Crypto · Red Team · Red Team
Turkey-based crypto exchange with 8M users · REST/WebSocket API + withdrawal flow pentest
A Turkish crypto exchange with 8M users requested a Red Team engagement from DSET. Target: REST/WebSocket API, withdrawal flow logic, cold wallet HSM signing flow. Black-box. Loss of funds is strictly FORBIDDEN. Test wallet limit 0.05 BTC. There is a risk of an anomaly-detection ban. You will make 11 critical decisions in sequence.
Before you start the scenario
- You are the decision-maker in this incident · every choice leaves time/cost/reputation behind
- There are no wrong answers · just like in real life · but some paths are more expensive
- You can restart it anytime · try different paths
- At the end, a 3-axis score + alternative routes are shown