Smart contracts hold real money, often in public, and once deployed they are hard to change. A missing permission check, a price feed that can be skewed or a single exposed signing key can drain a treasury in minutes, and transactions do not reverse. Most of these losses come from a short list of known weakness classes — and from keys and operations, not only code.
XcellSecure Applied Blockchain Security looks at the whole system: the contracts, the protocol design around them, the keys that control them, the nodes they run on, the wallets and dApps users touch, and the monitoring that catches trouble early. Every engagement is defensive: we find weaknesses, rate them, help you fix them and verify the fixes.
Defensive work only. We do not publish exploit code, attack your counterparties or test systems you do not own. Findings are shared privately with your team and the report is yours.
Buy a single audit or combine pillars into a programme. Each one ends with a written deliverable you can show your board, investors or exchange-listing teams.
Manual line-by-line review plus industry-standard static analysers and fuzzers, for Solidity, Vyper, Rust (Solana) and Move.
The risks code review alone misses: economics, oracles, upgrade paths, admin powers and governance.
Architecture review of HSM, MPC and multisig set-ups, signing policies and the people and process around them.
Validator, sentry and RPC nodes hardened on cloud or bare metal, with DDoS protection and health monitoring.
Web and mobile app testing for wallets and dApps, plus the supply chain behind them.
Real-time alerts on unusual transactions and admin actions, with a rehearsed pause and response plan.
Hyperledger Fabric, Besu and Corda networks for consortia, banks and public-sector pilots.
Evidence and controls that help you meet Indian and global rules for virtual digital asset businesses.
The same sequence for every audit, so you always know what happens next and what you will receive.
Every finding gets one of five ratings. Tap a cell to see how impact and likelihood combine, and what we recommend before you deploy.
Custody review, hot-wallet limits, node hardening and the CERT-In, FIU-IND and Travel Rule evidence your auditors ask for.
Custody · monitoring · compliancePre-launch audits sized to your code, fix verification before mainnet, and monitoring with a pause plan after.
Audit · protocol review · monitoringPermissioned networks on Fabric, Besu or Corda: identity, CA, chaincode and node design reviewed before go-live.
Network design · chaincodeTokenisation and DLT pilots reviewed against your IT governance, outsourcing and data rules, inside a sandbox or proof of concept.
Pilot review · key custodyRecords and supply-chain ledgers with security designed in: access control, node hosting in India and audit-ready logs.
Design review · hostingWe help you meet these obligations with controls, runbooks and evidence. We are not a law firm or tax adviser, and nothing here is legal, tax or investment advice.
A Finance Ministry notification of 7 March 2023 made VDA service providers — exchange, transfer, safekeeping and issuer-related services — reporting entities under the PMLA. They register with FIU-IND, run KYC and report suspicious transactions, and keep records for five years. We build the logging and evidence side.
CERT-In's directions of 28 April 2022 require cyber incidents to be reported within 6 hours, ICT logs kept for 180 days in India, and VDA exchange and custodian wallet providers to keep KYC and transaction records for five years. We write the runbook and check the logs.
Under the Income-tax Act 1961, VDA transfer income is taxed at 30% (section 115BBH) and 1% TDS applies to transfers (section 194S). The Income-tax Act 2025, in force from 1 April 2026, renumbers these provisions — verify the current sections with your adviser. We supply transaction data, not tax advice.
KYC and wallet-linked data is personal data. The Act requires reasonable security safeguards and breach intimation to the Data Protection Board and affected people; the Rules were notified in November 2025 and phase in. See our vDPO service for the privacy programme.
The Reserve Bank has repeatedly said it has serious concerns about crypto assets and stablecoins, and favours central bank digital currency. Its stance is cautionary, not an endorsement of any asset. For regulated entities, any blockchain pilot sits inside RBI's IT governance and outsourcing expectations.
Where a token represents a security, securities law applies. SEBI's regulatory sandbox has hosted tokenised corporate-bond pilots in 2026, recorded on permissioned ledgers. If your project touches securities, confirm the regime with your adviser; we secure the ledger and keys.
The EU Markets in Crypto-Assets Regulation (EU) 2023/1114 applies to crypto-asset service providers from 30 December 2024, with national transitional periods ending by 1 July 2026. Indian firms serving EU users map custody, ICT and complaint controls to it.
FATF applies Recommendation 16 to virtual asset transfers: originator and beneficiary information travels with the transfer between providers. FATF revised Recommendation 16 in June 2025. We review how your Travel Rule data is collected, sent and protected.
The CCSS from the CryptoCurrency Certification Consortium (C4) sets controls for systems that hold crypto assets — key generation, storage, use, audit logs — at three levels. We run a gap review against it; certification is done by C4-certified auditors.
An ISMS gives exchanges and custodians a certifiable management system around the controls above. See our ISO 27001 readiness service.
Institutional clients and banking partners often ask custodians and infrastructure providers for a SOC 2 report. See our SOC 2 readiness service.
We do not comment on any token's value, legality in a given country or suitability as an investment. Our work is security: code, keys, infrastructure, monitoring and evidence.
Regulatory summaries checked October 2026 from Finance Ministry / FIU-IND, CERT-In, Income Tax Department, RBI, SEBI, ESMA, FATF and C4 publications, for orientation only — not legal, tax or financial advice. Confirm current requirements with your advisers and the regulator.
Audit tiers follow normalised source lines of code (nSLOC — code lines without comments or blank lines). One round of fix verification and the re-audit letter are included.
* Indicative — confirm with XcellHost. INR, excluding 18% GST. Audit, custody, node and monitoring prices are placeholders until your quotation; scopes above 7,500 nSLOC are quoted. Reused list prices from sibling pages: wallet mobile-app assessment ₹49,999 per app (Mobile App Security), WAAP Business ₹14,999 / month (WAAP), dedicated full node from ₹16,999 / month (RPC Node Servers); the IR retainer follows our DFIR fixed-proposal model.
Set your code size and chains, then add custody, nodes and monitoring. Lines go to the cart at the prices shown.
Above 7,500 nSLOC the audit is quoted after scoping — it is not in this total.
* Indicative — confirm with XcellHost. INR excl. 18% GST. Each extra chain adds a deployment & configuration review at ₹24,999* per chain. Monthly items repeat; one-time items are billed once.An illustrative estimate from code size and complexity. Real scoping looks at your repository, tests and documentation — but this shows the drivers, and the formula is below.
reviewer-days = max(3, ⌈ nSLOC ÷ pace × complexity × (1 + 0.10 × integrations + 0.10 × upgradeable) × coverage ⌉)
reviewers = 2 (3 above 30 days) · weeks = ⌈ days ÷ (reviewers × 5) ⌉ + 1 for report & fix verification
Answer for your live or upcoming deployment. Unanswered questions count as "No".
Your weakest areas show here.
| What happens | No audit, no monitoring | Audit only | Audited + monitored |
|---|---|---|---|
| Known weakness classes | Ship with whatever is there | Found and fixed before launch | Found, fixed and re-verified |
| Code changes after launch | Unreviewed | Unreviewed unless re-audited | Diff reviews and new rules per release |
| Admin and signing keys | Often one person, one key | Flagged in the report | k-of-n quorum, time-locks, reviewed policy |
| Unusual transfer at 3 a.m. | Seen on social media | Seen on social media | Alert to on-call within minutes* |
| Ability to stop damage | None planned | Pause exists, never rehearsed | Rehearsed pause / circuit-breaker playbook |
| CERT-In 6-hour report | Improvised | Improvised | Runbook, contact and logs ready |
| Cost | Nothing — until an incident | From ₹1,49,999* per scope | Audit + ₹24,999* / month monitoring |
* Response targets are agreed in your monitoring plan; this is not a guarantee against loss.