Cybersecurity risk is a central consideration when evaluating digital asset custody infrastructure. A custodian can use cold storage, multi-factor authentication, encryption, and other security technologies while still having material weaknesses elsewhere in its operating model.
The scale of security losses across the broader digital asset ecosystem illustrates why individual controls should be assessed as part of a wider system. CertiK recorded more than $1.31 billion in losses across 344 Web3 security incidents during the first half of 2026.
Wallet compromises accounted for approximately $444.5 million across 33 incidents, while phishing accounted for approximately $366.3 million across 63 incidents. These figures cover the broader Web3 ecosystem rather than institutional custodians specifically, but they illustrate the consequences that can arise from compromised wallets, credentials, and transaction access.
A useful custody assessment therefore looks across the full control environment. That includes identity and access management, private-key protection, transaction authorization, segregation of duties, monitoring, incident response, recovery capabilities, and dependence on external technology providers.
What Should Custodian Cyber Risk Benchmarks Measure?
Cyber risk benchmarks for digital asset custodians should cover the points at which unauthorized access could lead to the loss, transfer, or misuse of assets.
A practical framework includes:
- Identity and access: How users, administrators, and privileged accounts are authenticated and authorized.
- Key and wallet security: How private keys and signing mechanisms are generated, stored, accessed, rotated, and protected.
- Transaction controls: How withdrawals, transfers, and other sensitive actions are approved and monitored.
- Segregation of duties: Whether a single individual or compromised credential can initiate and complete a high-impact action.
- Monitoring and detection: Whether unusual access, transactions, configuration changes, and other indicators are detected promptly.
- Incident response: Whether the custodian has tested procedures for containment, investigation, communication, and escalation.
- Recovery: Whether systems, access mechanisms, and custody operations can be restored after a security incident.
- Third-party dependencies: Whether cloud providers, technology vendors, wallet infrastructure, and other external services introduce unmanaged points of failure.
- Governance: Whether security responsibilities, escalation paths, testing requirements, and control ownership are clearly defined.
This framework aligns with established cybersecurity approaches that treat governance, identification, protection, detection, response, and recovery as interconnected outcomes. For digital asset custody, those principles need to be considered alongside blockchain transactions, private-key control, signing infrastructure, and the difficulty of reversing confirmed transactions.
Identity and Access Controls
A custodian’s security posture begins with controlling who can access systems and what those users are permitted to do.
Authentication should be assessed separately from authorization. Strong login authentication does not prevent an authorized user from performing an inappropriate transaction if permissions are too broad.
Relevant controls include:
- phishing-resistant authentication;
- multi-factor authentication;
- device binding where appropriate;
- privileged-access management;
- role-based access controls;
- least-privilege permissions;
- separation between administrative and operational accounts;
- timely removal of access when roles change;
- controls over emergency or break-glass accounts;
- logging of privileged activity; and
- periodic access reviews.
The threat data supports placing particular emphasis on phishing resistance. In July 2026, Hong Kong’s Securities and Futures Commission reported that phishing accounted for 57% of cybersecurity incidents reported to the Hong Kong Computer Emergency Response Team Coordination Centre in 2025.
The SFC subsequently called on licensed virtual asset service providers to use robust, phishing-resistant authentication and device binding, alongside monitoring for suspicious activity and procedures for responding to unauthorized transactions.
For institutional custody, the relevant benchmark is therefore not simply whether multi-factor authentication exists. It is whether authentication, authorization, device controls, and privileged access are designed so that compromising one identity does not automatically provide a path to high-impact asset movement.
Wallet, Private-Key, and Signing Security
Private-key and signing security are central to digital asset custody because the systems controlling transaction authorization must remain protected from unauthorized access and manipulation.
A custody assessment should examine how keys and signing mechanisms are:
- generated and stored;
- isolated from ordinary corporate systems;
- accessed and administered;
- protected through multi-party approval where appropriate;
- monitored for unauthorized activity;
- backed up and recovered; and
- disabled or isolated when compromise is suspected.
The assessment should also consider the operational controls surrounding these systems. Cold storage can reduce certain attack surfaces, but it does not by itself demonstrate effective custody security. Procedures governing transfers between storage environments, signing-device access, transaction authorization, emergency controls, and recovery can materially affect the overall risk.
MiCA Article 75 addresses several of these operational considerations for crypto-asset custody, including custody policies, records of client positions and movements, security systems, segregation, procedures for returning crypto-assets or access, and responsibility for losses attributable to the custody service.
Recommended Read: Wallet Architecture Fundamentals – Why Control, Custody, and Access Are Not the Same Thing
Transaction Controls and Policy Enforcement
Protecting keys is only one layer of transaction security. A custodian also needs controls around what those keys are allowed to authorize.
Transaction controls can include:
- withdrawal limits;
- address allowlists;
- restrictions on new destination addresses;
- transaction-size thresholds;
- time delays for selected actions;
- multi-person approval;
- transaction simulation or validation;
- policy-based restrictions;
- anomaly detection;
- automated alerts;
- manual review for unusual activity; and
- independent verification of high-value transactions.
These controls are particularly important because blockchain transactions can be difficult or impossible to reverse once confirmed.
A strong control environment should therefore distinguish between authentication, authorization, and transaction approval. Successfully logging into a system should not by itself establish that a particular transfer is permitted.
This is where segregation of duties becomes important. An employee who can initiate a withdrawal should not necessarily be able to approve it, alter the relevant security policy, and complete the transaction without independent intervention.
European regulators have also placed transaction controls directly within the scope of current custody resilience supervision. ESMA’s 2026 Common Supervisory Action on crypto-asset service providers performing custody activities specifically examines key and storage management, transaction controls, incident detection and response, distributed-ledger risks, smart-contract risks, governance, and third-party dependencies.
Recommended Read: Policy-Driven Transaction Controls: Preventing Authorized Actions From Becoming Incidents for a deeper examination of transaction-level safeguards.
Encryption and Secure Data Handling
Encryption remains an important control, but custody assessments should distinguish between encryption in transit, encryption at rest, and protection of the cryptographic material that makes encryption effective.
Areas to examine include:
- encryption of sensitive data in transit;
- encryption of sensitive data at rest;
- secure key management;
- secrets management;
- access restrictions for encryption keys;
- key rotation and lifecycle management;
- backup protection;
- secure deletion where applicable; and
- monitoring for unauthorized access to sensitive data.
Custodians may hold information beyond blockchain keys, including client records, authentication information, operational data, transaction histories, system configurations, and recovery information. A compromise of these systems may create risks even if private keys themselves remain protected.
The same principle applies to authentication secrets and access tokens. Protecting the data used to establish identity or authorize actions is part of protecting the custody environment itself.
Encryption should therefore be assessed as one component of a broader information-security architecture rather than treated as evidence of security on its own.
Detection, Monitoring, and Incident Response
Prevention controls cannot eliminate cyber risk. Custodians need mechanisms that can identify suspicious behavior and contain incidents before they develop into larger losses.
Monitoring should cover more than conventional network events. Relevant signals may include:
- unusual login patterns;
- privileged-account activity;
- changes to wallet or signing configurations;
- new devices or authentication factors;
- unusual withdrawal destinations;
- abnormal transaction volumes;
- repeated failed authentication attempts;
- changes to access permissions;
- suspicious API activity;
- unexpected changes to infrastructure; and
- activity involving critical third-party services.
The quality of monitoring depends on what the custodian considers a meaningful event. A large withdrawal may be legitimate, while a small transaction to an unusual destination could be an early indicator of account compromise.
The 2026 security data illustrates why incident frequency alone can be misleading. CertiK recorded 63 phishing incidents resulting in approximately $366.3 million in losses. Phishing incident volume was more than 50% lower than in the first half of 2025, yet losses declined by only about 11%. Four highly targeted phishing incidents accounted for approximately 85% of phishing losses during the period.
The implication for custody benchmarks is important: incident counts should be considered alongside potential impact, transaction authority, asset exposure, and the concentration of privileges.
Incident response should also be tested rather than treated solely as a written policy.
Testing should address scenarios such as:
- compromised employee credentials;
- unauthorized withdrawal attempts;
- compromised signing infrastructure;
- loss of access to a critical wallet system;
- cloud or infrastructure outages;
- malicious insider activity;
- compromise of a third-party technology provider; and
- simultaneous technology and communication failures.
Institutions should also understand who has authority to pause transactions, isolate systems, notify clients, contact external parties, and restart affected services.
Recovery and Operational Resilience
Cybersecurity benchmarks should not stop at detection.
A custodian may identify an incident correctly but still face significant exposure if it cannot restore secure operations or regain control of critical systems.
Recovery planning should address:
- backup integrity;
- recovery of critical systems;
- restoration of access controls;
- key and signing infrastructure recovery;
- alternative communication channels;
- dependency failures;
- manual operating procedures;
- transaction reconciliation;
- client communication;
- recovery testing; and
- lessons learned after incidents.
Recovery procedures should also distinguish between restoring an IT system and restoring safe custody operations. Restarting a database does not necessarily mean that transaction authorization, wallet balances, access rights, and control records have been independently validated.
The importance of this distinction is reflected in the first DORA incident report from the European Supervisory Authorities. The report recorded 3,383 major ICT-related incidents reported by financial entities and found that approximately one-third had a cross-border impact. System failures and external events were the main drivers, while cybersecurity incidents represented 10% of the reported incidents.
This is an important distinction for custody assessments. Operational resilience is broader than preventing hacking. A custodian also needs to remain capable of protecting assets and maintaining controlled operations when critical technology, infrastructure, or service providers become unavailable.
Third-Party and Cloud Risk
Custodians frequently depend on external infrastructure. These dependencies can include:
- cloud hosting;
- wallet technology;
- hardware security modules;
- identity providers;
- analytics and monitoring services;
- blockchain infrastructure;
- node providers;
- communications platforms;
- data providers; and
- other technology vendors.
A custodian can maintain strong internal controls while still being exposed through a critical provider.
The DORA incident data provides useful context. Around one-third of the 3,383 major ICT incidents reported in the EU had a cross-border impact, highlighting how shared infrastructure and external services can transmit operational risk across institutions and jurisdictions.
Third-party risk assessment should therefore consider the provider’s role, access level, concentration risk, security controls, incident history, recovery arrangements, contractual responsibilities, and ability to support the custodian during an outage or security event.
The question is not simply whether a vendor is reputable. Institutions should understand what happens to custody operations if that vendor becomes unavailable, compromised, or unable to provide accurate information.
ESMA’s custody-focused supervisory action also specifically includes third-party dependencies alongside key and storage management, transaction controls, incident detection and response, DLT risks, and smart-contract risks.
Recommended Read: Third-Party Dependency Risk: Securing the Infrastructure You Do Not Control for a broader examination of external technology exposure.
Zero-Trust Controls and Continuous Verification
Zero-trust architecture is relevant to custody environments because sensitive operations should not automatically be trusted simply because they originate inside a corporate network or from an established user account.
It can be described as an approach that removes implicit trust based on network location or ownership. Authentication and authorization are treated as distinct functions that occur before access to resources is established.
For custody operations, this principle can translate into:
- verifying users and devices before access;
- limiting permissions according to role and task;
- separating administrative environments;
- continuously evaluating access conditions;
- segmenting critical systems;
- restricting privileged sessions;
- monitoring sensitive actions; and
- requiring additional controls for high-risk transactions.
Zero trust should not be treated as a product or a single technology. It is better understood as an architecture and control philosophy that can reduce reliance on implicit trust.
AI-Enabled Cyber Risk
Artificial intelligence is becoming relevant to custody cybersecurity in two directions: attackers can use AI-enabled tools to accelerate or improve attacks, while defenders can use automated systems for detection, analysis, and response.
This creates additional questions for custodians:
- How are AI-enabled threats incorporated into security testing?
- Can monitoring systems identify unusual behavior that conventional rules may miss?
- Are automated security tools themselves subject to access controls and validation?
- Can AI-assisted processes modify security configurations or transaction workflows?
- Are sensitive data and credentials protected when AI tools are used?
- Are human approval points retained for high-impact actions?
In June 2026, Hong Kong’s SFC issued guidance addressing cybersecurity risks associated with AI-enabled attacks. The regulator noted an increase in cybersecurity incidents in Hong Kong, with incidents reported by the Hong Kong Computer Emergency Response Team Coordination Centre rising from 12,536 in 2024 to 15,877 in 2025.
The SFC encouraged licensed firms and virtual asset service providers to strengthen resilience, response strategies, asset inventories, vulnerability management, privileged-account protection, network segmentation, and monitoring.
The European Supervisory Authorities likewise called for a risk-based approach to ICT risks arising from frontier AI models, emphasizing prevention, detection, and management of those risks.
The practical benchmark is not whether a custodian uses AI. It is whether the organization understands where AI can change its threat exposure and has controls around both AI-assisted attacks and AI-enabled security processes.
What Institutions Can Look for in Custodian Cybersecurity Disclosures
Public disclosures rarely provide enough information to independently validate every security control. Institutions can nevertheless look for evidence that a custodian has a structured approach to cybersecurity and operational resilience.
Governance
Look for clear responsibility for cybersecurity, custody operations, privileged access, incident response, and third-party risk.
Access Management
Review the authentication methods, privileged-access controls, role separation, access reviews, device controls, and procedures for compromised accounts.
Key Management
Look for information about storage architecture, signing controls, approval requirements, recovery mechanisms, and protection of sensitive cryptographic material.
Transaction Security
Assess whether high-risk transactions are subject to policy controls, independent approvals, limits, monitoring, and anomaly detection.
Incident Response
Look for evidence of tested response procedures, escalation processes, client communication mechanisms, and post-incident improvement.
Resilience
Assess whether critical systems have recovery arrangements and whether those arrangements have been tested under realistic failure scenarios.
Third-Party Risk
Understand which critical functions depend on external providers and how those dependencies are monitored, contracted, tested, and recovered.
Regulatory Alignment
Determine which regulatory requirements apply to the custodian’s jurisdiction and service model. Requirements differ across markets, so a control requirement in one jurisdiction should not automatically be presented as a universal global standard.
The quality of public disclosure also matters. Institutions can distinguish between a custodian describing a control and providing meaningful evidence about how that control is governed, tested, monitored, and reviewed.
Kenson Perspective on Custodian Cyber Risk Benchmark
Custodian cyber risk is not defined by a single security technology, incident count, or certification. The more meaningful benchmark is how access controls, key management, transaction policies, monitoring, recovery, governance, and third-party dependencies operate together when conditions change or a control fails.
Authentication methods will evolve. Threat actors will adopt new techniques. Regulatory expectations will develop, and custody infrastructure will increasingly incorporate cloud services and AI-enabled systems. A useful assessment therefore considers both the frequency of security events and the potential consequences of a successful compromise.
For institutions evaluating custody infrastructure, the focus can remain on a few durable questions:
- Who can access critical systems?
- Who can authorize transactions?
- What prevents one compromised credential from becoming a high-impact event?
- How quickly can abnormal activity be detected? And can secure custody operations be restored after a disruption?
The strongest cybersecurity framework is one that can adapt as the technology, dependencies, and threat environment change.
Explore Kenson’s Digital Infrastructure Research
Explore the Kenson Investments Knowledge Center for research on digital asset custody, transaction controls, wallet architecture, third-party dependencies, and operational risk. Register now to access more educational market-analysis resources and research.
Disclaimer: The information provided on this page is for educational and informational purposes only and should not be construed as financial advice. Crypto currency assets involve inherent risks, and past performance is not indicative of future results. Always conduct thorough research and consult with a qualified financial advisor before making investment decisions.
“The cryptocurrency and digital asset space is an emerging asset class that has not yet been regulated by the SEC and the US Federal Government. None of the information provided by Kenson LLC should be considered as financial investment advice. Please consult your Registered Financial Advisor for guidance. Kenson LLC does not offer any products regulated by the SEC, including equities, registered securities, ETFs, stocks, bonds, or equivalents.”
