Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #10[disputed][awaiting moderator]in the timeline

   “Stacks Foundation announces Asymmetric Research as a core security contributor and sBTC signer for the Stacks Bitcoin L2 ecosystem.”

   reviewerStacks Foundation announced Asymmetric Research as core security contributor and sBTC signer on 2024-10-01.The timeline date (2024-10-01) does not match the actual publication date (October 24, 2024) of the cited Stacks Foundation announcement.
   Proposed correction (not yet applied)

   2024-10-24
   citedstacks.foundation/asymmetric-joins-stacks-ecosystem

No source the reviewer could reach confirms or contradicts the claim.

1. #16[unverifiable][awaiting moderator]in section: Regulatory and Legal Status

   “No regulatory actions, enforcement proceedings, court filings, or legal complaints involving Asymmetric Research have been identified in available sources as of September 2026.”

   reviewerNo regulatory actions, enforcement proceedings, court filings, or legal complaints involving Asymmetric Research have been identified; no OFAC/SEC/CFTC actions on record.Consistent with everything found in independent searches, but a negative claim ('no actions exist') can only be checked by absence of contrary evidence, so it is marked unverifiable rather than confirmed.
   citedwww.asymmetric.re/

The claim was accurate when written but events since have overtaken it.

1. #14[stale][awaiting moderator]in section: Company Overview

   “According to its website, the company employs 45 or more team members distributed across North America, Europe, and Asia.”

   reviewerAsymmetric Research's team numbers 45 or more, distributed across North America, Europe, and Asia.The site may have shown '45+'/three-region figures at the time the archived snapshot (dated 2026-03-06) was captured, and has since grown and added an Africa presence; the current live page no longer matches the page's figures.
   Proposed correction (not yet applied)

   According to its website, the company employs 50 or more team members distributed across the Americas, Europe, Africa, and Asia.
   citedwww.asymmetric.re/company
2. #15[stale][awaiting moderator]in the summary

   “with a team of 45+ researchers across North America, Europe, and Asia”

   reviewerAsymmetric Research employs 45 or more team members (summary statement).Same underlying staleness as the Company Overview section finding; grouped under the same defect_group.
   Proposed correction (not yet applied)

   with a team of 50+ researchers across the Americas, Europe, Africa, and Asia
   citedwww.asymmetric.re/company

A cited source no longer resolves or no longer says what the page attributes to it.

1. #6[link rot][awaiting moderator]in the timeline

   “Felix Wilhelm publishes a disclosure of a critical Solana p-token bug caught before mainnet deployment.”

   reviewerAsymmetric Research disclosed Solana p-token bug caught before mainnet deployment, authored by Felix Wilhelm, around April 2026 — cited to a specific blog URL.The underlying fact (Felix Wilhelm, p-token bug, pre-mainnet, April 2026) is independently verified true, but the cited source_url points to an unrelated 2025 post by a different author, not the p-token disclosure.
   Proposed correction (not yet applied)

   https://blog.asymmetric.re/solana-p-token-catching-a-bug-before-mainnet/
   citedblog.asymmetric.re/invocation-security-n…-in-solana-cpis/

The cited evidence supports part of the claim but not all of it.

1. #3[partially supported][awaiting moderator]in section: Notable Security Disclosures

   “The flaw put at least $126 million at risk according to reporting by CoinTelegraph and CoinDesk.”

   reviewerThe Cosmos IBC reentrancy bug put at least $126 million at risk, per reporting from both CoinTelegraph and CoinDesk.The $126M figure is real and well-sourced to CoinTelegraph, but the page incorrectly attributes the same figure to CoinDesk, whose article (also cited in the timeline) actually states $150 million. This same error recurs in the timeline entry for this event.
   citedcointelegraph.com/news/cosmos-patches-bu…tocol-saves-126mwww.coindesk.com/tech/2024/04/23/patched…that-reported-it
2. #4[partially supported][awaiting moderator]in the timeline

   “Asymmetric Research discloses a critical reentrancy vulnerability in Cosmos IBC timeout handling enabling infinite token minting, putting at least $126 million at risk. Disclosed via Cosmos HackerOne; no funds lost.”

   reviewerThe Cosmos IBC bug, disclosed April 2024, put at least $126 million at risk.Same underlying figure mismatch as the Company Overview/Disclosures section; the timeline entry cites the $150M CoinDesk article as its source for a $126M figure.
   citedwww.coindesk.com/tech/2024/04/23/patched…that-reported-it
3. #11[partially supported][awaiting moderator]in section: Client Relationships and Partnerships

   “Solana Foundation: Asymmetric co-led the STRIDE (Solana Trust, Resilience and Infrastructure for DeFi Enterprises) program, launched in April 2026.”

   reviewerAsymmetric co-led the STRIDE program for the Solana Foundation, launched in April 2026, providing continuous foundation-funded security evaluation across eight security pillars, days after the $270M Drift exploit.Minor overstatement: the cited CoinDesk source describes Asymmetric Research as leading, not co-leading, STRIDE; OtterSec and Neodyme are founding participants in the related SIRN incident-response network, not necessarily co-leads of STRIDE itself. Launch date and 'eight security pillars' framing otherwise check out.
   citedwww.coindesk.com/tech/2026/04/07/solana-…on-drift-exploitwww.crowdfundinsider.com/2026/04/271827-…-defi-protocols/

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: Founders and Key Personnel

   “Jonathan Claudius is co-founder and CEO. His public biography lists more than two decades in cybersecurity, with prior roles including Chief Security Officer at Jump Crypto, Director of Security Assurance at Mozilla, and Lead Security Researcher at Trustwave SpiderLabs.”

   reviewerJonathan Claudius is co-founder/CEO, former CSO at Jump Crypto, with roles at Mozilla and Trustwave SpiderLabs; Felix Wilhelm is co-founder/CTO, former Google Project Zero and Jump Crypto researcher.Founder bios and prior employers are corroborated by the company's own team pages and by Jump Crypto's third-party materials describing Asymmetric as an internally incubated/spun-off team.
   citedwww.asymmetric.re/team/jonathan-claudiuswww.asymmetric.re/team/felix-wilhelm
2. #2[confirmed][no action needed]in section: Founders and Key Personnel

   “Wilhelm is credited with discovering the Marginfi flash loan vulnerability disclosed in September 2025.”

   reviewerFelix Wilhelm discovered the Marginfi flash loan vulnerability disclosed in September 2025.Corroborated by Blockworks and Asymmetric's own post; a secondary repost (BTCC) describes the bug differently (full collateral bypass) but the primary sources agree with the page's characterization.
   citedblockworks.co/news/marginfi-flash-loan-bugblog.asymmetric.re/threat-contained-marg…n-vulnerability/
3. #5[confirmed][no action needed]in section: Notable Security Disclosures

   “The effective impact was capped by Noble's mint limit of approximately 35 million USDC. Disclosed privately to Circle via bug bounty; no user funds lost.”

   reviewerThe Circle/Noble CCTP bug's effective impact was capped by Noble's mint limit of approximately 35 million USDC; disclosed privately to Circle via bug bounty; no funds lost.Core facts confirmed by CoinTelegraph; the 'bug bounty' channel detail is unconfirmed by this source but not contradicted.
   citedcointelegraph.com/news/critical-bug-iden…ircle-noble-cctp
4. #7[confirmed][no action needed]in the timeline

   “Asymmetric Research discloses the Across Protocol event spoofing vulnerability on Solana, which could have allowed attackers to trick relayers into filling unfunded orders.”

   reviewerAsymmetric Research disclosed the Across Protocol event spoofing vulnerability on Solana (April 2026), which could have allowed attackers to trick relayers into filling unfunded orders.Confirmed via the current blog index; date (April 22, 2026) matches the timeline entry exactly.
   citedblog.asymmetric.re/
5. #8[confirmed][no action needed]in section: Client Relationships and Partnerships

   “According to the announcement, Asymmetric had been a core contributor to the Wormhole Protocol for two years prior to public disclosure.”

   reviewerWormhole Foundation awarded Asymmetric Research a Core Contributor Grant, and Asymmetric had been a core contributor to Wormhole for two years prior to public disclosure.Directly confirmed by the cited Wormhole Foundation announcement.
   citedwormhole.foundation/blog/wormhole-founda…latform-security
6. #9[confirmed][no action needed]in section: Client Relationships and Partnerships

   “In October 2024, the Stacks Foundation announced Asymmetric Research as a core security contributor and sBTC signer, joining an established signer group that includes BitGo, Blockdaemon, Copper, Figment, Kiln, Luganodes, and Chorus One.”

   reviewerIn October 2024, the Stacks Foundation announced Asymmetric Research as a core security contributor and sBTC signer, joining BitGo, Blockdaemon, Copper, Figment, Kiln, Luganodes, and Chorus One.Section prose says 'October 2024' (fine), but the corresponding timeline entry gives an exact date of 2024-10-01, which does not match the October 24, 2024 announcement date found on the source page — see separate timeline finding.
   citedstacks.foundation/asymmetric-joins-stacks-ecosystem
7. #12[confirmed][no action needed]in section: Client Relationships and Partnerships

   “Jonathan Claudius submitted a governance delegate proposal to the Jito Foundation.”

   reviewerJonathan Claudius submitted a governance delegate proposal to the Jito Foundation.Confirmed directly by the forum post itself.
   citedforum.jito.network/t/delegate-proposal-j…ric-research/398
8. #13[confirmed][no action needed]in section: Solana Patch Process and Decentralization Concerns

   “The patch was distributed privately beginning April 17, 2025, with a supermajority of stake adopting it by April 18, 2025. Asymmetric Research, Neodyme, and OtterSec conducted patch reviews as part of the coordinated response.”

   reviewerThe ZK ElGamal patch was distributed privately beginning April 17, 2025, with a supermajority of stake adopting it by April 18, 2025; original report by LonelySloth; Asymmetric Research, Neodyme, and OtterSec reviewed the patch.Fully corroborated, including exact dates, by the Solana Foundation's own post-mortem.
   citedsolana.com/news/post-mortem-may-2-2025
9. #17[confirmed][no action needed]in section: Unverified and Self-Reported Claims

   “'Prevented over $5 billion in potential losses' through responsible disclosure — a figure cited in the Wormhole Foundation grant announcement and the Felix Wilhelm Crunchbase profile.”

   reviewerThe $100 billion in prevented losses, $300 million recovered, and $5 billion prevented-losses figures are self-reported/marketing claims not independently audited; the $5B figure appears in the Wormhole grant announcement and Crunchbase.The page's own hedged treatment of these self-reported figures is accurate and appropriately skeptical; no correction needed.
   citedwormhole.foundation/blog/wormhole-founda…latform-security