What a Crypto Audit Costs in Cyprus

The honest answer to what a crypto audit costs is that it depends almost entirely on the state of your records, and that the same engagement can differ by a multiple between two firms of identical size.

Key takeaways

The biggest driver is not your size. It is whether your ledger already ties to the chain.
Wallet and chain count drives effort more than transaction volume does. Ten thousand transactions across one chain is easier than two hundred across nine.
Custody model matters: self-custody can be proven cryptographically, offshore exchange positions often cannot be confirmed well at all.
Three different engagements get called "a crypto audit" and they differ in cost by an order of magnitude. Establish which one you need first.

We are asked for a number on most first calls, and we decline on most first calls, which is unsatisfying for everyone. This article explains what sits behind that, because understanding the fee drivers is genuinely useful: three of the four are inside your control, and acting on them before you ask for a quote changes the quote.

Why Nobody Quotes on the First Call

Not evasion, and not a negotiating tactic. The variance is simply enormous.

Two companies can look identical from outside. Same headcount, same balance sheet, same business model. One has a maintained wallet register, a monthly reconciliation and a documented valuation policy. The other has assets across nine chains, a register that was last updated when the CFO before this one left, and a year of history that has never been tied to anything. The audit work in the second case can be several times the first, and there is no way to tell which you are from the outside.

A firm that quotes a fixed fee before scoping is either padding heavily to cover the downside, or is about to come back with a variation once it discovers what it took on. Neither is a good start. What we do instead is a short scoping exercise, mostly a conversation and a look at your wallet inventory, and then a fixed fee for the work that exercise revealed.

Driver One: The State of Your Reconciliation

This is the dominant factor and it is worth more than the other three combined.

If your ledger already agrees with the chain, the auditor's job is to test a reconciliation that exists. If it does not, someone has to build it first, and that someone cannot be the auditor, because an auditor who prepares your records cannot express an independent opinion on them. So it becomes a separate transaction reconciliation engagement that has to complete before the audit can meaningfully start.

Three rough states, in ascending order of cost:

Reconciled monthly, breaks investigated. The audit tests what exists. Cheapest, and the gap to the next state is wider than most people expect.
Reconciled at year-end only. Twelve months compressed into one exercise, with staff turnover in between and transactions nobody present can explain. Materially more expensive, and some items end up estimated rather than proven.
Never reconciled. A reconstruction project, priced as one. This is also where an audit is most likely to end in a qualification, because some of what is missing cannot be recovered at any price.

If you do one thing after reading this, reconcile the year to date before you ask anyone for a fee.

Bar length is the relative effect on effort, not a price. The point is that the largest driver is the one you can fix.

Driver Two: Wallet and Chain Count

Counterintuitive for anyone who thinks in terms of transaction volume: ten thousand transactions on a single chain is a cheaper audit than two hundred transactions across nine chains.

Volume scales with tooling. Breadth does not. Each additional chain brings its own address formats, its own data sources with their own reliability, its own token standards, its own conventions for what a transaction even is, and its own edge cases around staking, wrapping and bridging. Each additional wallet is another control assertion to test. Bridges are the worst of it, because a bridged movement is two transactions on two chains that have to be identified as one economic event, and nothing on either chain says so.

The lever here is real but only forward-looking: consolidate. Firms that reduce from fourteen wallets to five, or retire a chain they no longer trade, pay less in every subsequent year. It does nothing for the year already behind you.

Driver Three: Custody Model

How you hold assets determines what can be proven and how cheaply.

Self-custody is, perhaps surprisingly, the cheapest to evidence. Control can be proven cryptographically with a signed message, the balance is public, and the whole exercise is fast.

Institutional custody with a reputable provider is straightforward: a direct confirmation, and where the custodian has a service organisation control report, the confirmation carries real weight.

Exchange-held balances vary enormously. A regulated venue that responds to confirmation requests is fine. An offshore exchange that will not respond to anyone, where the best available evidence is an API read of the exchange's own display of its own records, is a problem no amount of fee solves. Firms are sometimes surprised that this is the item that qualifies an opinion rather than the complicated DeFi position.

Multi-signature and MPC sit in between: provable, but sometimes only by instructed transfer rather than signature, which takes coordination.

Driver Four: Entity Type and Regulatory Layer

A private company holding treasury crypto needs the balances verified and the accounting right. An authorised CASP needs that plus the evidence its supervisor reads: client asset segregation, the Article 67 own funds position computed against audited fixed overheads, and safeguarding arrangements that hold across the period rather than at a snapshot. We have set that out in full in CASP audit requirements under MiCA in Cyprus.

An ART or EMT issuer adds reserve examination on top. A fund adds investor reporting and valuation scrutiny. This driver is mostly not yours to change, but it should be established on the first call, because it determines which of three quite different engagements you are actually buying.

Three Things Called "A Crypto Audit"

A great deal of confusion about price comes from the word covering three engagements that differ by an order of magnitude.

Crypto audit support. Your existing auditor keeps the engagement and the opinion; we perform the on-chain examination and hand over working papers. Narrowest scope, lowest cost, and the right answer when the audit is only stuck on the digital assets.
Proof of reserves. A targeted attestation about assets and customer liabilities at a point in time. Priced per cycle and usually run several times a year, so the annual cost depends on frequency.
A statutory audit. An opinion on the whole entity, issued under audit standards by a licensed firm. The broadest scope and the highest cost, and the only one that satisfies the Registrar of Companies.

Firms sometimes arrive asking for the third when the first would resolve their actual problem, and occasionally the reverse. Establishing which one you need is the single most useful thing a first call can achieve.

How to Bring the Number Down

In rough order of impact:

Reconcile before you ask. The largest lever by a wide margin, and it is entirely yours.
Produce a complete wallet and account inventory. Cheap for you, expensive for anyone else, and it is the first thing every engagement needs.
Prove control while you can. Signatures obtained today are cheap; reconstructing control after a key rotation may be impossible at any price.
Consolidate wallets and retire dormant chains. Pays back every year after this one.
Write down your valuation policy. Source, time of day, treatment. One page that prevents a recurring argument.
Move off custodians who will not confirm. The most uncomfortable item on this list and occasionally the decisive one.
Engage earlier in the year. Work done in October is cheaper than the same work in February, because evidence is still available and nobody is working to a filing deadline.

A firm that does the first three typically finds the eventual fee unremarkable, in the way that audit fees for conventional businesses are unremarkable. A firm that does none of them is not really buying an audit. It is buying a reconstruction of its own financial history, with an opinion at the end, and that is a different product at a different price.

How Ondology Labs can help: We scope up front and quote a fixed fee once we understand the wallets, chains and volumes involved. Depending on what the scoping finds, that is crypto audit support, transaction reconciliation first, or a full statutory crypto audit with our ICPAC-licensed partner. All of it starts on our crypto audit services page.

What a Crypto Audit Costs in Cyprus (and What Drives the Fee)