Risk warning: This article is education and advisory only. It is not investment advice, financial advice, tax advice, or a recommendation to buy, hold or transact in any asset. Crypto assets are volatile, largely unregulated in many jurisdictions, and you can lose everything. If a transaction goes wrong, there is usually no chargeback and no one to call. Get independent professional advice before acting.
Most operators worry about the wrong thing. They obsess over which coin, which exchange, which price. Then they lose the lot because one person had the seed phrase in a Notes app.
The money almost never disappears the way people imagine. It rarely gets "hacked" through some cinematic breach. It walks out the door because of a custody decision nobody thought hard about — a single key, a bad backup, a rushed signature. This is the boring stuff. It's also the stuff that actually protects you.
The one question that matters: who can move the money
Forget the jargon for a second. Custody boils down to a single question: who, physically, can authorise a transaction — and how many of them need to agree?
If the honest answer is "one laptop, one person, one password," you have a problem. That's not custody, that's a hostage situation waiting to happen. That person can be phished, coerced, sacked, or hit by a bus, and your treasury goes with them.
Serious operators separate this into three roles that should almost never be the same person:
- Who initiates a payment (the request)
- Who approves it (the check)
- Who holds the keys that sign it (the execution)
Once those are split, most catastrophic failures become near-impossible. A single compromised account can't drain anything on its own.
Multisig beats a hero with a hardware wallet
A lot of businesses graduate from an exchange to a single hardware wallet and think they've arrived. They've swapped one single point of failure for another — a slightly shinier one.
The grown-up answer is multisignature (multisig): a setup where, say, two of three keys are needed to send funds. Those keys live in different places, held by different people, ideally on different device types.
Why it works:
- Lose one key? You still have access via the other two.
- One key stolen? The thief still can't move anything.
- A rogue insider? They need a co-conspirator, which raises the bar enormously.
For a small firm, a 2-of-3 held by the founder, a trusted director and an off-site backup is a sensible starting shape. The exact structure depends on your team, your jurisdiction and your transaction volume — which is exactly the kind of thing we walk clients through rather than prescribe blind. If you're moving real value cross-border, our international desk sees these setups every week.
Backups: the failure nobody rehearses
Here's an uncomfortable truth. More operators lose crypto to bad backups than to theft.
A seed phrase photographed on a phone. A recovery sheet in a shared Google Drive. A single copy in a drawer that flooded. These aren't edge cases — they're the norm.
A workable backup discipline:
- Write seed phrases on paper or steel, never digitally.
- Store copies in geographically separate locations.
- Test your recovery before you rely on it — restore a wallet from the backup on a spare device.
- Document who knows what, and what happens if a key-holder is unavailable.
That last point — succession — is the one businesses skip. If your finance lead leaves on bad terms, can you still access funds? If not, fix it today.
Insider risk is the real threat model
External hackers get the headlines. Insiders get the money. A trusted employee with too much access and a bad month does more damage than any anonymous attacker.
The defence isn't suspicion, it's structure. Spending limits per key-holder. Approval thresholds that scale with amount. Whitelisted withdrawal addresses so funds can only go to pre-approved destinations. An audit trail that shows who did what.
None of this requires trusting people less. It just means a single lapse — theirs or yours — can't end the business.
Settlement-time discipline
Custody hygiene collapses fastest under pressure, and OTC settlement is peak pressure. Someone's on a call, a counterparty is pushing, and suddenly a large transfer is being signed off in thirty seconds.
Build your controls so speed can't override safety:
- Test transactions first. Send a tiny amount, confirm receipt, then send the rest. Always.
- Verify the full address, not the first and last four characters. Address-swapping malware relies on you glancing.
- Beware fake and "flash" USDT. Balances that appear then vanish, or tokens that mimic a real contract, are a classic trap. Confirm the token contract and that funds actually settle on-chain before you release anything.
- Watch for honeypot behaviour — wallets you can send to but can't withdraw from.
If any of this is new to you and you're handling meaningful sums, don't learn it live. We cover exactly these workflows in our crypto advisory work, and the same operational thinking runs through our AI training programmes — because the best control is a team that knows what a scam looks like before it lands.
The operator's checklist
Before you move another penny of value:
- No single person can move funds alone.
- Keys are split, geographically and by device.
- Backups exist, are separated, and have been tested.
- Withdrawal addresses are whitelisted.
- Every large transfer starts with a test send.
- There's a documented plan for if a key-holder disappears.
None of it is glamorous. All of it is cheaper than the alternative.
Get the setup right, once
Custody is one of those areas where the cost of getting it wrong dwarfs the cost of getting it right. Sort the structure early, while amounts are small and the stakes are low.
If you want a second pair of operator's eyes on your key management and settlement process before it's tested by a real transaction, book a call or get in touch. We'll tell you what we'd actually do — not what sounds impressive.