Three Sigma

Three Sigma is a Lisbon-based blockchain security and research firm founded in January 2022 by three cybersecurity engineers who saw the fragility of the early Web3 ecosystem. What began as a small team has grown into a global specialist group that has completed over 150 audits, protected more than $10 billion in client assets, and secured over $200 billion in on-chain transacted value — with 300+ critical and high-severity issues uncovered across its engagements.

Core Services

Three Sigma operates across two primary service pillars: Code Security Audits and Economic & Risk Services.

On the code side, the firm provides smart contract audits across Solidity (EVM chains including Ethereum, Arbitrum, Polygon, Base, and Optimism), Rust (Solana, NEAR, and related ecosystems), Move (Sui, Aptos), and Bitcoin-based infrastructure. Services extend to dApp frontend audits, blockchain bridge and cross-chain application audits, Layer 1 and Layer 2 protocol audits, operational security (OpSec) audits, and crypto incident emergency response.

On the economic side, Three Sigma performs in-depth economic audits that stress-test protocol financial and incentive structures against simulated market pressures such as price manipulation, liquidity crunches, and governance attacks. Complementary economic services include tokenomics audits, mechanism design reviews, ecosystem risk assessments, DAO governance audits, staking design reviews, points and incentives program design, and DeFi ecosystem strategic R&D.

Key Strengths

• Senior, attacker-minded engineers: Reviewers combine automated static analysis with deep manual code review, threat modeling, and custom fuzzing and property-based testing.
• Multi-language and multi-chain coverage: Solidity, Rust, Move, and Bitcoin — covering EVM and non-EVM ecosystems alike.
• Dual code and economic expertise: One of few firms offering both code-level security and quantitative economic risk assessment under the same roof.
• Adaptive, developer-first process: Audits are tailored to each protocol's stack, logic, and goals. Findings include suggested diffs, test hints, and proof-of-concept exploits for fast developer remediation.
• Post-audit support: Remediation verification, PR reviews, retests, and ongoing advisory through upgrades and emergency patches.

Notable Clients

Three Sigma has worked with leading Web3 protocols and foundations including Uniswap Foundation, Arbitrum Foundation, zkSync, Liquity, Maple Finance, MegaETH, Starkware, Scroll, Linea, Fuel, M0Labs, Filecoin, Panoptic, Arrakis, Hypernative, Immunefi, Vertex, Ostium, and Harmony.

Why Choose Three Sigma

Three Sigma optimizes for reduced exploit risk and low-friction developer fixes rather than vanity issue counts. The audit methodology sequences findings by economic impact and reachability, ensuring the most dangerous issues receive immediate attention. From first deploy through every future upgrade, the team remains available as a long-term security partner — helping protocols design, test, and ship with confidence in an evolving Web3 landscape.