Theoriq completes continuous infrastructure security tool pilot with Nethermind, hardening signing and deployment security

Every decision a curator makes ends the same way: as a signed transaction.

‍

We publish a great deal about the decisions. Conservative leverage, continuous monitoring, health-factor defense, documented unwind paths all depend on software running on infrastructure. While the strategy gets the attention, it is infrastructure that more often than not has to fend off the attackers.

‍

Theoriq participated as a design partner in a pilot of a pre-release infrastructure risk-assessment tool developed by @NethermindSec. We self-hosted the software to evaluate its capabilities across selected aspects of digital asset custody and signing infrastructure, using its findings to support our own security review. Here we share selected observations from that evaluation.

Why Nethermind

Nethermind built the second-largest Ethereum execution client and has worked at Ethereum’s infrastructure layer since 2017, giving it practical experience in infrastructure engineering. Nethermind Security provides audits, formal verification and AI security tooling together into continuous security, and this pilot extends that approach to the infrastructure around the code, assessed on the same timescale it changes.

That fit mattered to us. Custodians, lenders and tokenized asset issuers ask operational questions before they ask yield questions, and they ask them about everyone in the chain, not just the curator. We wanted to evaluate tooling developed  by a team that runs this kind of infrastructure itself and explore how it could support our own security reviews.

Operational risk is a discipline, not a surprise

Institutional finance resolved this question decades ago. Custody controls, segregation of duties, change management and continuous third-party oversight exist because the failure mode in a large financial operation is rarely the strategy. It is the operational layer around it. Regulators codified the expectation: the EU's Digital Operational Resilience Act, applicable since January 2025, requires financial entities to monitor technology-provider risk throughout the life of the arrangement rather than at review points.

Onchain finance is arriving at the same conclusion, with data behind it. 

TRM Labs attributes 76 percent of the value stolen in crypto during 2025, or 2.2 billion dollars across 45 incidents, to what it classifies as infrastructure attacks: compromises of keys, wallets, privileged access and front ends, rather than smart contract code. CoinGecko reaches the same conclusion from the other direction. Its 2026 State of Crypto Security Report found that platforms which had completed independent audits accounted for 88.44 percent of funds lost between January 2025 and July 2026, with most attacks falling outside conventional audit scope. The audits were not wrong. They were answering a different question, on a fixed date, about a system that keeps changing.

That is not an argument that onchain yield is unusually dangerous. It is an argument that controls have to sit where the risk actually is, and that they have to run continuously rather than annually. Mature operators already work this way. We would rather be early to it than defend a gap later.

What we tested

Theoriq is one of the design partners Nethermind has built this work with: a live curator running vaults, treasury operations and a real deployment pipeline. We got early access to the assessment tool. They got ground truth from an operation with something to lose.

The program ran in phases against a defined inventory. It began with the externally reachable assets in scope, extended into authenticated review of internal configuration under scoped access, and treated the deployment pipeline as its own workstream throughout. Assessment was recurring: checks ran against the inventory roughly hourly, around the clock, providing updated observations at each scan. Findings were triaged by severity, routed to an owner, and confirmed closed by rescan.

It surfaced real work, and most of it was the ordinary substance of an infrastructure review: automated jobs holding broader permissions than the task required, access credentials persisting further through a pipeline than they needed to, configuration and endpoints left behind by earlier work. None of that is exotic. Almost every operation carries some version of it, and most never go looking. All of it went through the same loop for review and follow-up.

Here is some of what that involved:

Continuous external assessment. The externally reachable surface was treated as the first perimeter: attack surface mapping, secret and credential detection across public code, treasury and multisig intelligence, and monitoring of newer account abstraction authorization primitives as they came into use. The output was not a document at the end of a quarter. It was a picture updated through recurring checks of the configured assets.

Authenticated review, read-only throughout. A further phase covered cloud identity and access configuration and private repositories under scoped, least-privilege access. Nethermind maintained a read-only operational posture for the duration and held no write access to Theoriq infrastructure at any point in the engagement. Nethermind offered the self-hosted build, which lets an operator run the agent on its own infrastructure so that scan data stays inside its own environment.

Attack paths, not just findings. A weakness that looks minor on its own is often the first step in something that is not. The pilot mapped how our systems connect to one another and what sits at the end of each route, then chained individual findings along those connections into potential attack paths for our review. That is what set priority: not how severe a finding looked alone, but what it opened up in combination. 

Deployment pipeline hardening. Build and continuous integration systems are part of the attack surface, and in 2025 they were an unusually productive one for attackers. The changes we implemented were unglamorous and specific: pinning outside components to reviewed versions, restricting automated jobs to least-privilege and read-only permissions, preventing access credentials from persisting into later build steps, and running automated update proposals so that pinned versions stay current instead of going stale.

The first three map directly to OpenSSF Scorecard checks and to GitHub's own hardening guidance for Actions, with SLSA build levels covering provenance further up the same stack. In the March 2025 compromise of the widely used build action tj-actions/changed-files, Wiz noted that repositories using a hash-pinned version were not impacted, unless they had updated to a compromised hash during the exploitation window. Unglamorous controls are usually the ones that hold.

Defined escalation and a closure loop. Findings were routed to our engineering channels as they were raised. Critical-severity findings, meaning anything that could plausibly affect control of signing infrastructure or key material, were escalated immediately. Everything else entered a remediation queue with an owner. The part that mattered most was the last step: remediated items were rescanned and confirmed closed by the platform rather than marked resolved on our own say-so. A finding is not closed because we say it is. These checks supported our independent verification.

Findings mapped to compliance frameworks. Each finding was tagged against frameworks including DORA, SOC 2 and CCSS as it was raised, so the record lines up with the frameworks counterparties ask about. However, these mappings did not constitute a legal compliance assessment, SOC 2 examination or CCSS certification.

Detection feedback. We confirmed finding accuracy and remediation status back to Nethermind, which tuned detection precision. That is the substance of a design partnership. A security platform is only as good as the environments it has been sharpened against, and we would rather be one of the environments doing the sharpening. 

What the pilot was for

Infrastructure and contract logic are different disciplines, and we treat them that way. The work with Nethermind covered the operational layer: the systems, the access paths and the deployment pipeline that carry a decision from strategy to signature. Contract logic runs on its own review track, and the vaults we operate each go through it.

Being specific about which control does which job is the difference between a security posture and a performative badge.

Theoriq operates the curator layer, between protocols that provide rate markets and platforms that provide access. Curation is a chain of decisions that starts with a strategy and ends with a signature, and every link in it runs on infrastructure that somebody has to answer for.

We would rather discover those gaps with Nethermind than from an attacker. 

‍

About Theoriq

Theoriq builds the risk and yield intelligence layer for tokenized markets. It turns tokenized assets into risk-managed yield through multi-asset and infra-agnostic DeFi vaults: curators set the strategy and the risk limits, and AI-assisted systems execute and monitor within them. Its flagship vault, AlphaVault ETH, applies this framework to ETH-native yield, and the Theoriq Gold Vault extends it to tokenized gold, with plans to extend the model to additional real-world assets. Learn more at theoriq.ai.