Hacken🇺🇦

Security and assurance partner for financial institutions and the infrastructure they rely on 🛡️

[Hacken🇺🇦 @hackenclub]

A Proof of Reserves audit is typically relevant for about a month, while a SOC 2 Type II report remains valid for approximately a year. A smart contract audit, up to two years.

Hacken's Q3 2026 Security & Compliance Report outlines the duration of security evidence.

Supervisors are increasingly seeking proof that controls are effective in practice.

The three financial supervisory authorities in the EU said annual penetration tests and compliance audits may no longer be enough as AI speeds up exploitation, and they encouraged continuous vulnerability scanning and dependency monitoring.

The quarter's incident data points the same way. Most losses in Q3 stemmed from attack paths that crossed the boundary of the last review: a compromised supplier, a public fix not yet deployed, or a component the review did not cover.

The report also includes:
- A comparison of five cyber-resilience frameworks: EU DORA, NYDFS Part 500, MAS, VARA, and UAE CMA.
- Updates on MiCA post-transition: the EU register expanded from 151 authorized firms on January 1 to 356 by September 30, with banks comprising 38 of the 66 additional firms added in Q3.
- Six priorities for institutions preparing for 2027, along with compliance milestones through October 2027.

Perspectives from @chainlink, @StellarOrg, @bluechip_org, @gosai_law and Europeum-EDIC operator of the @EU_EBSI.

"An audit is evidence, not a safe harbor."
— @kcgosai, Gosai Law

Read the report to plan evidence refreshes, ongoing monitoring and 2027 priorities: https://t.co/9EURvwFWde

[Hacken🇺🇦 @hackenclub]

Congratulations to @The_DTCC on launching live on @CantonNetwork, a platform designed for regulated finance.

Whether for DTCC or a small Web3 team, onboarding requires five key decisions that impact project cost, compliance, and long-term scalability.

These decisions form the foundation of any project and can be costly to change if you address them late in development.

Hacken, @catalyx_suite, C7, and @noves_fi will discuss these topics tomorrow at 15:00 UTC.

Register: https://t.co/Z0gKUhi41H

[Canton Network @CantonNetwork]

.@The_DTCC, which custodies $114T in assets, has launched its Tokenization Service.

Minting digital representations of Russell 1000 constituents, major index ETFs, and US Treasuries, are now live on Canton Network, built with input from 150+ firms.

PR: https://t.co/MBmftfPck9

[Hacken🇺🇦 @hackenclub]

The Ethereum Security Subsidy Program now runs through January 2027, and Hacken is happy to keep supporting Ethereum builders as one of its audit firms.

[Findlay @0xboo]

1/ 🔐 Extension secured!

185 applications. 60+ projects supported. $500k in subsidies allocated.

We’re excited to bring 3 more months of the Ethereum Security Subsidy Program to @ethereum builders.

Big thanks to @ethereumfndn and @NethermindSec for helping make the pilot program a success - let’s keep it going!

[Hacken🇺🇦 @hackenclub]

@trkweb3 @quipnetwork @KeystoneWallet 🛡️🛡️🛡️

[Hacken🇺🇦 @hackenclub]

@bella_quack @trkweb3 @quipnetwork @KeystoneWallet 🛡️🛡️🛡️

[Hacken🇺🇦 @hackenclub]

Key custody, privacy design, node operations, release review and audit records. Which of these is still unresolved for your team?

Tomorrow, @catalyx_suite by @IntellectEU, C7, @Noves_fi, and Hacken will examine five decisions to settle before building on @CantonNetwork.

Register: https://t.co/Z0gKUhi41H

Online panel | 29 October | 15:00 UTC

[MEXC @MEXC]

🔵 Smarter AI. Informed traders. You stay in control.

84.8% of traders surveyed by MEXC have used AI for crypto research or trading. But trust matters as much as adoption.

Explore MEXC's AI Trading Report, featuring security insights from @hackenclub : https://t.co/6OyauVfYhs

[Hacken🇺🇦 @hackenclub]

Robinhood Chain makes a block roughly every 100 ms, but block.number moves only about four times a minute: it tracks Ethereum. prevrandao is always 1, Ethereum callers arrive under an aliased address, and gas includes a fee for posting data to Ethereum. https://t.co/Q8ckqO2v27

[Hacken🇺🇦 @hackenclub]

@MEXC 🛡️🛡️🛡️

[Hacken🇺🇦 @hackenclub]

An attacker does not need the API key to change what an agent does. In Hacken lab testing, an instruction hidden in a changelog made an agent run a script without explicit approval.

Everything an agent reads is attack surface.

Full @MEXC_Official × Hacken breakdown below.

[MEXC @MEXC]

AI should move forward. Control should never fall behind.

Blocking withdrawals alone won’t prevent AI trading losses.

The MEXC × @hackenclub handbook explains why.

Learn which permissions, loss limits, and emergency stop controls to check: https://t.co/2T6RILAuJO

[Hacken🇺🇦 @hackenclub]

Hacken Pulse: monthly security and compliance analysis for teams securing financial infrastructure. Incidents, institutional risk, regulatory deadlines.

Get October’s Pulse straight in your inbox:
Security: https://t.co/qGfyNpSoKM
Compliance: https://t.co/cIkg5Hd2ck

[Hacken🇺🇦 @hackenclub]

9/ The Q1 2027 dates haven't moved: ESMA on 8 January, GENIUS on 18 January, the FCA gateway on 28 February.

Hacken maps each requirement to your current controls and prioritizes the evidence you need, helping compliance teams stay ahead of deadlines: https://t.co/7zDMgnvvEW

[Hacken🇺🇦 @hackenclub]

1/ The OCC finalized its GENIUS Act rule on 21 October. It takes effect on 18 January 2027, in 84 days.

The catch: existing issuers need a substantially complete application pending by then, and the OCC isn't accepting applications yet.

Regulatory radar, week of 26 October:

[Hacken🇺🇦 @hackenclub]

8/ Comment deadlines:
• 18 Nov: FCA CP26/36, GC26/7
• 23 Nov: OCC GENIUS forms
• 27 Nov: ASIC CP 392
• 30 Nov: Fed GENIUS proposal, Treasury state certification, ADGM DeFi guidance
• 7 Dec: SEC crypto custody
• 14 Dec: CFTC crypto markets notice

[Hacken🇺🇦 @hackenclub]

@CantonNetwork 🤝🤝🤝