A smart-contract audit can help identify weaknesses in code. It does not, by itself, establish who controls a company’s keys, how its customers are screened or whether its governance can withstand scrutiny. That gap is the focus of a new collaboration between Moore Hong Kong and CertiK.

In an announcement dated October 13, the firms said they had signed a memorandum of understanding to explore coordinated services for Web3 and digital-asset businesses. CertiK would bring blockchain and on-chain security expertise; Moore Hong Kong would contribute technology risk, corporate governance, assurance and institutional risk-management capabilities.

The aim is to give clients a more connected view of the risks inside their blockchain systems and the businesses operating them. The agreement establishes a framework for that work. Specific services and deliverables remain subject to separate engagement terms.

The Risks Outside the Smart Contract

For a digital-asset operator, technical security and operational controls meet at practical points: custody, access to private keys, transaction approvals and the ability to respond when something goes wrong. Reviewing one part of that system leaves questions about the others.

Kenneth Ma, Transaction Services Managing Director at Moore Hong Kong, put the distinction plainly in the announcement.

“A clean smart contract audit is only half the evidence.”

— Kenneth Ma, Transaction Services Managing Director, Moore Hong Kong

Ma said regulators, banks and investors also expect sound custody and key-management controls, effective anti-money-laundering screening and a credible path to licensing. He described the proposed arrangement as a way for clients to address on-chain security and off-chain assurance through a coordinated engagement, rather than managing separate providers.

That is the practical case for the collaboration: connecting findings about software with evidence about how an organization manages assets, assigns responsibility and maintains controls. A technical review and a governance review answer different questions, even when they concern the same platform.

What the Firms Plan to Explore

The MOU covers potential joint opportunities across blockchain security, technology and cyber risk, governance and control frameworks, operational resilience, assurance readiness and risk management. The intended clients include Web3-native businesses, other digital-asset ecosystem participants and institutions pursuing blockchain-based opportunities.

Assurance readiness is a significant part of that scope. Preparing controls and documentation for review is different from already having an assurance conclusion. Likewise, work on regulatory readiness should not be read as a licensing approval.

“Sustainable trust requires security to be supported by sound governance, robust risk management and credible assurance.”

— Kevin Lau, Director, IT & Cybersecurity, Moore Hong Kong

Lau said the collaboration is intended to help clients manage on-chain and off-chain risks together as they develop their businesses. Moore Hong Kong’s contribution extends the discussion from finding technical vulnerabilities to examining the operational environment around them.

A Broader Role for Blockchain Security

The proposed collaboration fits a direction CertiK has already described in Blockster’s coverage of its expanding security work: moving beyond smart-contract audits into enterprise cybersecurity, anti-money-laundering frameworks, customer-verification infrastructure and institutional security tools.

Its technical research remains part of that picture. Blockster previously reported on five vulnerabilities CertiK identified in Ethereum client Besu, which were patched through coordinated disclosure. That work addressed blockchain infrastructure itself. The Moore Hong Kong MOU concerns how that kind of technical expertise can sit alongside a wider assessment of business risk.

In a separate October 13 post, CertiK said it had joined Mastercard’s Crypto Partner Program and would contribute security, compliance and risk expertise. That announcement offers another example of its push toward work with financial institutions and payment providers.

“Together, we are offering something the market has been waiting for: a single, coordinated engagement covering both on-chain and off-chain risk in one integrated scope.”

— Esme Pau, Head of Capital Markets and Policy, CertiK

Pau’s statement describes the ambition behind the partnership. The announcement does not set out a standardized service package, pricing, named client engagements or a rollout timetable. The scope of any resulting work will depend on each client’s requirements and the applicable professional, legal and regulatory rules.

For prospective clients, the useful question is what a coordinated engagement will actually deliver: which systems and controls are reviewed, who is responsible for addressing findings and what evidence the work produces. Those details will determine whether the collaboration makes it easier to assess the security of an entire digital-asset operation.

Reporting by Lidia Yadlos

CertiKSecurity