I Checked 1,000 Crypto Companies for One Thing: Can You Even Reach Them?

Imagine you're a security researcher and you just found a real, serious problem on a crypto company's website, something that could let an attacker get at customer funds. You want to do the right thing and warn them before anyone exploits it.

Most companies have a general "Contact Us" email somewhere. That's not what this is about. A serious security problem needs to go to someone who will actually treat it like one and not sit in a general support queue for a week, or get missed entirely.

So I checked 1,000 real crypto companies for one specific thing: do they have an actual dedicated path built specifically for a researcher to report a security problem?

Most of them don't.

Five Ways to Say "Here's Who to Tell"

There's no single universal standard for this, so I checked for any of the five real paths a company might offer:

1. A security.txt file — a tiny, standardized file published at a fixed web address specifically so a researcher (or an automated tool) can find a contact email without having to dig.
2. A bug bounty program — a formal, hosted program where researchers can submit findings, often with a reward attached.
3. A dedicated security page on the company's own site, linked from somewhere a visitor would actually find it.
4. A public security policy on GitHub — common for companies that build open-source code, this is a standard file telling contributors and researchers how to report issues.
5. A "trust center" — a page, usually from a third-party compliance vendor, listing a company's security and compliance posture, often with a contact route included.

A company doesn't need all five. It just needs one clear, discoverable path from "I found something" to "the right person knows about it."

One of These Five Matters More Than the Others

Here's something worth separating out: four of these five are things a person has to go looking for by hand, searching for the right company page, hoping they land in the right place. Only one of them was actually built so a computer could find it automatically with no guessing involved.

That one is the security.txt file. It lives at the exact same web address on every single company's site, in a simple, predictable format. That means a researcher doesn't need to visit the website at all — a script can check thousands of companies in the time it takes a person to check one, pulling out the contact email automatically every time.

The other four all require a human to actually look, and every company presents them differently. A bug bounty program might be mentioned in a footer link, or buried in a blog post, or not linked from the homepage at all. A security page could be at /security, /trust, /responsible-disclosure, or a dozen other places, with no way to guess which. None of that is automatable the way security.txt is.

That's not just a technical detail, it's the difference between a disclosure channel that scales and one that depends on a person stumbling across it by luck.

This Isn't Theoretical

Earlier this month, a DeFi vault on a major blockchain lost roughly $6 million in an exploit. What made the story notable wasn't just the loss, it's that according to security researchers who looked into it afterward, the exact flaw that got exploited had reportedly been spotted by someone in the security community the week before it was used to steal funds.

So why didn't that get fixed in time? Because nobody could figure out who actually ran the vault. No team had publicly claimed it and there was no security contact listed anywhere. A researcher who tries to intervene on an anonymous, unidentified project moving funds, may actually risk real legal exposure for doing the right thing. The warning had nowhere to go.

That's the whole point of this check. It's not about whether a company's code is perfect because nobody's is. It's about when someone does spot a problem, there's an actual door to knock on before it turns into a headline.

The Numbers

Of 1,000 crypto companies checked, 884 were reachable for this test (the rest blocked automated checks outright — a separate problem for another day).

Add it all up, and allowing for overlap, plenty of companies have more than one. Here's the headline number:

353 of 884 (39.9%) have at least one of these five. 531 (60.1%) have none at all.

That second number is the one that matters. It doesn't mean those companies can't be reached at all as most have a general contact form or email somewhere, the way almost every website does. What they don't have is a path built specifically for a security report. A researcher with a real, urgent problem to report is stuck choosing between a general support inbox that was never designed for this, or just not bothering.

Credit Where It's Due

Nobody in the full 1,000 hit all five signals. But four companies tied for the top score, four out of five, and they deserve to be named for it:

Turnkey, Lido, Yearn Finance, and Yearn.fi.

Turnkey has a published security.txt, a dedicated security page, a public GitHub security policy, and a trust center , covering the compliance-vendor route as well as the developer-facing one.

Lido and both Yearn domains each combine a security.txt file, an active bug bounty program, their own security page, and a public GitHub security policy. This means a researcher has at least four independent and redundant ways to find them. Miss one, and there are three more.

That redundancy is really the point. These four aren't just checking one box, they've made it genuinely hard for a well-intentioned researcher to fail to find them, whether that researcher starts by searching GitHub, checking for the standard disclosure file, or just looking for a security page on the site itself. That's what "taking this seriously" actually looks like in practice, not just in a policy document.

One more worth a mention: Immunefi, who scored three of the five. They happen to be a crypto security company themselves, one that runs its own bug bounty platform, and whose own homepage naturally mentions their own name, which is part of how that signal registered for them specifically. Still, between a published security.txt and their own dedicated security page, they're easy to find and well ahead of the roughly 500 companies that had nothing at all.

What This Actually Costs to Fix

None of the five signals checked here require a security team, a budget, or months of work. A security.txt file is a handful of lines in one plain-text file. A security page is one page on a site that already exists. None of it is hard and the companies that scored highest didn't do anything exotic, they just made sure there was more than one door.

We've said it throughout this series and it's worth repeating: crypto doesn't get a do-over once something is stolen. No bank reverses the transaction, no chargeback undoes it, and the people responsible are rarely caught. Catching a problem before it's used is the only layer that actually works — and a researcher willing to warn you first is one of the cheapest forms of that protection there is. Right now, for 6 out of 10 of these companies, that warning has nowhere built-for-the-purpose to go.