For Business · Lesson 4 of 7

Custody and security policies

Education only. Not investment, legal or tax advice. We do not pick coins, vendors or platforms.

Most business losses in crypto come from people and process, not broken math. A short written security policy prevents the common ones.

Where funds live

• Hot wallet: online, fast, for small daily amounts.
• Warm: online but needs extra approvals.
• Cold storage: keys kept offline (hardware devices or a qualified custodian's vault), for anything not needed this week.

Set a maximum for the hot wallet and sweep anything above it to cold storage on a schedule.

Self-custody vs. a qualified custodian

With self-custody, you control the keys and carry all operational risk. With a regulated custodian, they hold keys under contract; you carry counterparty risk instead. Many businesses split: a custodian for most funds, a small self-custody float for operations. Use the vendor checklist for any custodian.

Never one person, never one key

• Multisig requires several keys to approve a transfer (for example 2 of 3).
• MPC splits one key into shares held by different people or devices.
• Either way: no single employee, founder included, should be able to move large amounts alone.

The approval rules to write down

• Who can request, who can approve, and the limits for each.
• Address allowlists: transfers only to pre-approved addresses, added with a waiting period and a second approver.
• Verify new addresses by a call-back on a known number, never by email or chat alone.
• Send a small test transaction before large first-time transfers.

Keys and recovery

• Seed phrases and key shares are written on paper or metal, stored in separate secure locations, never photographed, typed into a computer, emailed or put in cloud notes.
• Document a recovery procedure and test it with a small amount.
• Plan for staff leaving: rotate keys and access the same day.

Everyday protection

• Hardware security keys for exchange and email logins; no SMS codes where avoidable.
• Separate devices for treasury work where possible.
• Train staff on fake support, fake invoices and wallet "approval" drainers — see approval drainers and fake support.

Incident response (one page)

1. Freeze: revoke access, pause transfers, contact your custodian or exchange.
2. Record: transaction IDs, addresses, times, screenshots.
3. Report: to police and the relevant authority (in the US, the FBI's IC3); your insurer; your accountant.
4. Beware "recovery" offers — they are a common second scam (recovery scams).

Insurance questions

Ask any custodian or insurer: what exactly is covered (theft from hot or cold storage, insider theft), the limits, exclusions, and whether the policy covers your funds specifically or the provider in total.

Quick check

Sources and further reading

• FBI IC3
• CISA: phishing-resistant MFA

Last reviewed October 30, 2026. Laws and tax rules change; confirm with a licensed professional where you operate. Spotted an error? Tell us.