A Proof of Reserves audit is typically relevant for about a month, while a SOC 2 Type II report remains valid for approximately a year. A smart contract audit, up to two years. Hacken's Q3 2026 Security & Compliance Report outlines the duration of security evidence. Supervisors are increasingly seeking proof that controls are effective in practice. The three financial supervisory authorities in the EU said annual penetration tests and compliance audits may no longer be enough as AI speeds up exploitation, and they encouraged continuous vulnerability scanning and dependency monitoring. The quarter's incident data points the same way. Most losses in Q3 stemmed from attack paths that crossed the boundary of the last review: a compromised supplier, a public fix not yet deployed, or a component the review did not cover. The report also includes: - A comparison of five cyber-resilience frameworks: EU DORA, NYDFS Part 500, MAS, VARA, and UAE CMA. - Updates on MiCA post-transition: the EU register expanded from 151 authorized firms on January 1 to 356 by September 30, with banks comprising 38 of the 66 additional firms added in Q3. - Six priorities for institutions preparing for 2027, along with compliance milestones through October 2027. Perspectives from @chainlink, @StellarOrg, @bluechip_org, @gosai_law and Europeum-EDIC operator of the @EU_EBSI. "An audit is evidence, not a safe harbor." — @kcgosai, Gosai Law Read the report to plan evidence refreshes, ongoing monitoring and 2027 priorities: hackenio.cc/q3-2026-report

Congratulations to @The_DTCC on launching live on @CantonNetwork, a platform designed for regulated finance. Whether for DTCC or a small Web3 team, onboarding requires five key decisions that impact project cost, compliance, and long-term scalability. These decisions form the foundation of any project and can be costly to change if you address them late in development. Hacken, @catalyx_suite, C7, and @noves_fi will discuss these topics tomorrow at 15:00 UTC. Register: hackenio.cc/canton_onboardin…

The Ethereum Security Subsidy Program now runs through January 2027, and Hacken is happy to keep supporting Ethereum builders as one of its audit firms.

Key custody, privacy design, node operations, release review and audit records. Which of these is still unresolved for your team? Tomorrow, @catalyx_suite by @IntellectEU, C7, @Noves_fi, and Hacken will examine five decisions to settle before building on @CantonNetwork. Register: hackenio.cc/canton_onboardin… Online panel | 29 October | 15:00 UTC

Robinhood Chain makes a block roughly every 100 ms, but block.number moves only about four times a minute: it tracks Ethereum. prevrandao is always 1, Ethereum callers arrive under an aliased address, and gas includes a fee for posting data to Ethereum. View article

An attacker does not need the API key to change what an agent does. In Hacken lab testing, an instruction hidden in a changelog made an agent run a script without explicit approval. Everything an agent reads is attack surface. Full @MEXC_Official × Hacken breakdown below.

Hacken Pulse: monthly security and compliance analysis for teams securing financial infrastructure. Incidents, institutional risk, regulatory deadlines. Get October’s Pulse straight in your inbox: Security: hackenio.cc/security_pulse Compliance: hackenio.cc/compliance_pulse

Investors review the group chart. Banks trace ownership through all entities. Regulators ask who controls the licensed entity and from which jurisdiction. Your structure should answer five key questions: • Revenue: which entity earns it. • IP: which entity owns the code and the brand. • Treasury: which entity holds the funds. • Token: which entity issues it and whether a foundation is required. • Control: who sits on each board and who votes. Already set up? Many engagements require only two or three changes, not a new structure. Hacken's Corporate Structure Advisory builds your structure around your business model and target regime, such as MiCA, VARA, ADGM, FCA, MAS, and others. Plan your structure proactively before your next review: hackenio.cc/corporate-struct…

Robinhood's stock tokens can look like ordinary ERC-20s in lending code, but treating them that way is a DeFi risk: the issuer still controls freezes, blocklists, and burns, and price feeds can go stale on weekends.

On 29 October, @catalyx_suite by @IntellectEU, C7, @Noves_fi, and Hacken will examine the five decisions institutions must settle before building on @CantonNetwork, and who should own each. • Who holds the key behind the institution’s party identity? • What does Canton’s privacy model guarantee by default, and what is left to the application designer? • Should infrastructure be self-operated or managed, and how does each option affect the ability to exit? • What should a security review verify before a Daml application is released? • Which records will exist when an auditor or regulator asks what happened? Reversing most of these decisions becomes costly once development is underway. Online panel | 15:00 UTC | 65 minutes, including Q&A Register here: hackenio.cc/canton_onboardin…