The Work Behind the Name

The layer beneath the noise

Most of crypto is optimism sold at volume. We are interested in the opposite: the byte-level mechanics of how these networks actually behave, where the trapdoors are, and who gets taken when one opens. That is the layer we work in — the plumbing, not the pitch.

It is deliberate positioning. The same on-chain transparency that lets an attacker plan an exit is the transparency we use to expose it. The bundles, the funding trails, the orderflow, the distribution — it is all written to a public ledger. The edge has never been secret information. It is the discipline to read what is already there, and the tooling to read it faster than the people counting on you not to look.

How we think about security

For years the industry treated security as an audit problem: get the contract reviewed, ship, done. The losses tell a different story. A growing majority of value now leaves through the front door — keys, access, permissions, orderflow, bridges — not through a subtle bug in otherwise-correct code. A clean audit is necessary. It is not sufficient.

So we investigate the way an adversary would. We map the extractable surface of a system — its mempool exposure, its trust assumptions, its key-custody and access model — before someone else prices it. A defense you have not tested against the real attack is an assertion, not a control. We would rather prove a system is safe than promise it. And if it is genuinely bad at what it claims, we will say so — to a client, in a report, or in public. That honesty is not a slogan; it is the only thing that makes the rest of the work hold up.

The people behind it

0xhades is a small, senior group of engineers and security researchers. We are deliberately not a large agency chasing volume — we keep the circle tight, the standards high, and the engagement count low, so that every protocol we take on gets the depth it actually demands. What binds the group is a single instinct: pull a system apart until you understand exactly how it fails, then close the gap before anyone else finds it.

Our work spans Solana and the EVM — Ethereum, BSC, Base, and Polygon — in Rust, Solidity, Python, and TypeScript. The Arsenal on this site — real software that dissects token launches, traces wallet clusters, and operates at the transaction layer — is the working evidence of how we think. We do not talk about adversarial research; we ship it.

What we're building

Alongside the client work, we publish. The Ledger is our research series — blockchain security, MEV, market structure, and the fundamentals, explained honestly from beginner to advanced. It is the clearest window into how we think, and it is open to everyone.