Quantstamp

Quantstamp is a blockchain security company founded in 2017 and headquartered in San Francisco, with a distributed team of security professionals. Its core offering is security auditing for web3 software, covering smart contracts, Layer 1 and Layer 2 protocols, DeFi applications, NFT marketplaces, exchanges, clients and supporting web infrastructure. The company also performs penetration testing, formal verification, static analysis and original security research, and it publishes recurring public reporting on crypto and off-chain security incidents through its blog.

Beyond point-in-time audits, Quantstamp offers managed security services for continuous monitoring after deployment, and an insurance product called Chainproof that covers customers against smart contract hacks and slashing risk. It has secured two Ethereum 2.0 consensus clients, Prysm and Teku, and has received multiple Ethereum Foundation grants related to Layer 2 security and scaling. The firm also conducts incident investigation work; it led the independent investigation into a social-engineering attack on Humanity Protocol that drained roughly $32 million.

Alongside its services business, Quantstamp makes strategic investments in the web3 ecosystem and acts as an advisor to projects as they scale.

Founding story

Quantstamp was founded in 2017 by Richard Ma, a former software engineer at Tower Research Capital who worked on software handling millions of dollars using extreme testing methods. He started the company to help mainstream users safely adopt blockchain technology. Quantstamp participated in Y Combinator's Winter 2018 batch.

Business model

Quantstamp sells security services to blockchain and web3 project teams, primarily engagement-based smart contract and infrastructure audits, supplemented by managed security services for post-deployment monitoring and the Chainproof insurance product covering smart contract hacks and slashing risk. The company also makes strategic investments in web3 projects and serves as an advisor to them.

Revenue derives from paid security engagements (audits, penetration testing, formal verification and related review work), ongoing managed security and monitoring services, and its Chainproof insurance offering.

Traction

Company materials report 1,300+ audits conducted, more than $500 billion in digital assets secured and coverage of over 60 ecosystems; its press page cites 700+ audits and over $200 billion in digital asset risk secured. Quantstamp audited two Ethereum 2.0 clients (Prysm and Teku), received multiple Ethereum Foundation grants for L2 security and scaling, and led the independent investigation into the $32 million Humanity Protocol key-compromise incident.

Latest developments

Quantstamp continues to publish monthly security reporting on crypto and software supply chain incidents, including analysis of npm package compromises and exploited CVEs, and led the independent investigation into the social-engineering attack that drained $32 million from Humanity Protocol. Recent research output covers EIP-7702 and the Pectra hardfork, engineering Solidity contract families for multi-chain deployment, and security considerations for AI agents operating on blockchains.