Digital asset security when markets and attackers move at once

If you run operations or security at a firm that holds digital assets, this probably was not a restful week. Bitcoin slid below $70,000. The Justice Department published a long account of North Korean theft. A brokerage in Japan told its members that their data may have been exposed. And in between, some of the tools many of us rely on went quiet while their teams worked to bring them back.

It is easy to read each of those as its own story. We have been reading them as one.

It starts with speed

Markets set the tempo before anyone else does. When Bitcoin dropped below $70,000 on November 13, its first time under that level since August, CoinDesk counted more than $1.6 billion in liquidations along the way. If you have ever worked a desk on a day like that, you know how it feels. Transfers stack up, approvals come faster, and everyone is doing three things at once.

That is the first thing worth noticing. A rushed day is when "looks fine" gets approved. A control that relies on someone spotting something strange is asking a lot of a person in the middle of it.

Then the video call comes in

Here is how the Justice Department describes a scheme it calls FaceStealer. An invitation to a video meeting arrives from an account that looks familiar, because it was stolen from someone the target knows. Once the target joins, the attackers play recorded video of a person they trust, and sometimes a deepfake of a well-known figure in the industry. A fake technical error appears, along with a helpful fix that installs malware. The Justice Department links the scheme to more than $400 million in cryptocurrency theft over 18 months, and the FBI says it can fool even careful, experienced people.

We take that at face value. Which is why we think the more useful question is not how to make everyone immune. It is what that one compromised laptop is allowed to do. If the answer is move funds on its own, the design is asking people to be perfect.

Then the money moves

The same announcement describes the larger picture. On or about October 29, the Justice Department says, a North Korean military group it calls TraderTraitor stole more than $6 billion in virtual assets from Binance. Since then, government and private sector teams have frozen more than $2.7 billion, and courts have authorized seizure or restraint of more than $1.2 billion. The release describes the response, not how the funds were taken, so there is a lot we still do not know.

What stands out to us is the afterward. Recovery is a race, and the people in it are working from whatever records exist, meaning who approved what, when, and under which rules. Good records do not stop an incident, but they decide how quickly the story can be put back together.

And all the while, the doors you did not build

Some of the quietest stories this week were about other people's systems. SMBC Nikko Securities told members that a third party had gained access to the system it uses to administer employee share plans, confirmed on November 9, with up to 56,487 people potentially affected. Chainalysis brought its Reactor, KYT, and Address Screening products back online on November 7 and Data Solutions on November 10 after a security incident, and asked customers to reconnect in a specific way. In Malaysia, Bank Rakyat said a disruption of its corporate website involved a third-party provider and that customer data and savings were safe, while its statements did not confirm an attack.

Each has its own facts, and they are still developing. But if you have ever had to answer the question of which vendors can touch your money, you know the feeling those headlines produce. It is the realization that part of your security sits in someone else's hands.

What we would do with a week like this

Pull back, and the week reads less like four stories and more like one. A fast market, a convincing stranger, a very large theft, a vendor in trouble. In each, the question that matters is what one ordinary thing is allowed to do on its own, whether that is a rushed approval, a single laptop, a shared credential, or a connection nobody reviewed.

That is good news in a way, because it is a design question, and design questions can be answered on a quiet Tuesday. Keep keys out of reach of the software that uses them. Have a named person confirm the exact request. Keep a record nobody can quietly edit. Keep the list of connections that can touch money short.

It is the way of thinking we built AlphaPoint Cloud around, with hardware-isolated keys, configurable policies, named approvers, and signed records, so that reaching one application is not enough to move money. If you would like to see how we approach it, our page on security-critical operations is a good place to start.

Frequently asked questions

What does digital asset security cover?

It covers more than wallets. In practice it spans how private keys are generated, stored, and used, who is allowed to approve a transfer and how, which vendors and integrations can reach your systems, and what records you keep for investigation and audit. Weakness in any one of those areas can undo strength in the others.

Does market volatility change how teams should think about security?

It does not change the threats, but it shortens the time teams have to respond. Controls that run automatically, such as withdrawal limits, approval workflows, and policy checks, behave the same in calm and volatile conditions, which is why many teams set them before they are needed.

How do you protect private keys from a compromised device or application?

Keep the keys where software on a compromised machine cannot read them, such as in hardware-isolated environments, and put an approval step in front of every signing request. Then a stolen laptop or a hijacked application can ask for a transfer, but cannot complete one on its own.

What should a transaction approval workflow include?

Named approvers, policy limits set in advance, and a view of the exact request being approved, including the recipient, asset, and amount. It should also make sure that no single person, credential, or system can satisfy an approval alone.

How does social engineering lead to crypto theft?

Attackers build trust first, often with stolen accounts, recorded video, or deepfakes, and then trick someone into installing malware or approving something they should not. The FBI describes the FaceStealer scheme this way. Designing controls so that one compromised person cannot move funds limits the damage when the trick works.

What is third-party risk in digital asset operations?

It is the exposure that comes from vendors, integrations, and service providers that connect to your systems or hold your data, such as compliance tools, administration platforms, and hosted websites. Reducing it starts with mapping which connections can touch money, rotating API keys and credentials, and being ready to restore service and reconnect safely after a vendor incident.

Why do audit trails and signed records matter after an incident?

They let your team and investigators see who approved what, when, and under which policy, without rebuilding events from scattered logs. Tamper-evident records speed up tracing and recovery, and they give auditors and regulators something concrete to verify.