Strong corporate Bitcoin custody can still be undone by a weak finance process. Attackers rarely try to break the mathematics that secures Bitcoin; they target the people who approve transfers, the devices they use and the instructions they trust. The defence is a small set of disciplined habits, backed by controls that make a single mistake insufficient to lose funds.
This article focuses on the finance team's side of security. For signing rules and key storage, see key management and signing policies.
Why Bitcoin changes the security picture for corporate Bitcoin custody
Finance teams already defend against payment fraud. Bitcoin raises the stakes in three ways:
- Finality. There is no recall, chargeback or bank to call. A transfer that leaves is gone.
- Speed. Transfers can complete at any hour, including weekends, when fewer people are watching.
- Opaque destinations. An address is a long string of characters. People do not read it carefully, and attackers rely on that.
The result is that controls must work before a transfer, not after it.
The attacks finance teams actually face
Impersonation and business email compromise
An attacker poses as a director, supplier, provider or colleague and asks for an urgent transfer or a change of address. The message may come from a look-alike domain, a compromised mailbox, or a messaging app. Voice and video impersonation using synthetic media is a growing variant.
Address substitution
Malware on a computer swaps a copied address for one controlled by the attacker. The pasted address looks similar at a glance. A variant sends tiny transfers from look-alike addresses so that one appears in the transaction history, hoping someone copies it later.
Account takeover
Attackers take control of an email, provider portal or phone number, often through phishing or by persuading a mobile carrier to move a number to a new SIM. They then reset passwords or intercept one-time codes.
Insider and collusion risk
A single employee with too much access, or two who coordinate, can bypass controls designed for honest mistakes.
Social engineering of providers
Attackers contact a custodian's or liquidity provider's support team pretending to be the company, asking to change contacts, whitelists or settlement details.
Controls that work
Verify through a second channel
Every new address, change of address, or unusual instruction is confirmed through a separate, pre-agreed channel: a call to a number already on file, not one given in the message. The person verifying should read the full address, not just the first and last few characters.
Agree with each provider, in writing, that no change to contacts, whitelists or settlement details will be accepted by email alone. Then test it once by asking them how they would handle such a request.
Use whitelists and delays
Restrict outgoing transfers to pre-approved addresses. Add a waiting period before a newly whitelisted address can be used, so a fraudulent addition can be spotted and reversed before funds move.
Make test transfers routine
Send a small amount first, confirm receipt with the recipient through an independent channel, then send the balance. This catches substitution and typing errors at the cost of a minor network fee.
Separate devices and accounts
- Use dedicated devices for custody and provider portals, not the laptop used for email and browsing.
- Keep those devices updated, encrypted and locked down.
- Use separate, role-based accounts on provider platforms, never shared logins.
Use phishing-resistant authentication
Prefer hardware security keys or platform passkeys over text-message codes. Remove phone-number recovery from critical accounts where the provider allows. Ask your mobile carrier about port-out protection for phones used by signers.
Limit what is public
Do not publish signer names, wallet addresses or custody details beyond what disclosure requires. Remind signers to be careful about what they share on professional networks.
Mapping attacks to controls
| Attack | Primary control | Backup control |
|---|---|---|
| Impersonation of an executive | Call-back to known number | Multi-person approval |
| Address substitution | Out-of-band address verification | Test transfer |
| Account takeover | Hardware keys or passkeys | Alerts on login and setting changes |
| Insider misuse | Segregation of duties | Access reviews, transfer delays |
| Provider support scam | Written change-control agreement | Notifications on any account change |
Record these in the Bitcoin risk register with an owner for each.
People and training
Controls fail when people are rushed or unsure. Practical steps:
- Brief training for everyone involved, focused on real examples of impersonation and address substitution.
- Permission to slow down. State in policy that no Bitcoin transfer is ever so urgent that verification can be skipped, whoever asks.
- Simulated tests. Run occasional internal exercises, such as a mock urgent request, and review how the team responded.
- Joiners and leavers. Remove access the same day someone changes role or leaves, and update signer lists with providers.
Incident response
Decide in advance what happens if something goes wrong. A short plan should cover:
- Contain. Freeze outgoing transfers with your custodian and revoke access for affected accounts.
- Assess. Establish what was accessed or sent, and when.
- Notify. Inform the CFO, legal counsel, the custodian, insurers and, where appropriate, law enforcement. Blockchain analytics firms and providers can sometimes help trace funds.
- Record. Preserve logs, messages and device images.
- Review. After the event, update controls and report to the board.
Keep the plan's contact list current and accessible offline. Rehearse it alongside your succession and continuity plan, since the same people and steps are often involved.
How The Bitcoin World helps
We review finance-team processes around corporate Bitcoin custody, including verification steps, whitelisting, provider change controls and incident plans, as part of our custody architecture work. Execution and custody are carried out by licensed third-party institutions.