Web3 Security Advisory
Strategy, wallet security and insurance advisory for banks, exchanges and custodians, from first architecture to licence and cover.
Wallet security maturity
Current level and target, by domain
410
+120
+150
+25
+On-site security sessions for licensed trading platforms.
Co-hosted an industry forum on security and insurance gaps for 100+ licensed and applicant VASPs.
Invited to brief on our Bybit hack analysis, published within 24 hours of the incident.
Every engagement starts with a specific problem. Client names are withheld.
01Institution new to Web3
We want to get into Web3, maybe stablecoins or a retail exchange, but we haven’t settled on the end goal.”
Result
A clear roadmap, a build-ready infrastructure design and management documentation
02Local top-tier bank building custody from zero
We want to build cold-only, institutional-grade custody for business clients.”
Result
An institutional-grade custody operation with top-tier security, built from scratch
03Exchange and custodian seeking a licence
We need an operating licence, but the regulator says our processes aren’t robust enough.”
Result
A risk and policy framework the regulator accepted, and a licence to operate
04Exchange and custodian under regulatory review
Our regulator wants a more complete wallet security review.”
Result
A full review report with mitigation steps, ready for the regulator
One team covers strategy, security, testing and insurance.
Business Strategy
We help you choose a business model, select the underlying technology and set a long-term build plan that meets regulatory standards, so you can launch securely and scale.
Licence requirements vary by jurisdiction and business scope.
Security & Risk Management
We design secure business systems and the governance around them, benchmarked against industry security standards and real licensing cases, with risk scenario analysis and practical improvements.
Insurance Advisory
We assess your current security level, plan your risk transfer and connect you with international underwriting capacity, working toward lower-rate cover that builds investor trust and financial resilience.
Related insurance
Security Testing & Wallet Audit
We identify risk scenarios through penetration testing, smart contract audits and a review of how you manage wallet security, then give you prioritised fixes aligned with international standards.
Need penetration testing, vulnerability scanning or a smart contract audit on its own? See Security Risk Assessment & Consulting.
Pilots & POCs
We help you explore digital asset use cases, weigh business feasibility against security, write the pilot plan and take part in stakeholder discussions until the pilot meets its goals.
“We want to get into Web3, maybe stablecoins or a retail exchange, but we haven’t settled on the end goal.”See how that engagement ran
Wallet security maturity assessment
Most audits ask whether you meet a standard. We ask whether you can actually run a digital asset business safely. Nine domains are broken into controls we can verify, then rated from L1 to L5.
Keys are the final control over digital assets. We check that every key and key share is generated, stored, used, backed up, re-issued and destroyed in a controlled, auditable and recoverable way, because one uncontrolled step means an irreversible loss.
Our recommendation: Remove signers on departure, re-share keys whenever the signer set changes and recertify the quorum quarterly.
A level shows where you are, how far you are from target and how to close the gap year by year: what boards and regulators want to see, and a guide to where to spend.
Talk to an AdvisorWe bring digital asset services live one business line at a time. Each cycle ends with a security test before the next one begins.
Insurance doesn’t replace security controls. It sits on top of them. Underwriters price the maturity of your whole control environment, so the work we do together shows up in your terms.
Related insurance
3.00annual premium per 100 of cover
Illustration only, using example rates. Premium = (limit × cold rate × cold share) + (limit × hot rate × hot share). Actual rates, limits, coverage and exclusions depend on policy terms and underwriting.
Every domain maps to international standards and regulatory expectations, and is compared with practice at leading custodians, global exchanges and tier-1 banks. We also adjust scope to the rules you must meet.
Banks and financial institutions adding digital asset services, and exchanges, custodians and wallet technology providers that need to strengthen their security, satisfy a regulator or qualify for insurance.
A compliance audit asks whether you meet a standard. We ask whether you can actually operate a digital asset business safely. Each capability gets a level from L1 to L5, backed by documents, interviews, configuration checks and site visits, so you can see the gap and a path to close it.
Underwriters assess the maturity of your control environment, and your hot and cold wallet allocation sets the base rate. Mature controls generally support better terms, but rates, limits and coverage are always subject to underwriting.
Yes. We can review your current provider, or run a full selection that scores each candidate independently on security, functionality and compliance, and ends with a formal recommendation.
Tell an advisor where you are, and we’ll scope the work with you.