All audits

Traditional · Digital Asset Risk Assessment

BitGo Europe

softstack completed an asset assessment engagement for BitGo Europe. Findings for this engagement are confidential and the report is available on request.

Key facts

Client
BitGo Europe
Type
Digital Asset Risk Assessment
Market cap
$65.2B as of 2026-06-30

About the project

BitGo Europe GmbH is the European subsidiary of BitGo, a digital asset infrastructure company founded in 2013 by Mike Belshe and Ben Davenport. The group provides institutional custody, wallet infrastructure, staking, trading, and settlement services. It also offers stablecoin infrastructure and crypto-as-a-service tooling.

Methodology

Review process

  1. Scoping and threat modelling

    The commit hash is frozen and the attack surface is mapped: asset flows, trust assumptions, privileged roles and the external systems the code depends on.

  2. Automated analysis

    Static analysers sweep the full codebase to surface known weakness patterns, unreachable states and deviations from established conventions.

  3. Manual code review

    Independent engineers read the code line by line, concentrating on business logic, access control, arithmetic and the handling of external calls.

  4. Adversarial testing

    Property-based fuzzing and invariant tests attack the assumptions the protocol relies on, targeting states that ordinary unit tests never reach.

  5. Reporting

    Every finding is documented with a severity rating, its impact, the steps to reproduce it and a concrete remediation the team can act on.

  6. Remediation verification

    Submitted fixes are re-reviewed against the original finding, and the final report records the resolved state of each one.

FAQ

The deliverable for this engagement is covered by a confidentiality agreement, so the findings are not published. softstack can share the report on request where BitGo Europe approves it.

Disclaimer

This audit represents a point-in-time security assessment of the reviewed codebase and is intended for informational purposes only. While Softstack applies industry-standard security review methodologies, no audit can guarantee the absence of vulnerabilities, bugs, or other security risks. This report does not constitute financial, legal, regulatory, or investment advice, nor does it endorse the project, its business model, products, or services. Security is an ongoing process, and we strongly recommend conducting a new assessment following any material code changes or at least every 6 months to address newly emerging threats, vulnerabilities, and ecosystem developments.