Protecting the key is only part of the problem
A short guide to assessing enterprise custody: how far one breach can reach, when a co-signer actually protects you, and five questions to put to your custodian.
Why we wrote this guide
On 29 October 2026, Binance reported unauthorised withdrawals of approximately USD 6.3 billion from its hot wallets, and said it had found no evidence that wallet private keys had leaked. In February 2025, a compromised developer environment at Safe was used to manipulate the transaction interface at Bybit, so that authorised signers approved a malicious transfer. The mechanisms differ, but both incidents point to the same place: the systems that prepare, display and approve transactions.
Encryption, hardware security modules and multi-party computation protect key material. Whether funds stay where they are also depends on how transaction policies and approvals are enforced, and on whether a single compromised system can authorise a transfer on its own. This guide sets out how to assess that, whichever custody model you use.
For enterprises, the question is no longer only who holds the keys. It is who controls the systems that authorise transfers. Institutions should be able to control those systems and verify the safeguards protecting their assets.
Written by Yury Derbasov, CTO, and Mikhail Boldov, Custody Product Owner, The Vault. For the full analysis of the October incident, read What the Binance incident means for enterprise custody.
Incident details reflect public updates reviewed on 2 November 2026; technical findings remain preliminary. For information only. Not investment advice.