Background & Biography
Josef Gattermayer’s background combines software entrepreneurship and academic work in distributed systems. The Block’s professional profile identifies his doctorate at the Czech Technical University in Prague and his role in building Ackee Blockchain. His continuing teaching is independently documented by the university’s current blockchain-course roster, which lists him as a lecturer and tutor.
He co-founded the wider Ackee software business with Dominik Veselý and Martin Půlpitel. CzechCrunch’s February 2023 account describes the group’s expansion from application development into a separate blockchain-security venture with Rockaway, begun in 2021. Gattermayer discussed the unit’s growth and the resources available for open-source tooling. This was reporting on an operating company and its stated plans, rather than evidence of personal investment performance.
His more recent professional identity is founder at ack3, as shown on its website, his August 2026 research byline and the ETHSofia 2026 programme. Ackee’s still-accessible website continues to list him as chief executive and co-founder, while ack3 describes his Ackee leadership in the past tense. This profile uses the newer founder designation without inferring an unverified legal merger, corporate restructuring or departure date. His March 2026 public professional statement places him in Prague, consistent with his ongoing university work.
Notable Contributions
Gattermayer’s blockchain work includes developer tooling before the specialist security venture was established. In May 2018, he announced that Ackee had received Ethereum Foundation support for an iOS development toolkit. His account explained the intention to adapt the company’s existing mobile-application experience for projects interacting with Ethereum. The announcement connects him directly to the development programme, while its future-tense descriptions are kept separate from claims about completed releases or user adoption.
A June 2018 follow-up set out the planned toolkit in more detail. It described reusable Swift project components, tools for generating interfaces to smart contracts and an example application. The design would use EtherKit for transaction handling and underlying functionality, with additional work intended to improve that library. Crediting the existing dependency and the development team matters: Gattermayer’s authored announcement does not imply that he personally wrote every component or invented the underlying technologies.
Published audit reports provide a more specific record of his security responsibilities. Ackee’s March 2025 report on Hyperlend names Gattermayer as audit supervisor and Michal Převrátil as lead auditor, alongside other team members. The assessment covered defined code repositories and revisions relating to lending, configuration and cross-chain deposits. Its methodology combined manual review, static analysis and testing, and the report expressly limited its conclusions to the reviewed scope. This is evidence of supervisory participation in a documented engagement, rather than a blanket assurance about the protocol or its later changes.
Open-source tools are another part of the team’s work. Ackee’s public materials describe Wake for Solidity development, testing and analysis, and Trident for testing Solana programs. They also identify separate technical leads and contributors. The current ack3 site describes its continuing work on Wake and the use of manual review alongside automated analysis. Gattermayer’s contribution here is organizational and research leadership; the available record does not justify assigning him sole authorship of the tools.
His teaching connects these methods with practical training. The Czech Technical University’s blockchain course covers smart-contract programming, testing and security review. Its semester project has students implement a contract, audit another student’s work and respond to findings on their own implementation. The current syllabus includes Solidity, Python and Wake. Gattermayer is one of several listed teachers, so the educational contribution is shared rather than attributed to him alone. The course provides a concrete channel through which industry security practice enters university instruction.
The university’s thesis-topic page also directs prospective students to Gattermayer. Suggested projects include extending static-analysis detectors, representing audits on-chain and evaluating machine-learning or language-model approaches to security testing. These topics show how the teaching programme can lead into applied research. They are opportunities and project specifications, however, and do not by themselves establish that a thesis was completed or that a proposed technique performed successfully.
In August 2026, Gattermayer, Jan Kalivoda and Arman Bašović posted a preprint analyzing an ack3 dataset of 135 DeFi security incidents from the first half of that year. The study distinguished a project’s history of having an audit from whether the particular exploited path fell within a public pre-incident audit’s scope. The authors reported that most identified attack paths in the audited subset were outside the documented scopes. They also noted that two large incidents heavily influenced the loss-weighted result. The work is company-associated research and a preprint, with conclusions bounded by its corpus and classification method, rather than a comprehensive or independently replicated account of all DeFi incidents.
A separate August 2026 article by Gattermayer described ack3’s benchmarking of AI systems against five unpublished audit engagements. The methodology used a common testing setup, compared results with an initial human-report baseline and counted findings validated by reviewers. It also disclosed that the exercise measured recall and did not score false positives. This makes the article relevant to how security work is evaluated, while leaving important limits visible: a small company-selected sample and a particular workflow do not establish general superiority over human auditors or performance on every codebase.
Gattermayer has also taken part in public governance discussions. His March 2026 Arbitrum forum post applied for a Security Council seat and described his security background. In a follow-up exchange, he discussed the balance between fixed execution rules and protecting users during emergencies. The record supports an application and stated position, not an election result. His inclusion here rests on the underlying security work rather than treating candidacy as an appointment.
Why Katharos.ai Follows Josef Gattermayer
Katharos.ai follows Gattermayer for work at the intersection of smart-contract review, developer tools and training. His record offers identifiable examples at several levels: a named audit responsibility, university teaching and authored research about how security claims should be interpreted. These are practical contributions to the infrastructure around blockchain applications.
His research is also relevant to a recurring question for readers: what does a security assessment actually cover? The distinction between reviewed code, later system changes and wider operational dependencies helps frame that question without assuming that a single report can remove every risk.
Areas to Follow
Further publications on audit scope and AI-assisted review may show how the methods develop beyond the initial datasets. Useful evidence would include clear revision histories, reproducible evaluation procedures, disclosure of missed issues and broader testing across different systems.
His continuing education and public discussion are also relevant. The ETHSofia 2026 programme listed him for a panel on AI, continuous security and the risks created by interconnected components. That programme documents the subject of an announced contribution; any specific conclusions from the session would need a recording or published account.
Reporting Scope
This profile covers public professional roles, attributed technical work and documented educational activity. Company statements about security performance are not treated as independent certification. Preprints, announcements, course topics and completed audit engagements retain their different evidentiary status.
Audit clients and research subjects are mentioned only to identify the work. Inclusion does not assess the merits of their tokens or services. Team members, coauthors and third-party tools retain separate credit, and an audit’s existence should not be read as a guarantee of continuing safety.
Areas of Influence
Gattermayer’s principal influence channels are smart-contract security, open-source developer tooling, applied research and blockchain education. Prague is his documented professional base, while the Ethereum and Solana ecosystems give the work an international audience. His relevance lies in how security practices are built, taught and evaluated.
Katharos.ai publishes this profile for information, based on the sources listed. Inclusion is not an endorsement of the individual, their organizations, or any investment product.
Source notice: Information and images are attributed to the external sources listed. Katharos.ai does not endorse the subjects or claims described and does not independently certify the authenticity of every source statement or image.
Photo attribution: Josef Gattermayer, 24 November 2021 (image metadata). Photo and copyright: JAN HROMADKO. Supplied by Ackee Blockchain Security under its explicit editorial-use permission. Source and permission: https://github.com/Ackee-Blockchain/brand/blob/master/photo/photo.md. Original title: CEO Josef Gattermayer — CEO_04.jpg. Complete native 2048×1365 photograph retained with neutral padding to 2432×1368, without cropping or resizing. Metadata removed; ICC retained. No endorsement implied.