They Fled Ukraine to Keep Their Cyber Startup Alive. Now, They’re Hacking Back.

“How will I feel, how will I look into the eyes of my employees, if we had the opportunity, had the money, understood that something can go wrong, and we didn’t do at least something to try to get everybody out?” he said.

Hacken, a five-year-old company that tests blockchain-based projects for security flaws, employs about 80 auditors, developers and other crypto specialists. Many contribute to the war effort by finding vulnerabilities in Ukrainian and Russian computer systems and reporting the information to Kyiv’s Ministry of Digital Transformation or National Security and Defense Council, Mr. Budorin, 35, said.

Hacken’s Liberator application, which allows users to lend computing power to distributed denial-of-service attacks against Russian propaganda sites, counts more than 100,000 downloads. The company is also contributing to targeted efforts against Russian businesses, including an attempt to pressure the suppliers of Russian military footwear manufacturers, Mr. Budorin said.

Non-state actors supporting both sides of the conflict have exchanged fire mostly via low-impact cyberattacks. Those hitting Russian targets have met with little scrutiny despite pushes by Washington and Brussels in recent years to set international norms limiting such cyber activity, said Stefan Soesanto, senior cyber defense researcher at the Center for Security Studies at Swiss university ETH Zurich.

“Within the Ukraine conflict, a lot of norms and rules for non-state behavior—or even company behavior—are gone now,” he said.

Mr. Budorin sees Hacken’s offensive efforts in terms of right and wrong. “This is not the time to be afraid of something,” he said.

Hacken’s journey across Europe began Feb. 14, as Western officials warned of a Russian invasion. Some employees discounted the possibility of an attack but in a meeting at Hacken’s office, located in a former Russian military factory in Kyiv’s central district, company leaders advised the team to work elsewhere for two weeks. Mr. Budorin said they thought the move would be temporary. The company offered $4,000 to workers who left the country and $2,000 to those who relocated within Ukraine.

Chief Business Development Officer Yevheniia Broshevan and others were on a plane to Barcelona the following day. Other colleagues went to Turkey, Austria or western regions of Ukraine. Nine days later, Russian forces invaded. By that time only a few dozen Hacken employees remained in the country to face the bombing raids and occasional communications blackouts.

“After all of that, we realized how lucky we were to have made the decision early,” Ms. Broshevan said.

Hacken executives said they split the company into two teams to maintain focus amid the flood of news alerts about Russia’s onslaught and Telegram chats from family and friends.

One team handles Hacken’s core business as it attempts to grab a greater share of the cryptosecurity market and develop subscription-based software slated for rollout later this year. The other pitches into the loosely organized cyber counteroffensive against Russia.

For Denys Ivanov, Hacken’s 35-year-old chief operating officer, making money to support Ukraine, along with aiding the digital war effort, is a better use of the team’s expertise than taking up arms. It has also helped him overcome a sense of guilt for leaving the country as it was attacked.

“The feeling that you were safe was so bad,” Mr. Ivanov said.

Mr. Ivanov said he and his wife went to Spain initially without their two children, who stayed in Ukraine with his parents. Four days after the war began, Mr. Ivanov flew to Bucharest, Romania, took buses and taxis to the edge of Moldova and crossed into that country by foot to meet his parents at a checkpoint on the Ukrainian border. He then drove back to Barcelona with his children—aged six and seven—over the next three days. His parents remained in their hometown in the Odessa region, far from the most intense fighting.

Hacken executives are now planning for the long term. Office space and the cost of living in Spain were pricey, they said, so the company last month moved to Lisbon.

Mr. Ivanov went ahead to the city to scout out flats and send videos back to colleagues, renting about 20 apartments on their behalf. The company is offering employees 500 euros extra each month to relocate there.

Hacken has continued to grow in revenue and headcount, despite cutting ties to Russian customers unless they denounce the war, said Mr. Budorin, the chief executive. The company generates roughly $1 million a month in revenue and is profitable, he said. Hiring new employees has proved easier than expected, Mr. Budorin added, given that so many Ukrainian tech workers are out of jobs. The World Bank has estimated Ukraine’s economy will contract by 45% this year.

Adjusting to a working life with colleagues in a Lisbon office he described as “cozy,” Mr. Ivanov, the chief operating officer, said he’s trying to save money on food and other expenses as he budgets for educating his children and sending funds to five family members back home.

“Each of us [is] just waiting until Ukraine is going to win this war,” he said. “And each of us thinks it’s our mission to get back and to try to rebuild.”

Write to David Uberti at david.uberti@wsj.com