Continuous Adversarial Testing
A continuous adversarial testing service combining AI and human red teams. We simulate real-world attacks against your organization on an ongoing basis to identify weaknesses before threat actors do. Available as an add-on to any DARC plan.
They're already looking.
What will they find?
Every incident on this page was preventable. See where your team stands before someone else checks.