CertiK has urged institutions holding cryptocurrency to treat wallet security as a continuous control system rather than a question of where private keys are stored, warning that valid signatures can still authorize malicious transactions when interfaces, permissions, or approval processes are compromised.
The blockchain security firm’s framework places governance around every stage of an asset movement: who can propose it, who reviews it, who signs it, what systems validate it, and who can change the rules. That approach responds to a persistent institutional risk: a transaction may pass a multisignature threshold while still violating the organization’s intended controls.
CertiK cited a 2025 attack involving a Safe wallet interface, in which attackers allegedly altered the front end viewed by signers. The interface displayed what appeared to be ordinary transfer information, while the transaction payload authorized a change to the wallet’s implementation contract. After multiple valid signatures were collected, the attackers were able to move assets.
The incident illustrates why institutions cannot rely on signature counts alone. A multisig wallet requires several authorized signers before a transaction can execute, reducing the risk attached to one compromised key. Yet it does not automatically prove that those signers reviewed the same transaction data, used trusted devices, or understood the permissions embedded in the payload.
Approval systems need controls beyond multisig
CertiK separates institutional protection into three related layers: multisignature authorization, multiparty computation, or MPC, and internal business approvals.
Multisig distributes signing authority among several keys. MPC divides the cryptographic process among separate parties or devices so that a complete private key does not need to be assembled in one location. Internal approvals determine whether a transaction is permitted under the organization’s own policies before cryptographic signing begins.
Each layer addresses a different failure mode. Multisig can reduce exposure to a single stolen credential, while MPC can limit the danger of a full key being exposed. Neither tool, by itself, decides whether a transfer has a legitimate business purpose, whether its recipient is correct, or whether its value exceeds an approved limit.
CertiK said institutions need to test whether those layers constrain one another in practice. An internal policy that requires independent approval provides limited protection if the same administrator can change the approval threshold, replace a signer, alter an address whitelist, and authorize the transfer.
The firm’s analysis of the Gnosis Pay incident made a related point. According to CertiK, a flaw in an authorization-check module allowed unauthorized transactions to be accepted. Reviews of custody systems therefore need to cover more than the cryptography securing a key. Identity validation, transaction checks, permission updates, recovery functions, and software upgrade paths can all provide routes around otherwise strong custody architecture.
Permission changes can be as sensitive as withdrawals
Institutional security policies often focus most closely on outgoing transfers, but CertiK said changes that modify control over assets require similar scrutiny. Those actions include adding a withdrawal address to a whitelist, raising a transfer limit, replacing an authorized signer, changing recovery settings, or updating wallet software.
Such changes can create delayed risk. An attacker who gains access to an administrator account may avoid an immediate withdrawal and instead prepare the environment for a later transaction by adding a trusted-looking address, altering a limit, or weakening a required approval route. Reconciliation and audit records need to capture these administrative actions alongside asset movements.
A complete framework should follow a transaction from initiation through reconciliation, CertiK said. That includes checking the stated purpose of a transaction, independently validating counterparties and wallet addresses, applying value limits, assigning responsibility at each stage, and ensuring records match across trading, custody, and accounting systems.
The approach is aimed at closing the gap between approval and execution. In a large organization, the staff member approving a transaction may not be the person signing it, and neither may control the system that broadcasts it on-chain. Clear handoffs and records can help expose a mismatch before funds leave custody.
Human and vendor risks remain central
The institutional threat model extends well beyond leaked seed phrases and phishing attempts. Organizations also face concentrated administrative permissions, compromised employee devices, vulnerabilities in third-party software, insider collusion, and mistakes made during routine operations.
Attackers may spend extended periods mapping an organization before attempting a theft. Gate’s security team described preparations that can include reviewing job postings, identifying employees through developer platforms, and establishing contacts at industry events. These methods can support impersonation or social-engineering campaigns aimed at administrators, finance staff, or technical personnel with access to approval systems.
Business continuity creates another pressure point. Emergency procedures may allow normal controls to be bypassed during a service outage or market event. Those permissions need expiry conditions and post-incident reviews; otherwise, a temporary exception can become an overlooked permanent weakness.
Third-party dependence also requires detailed planning. Custody providers, wallet software vendors, cloud services, compliance tools, and recovery partners can all affect an institution’s ability to control assets. Institutions should understand who can access each service, how backups work, what happens if a provider becomes unavailable, and whether recovery depends on a single outside party.
A cautious route for new institutional users
CertiK recommends that institutions beginning a crypto allocation establish objectives, exposure limits, supported assets, venues, chains, and counterparties before moving significant funds. Responsibility should then be assigned separately for transaction initiation, approval, signing, reconciliation, and incident response.
Small pilot programs can test the actual workflow under controlled conditions. An institution can confirm whether its teams can trade, withdraw, reconcile records, verify recipient addresses, and respond to a lost device or service outage without relying on improvised decisions during an emergency.
Transfer delays can add a final window for intervention. Where supported, a delay between approval and settlement would give an organization time to freeze an outgoing transaction if suspicious activity is detected. The measure works best alongside monitoring and clear escalation procedures, since a delay alone cannot identify an unauthorized request.
CertiK also advised institutions evaluating platforms or custody arrangements to confirm that security assessments apply to the precise service and software version they plan to use. A review of one product component does not automatically cover connected systems, administrative interfaces, recovery tools, or permission-management modules.
The resulting model shifts custody from a wallet-management exercise into an operational discipline. Large crypto holdings require controls that assume keys, interfaces, employees, vendors, and even established approval processes can fail—and that a single valid signature should never be the last line of defense.
Strengthen your institutional governance and crypto safeguards with Toobit Academy’s guide on crypto safety standards and best practices.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
