Gate has launched Gate Security Academy, an educational series examining the security risks crypto users face. The first edition, produced together with security firm CertiK, focuses on how institutions protect large digital asset holdings.
In crypto, protecting your own assets may be as simple as keeping your recovery phrase secure. But when an institution is responsible for tens of billions of dollars in assets, the challenge becomes far more complex.
Where should those assets be stored? Who needs to approve a transaction? Who has the authority to move funds through a multisignature wallet? And if an attacker exploits a weakness somewhere in the process, can the institution detect the threat and stop the loss before it happens?
These are the questions at the heart of institutional digital asset security.
In this edition of Gate Security Academy, we are joined by CertiK and Gate’s security team to shift the conversation from personal wallets to institutional asset management. From the perspectives of an independent security auditor and a crypto trading platform, we explore how institutions can keep their operations running smoothly while keeping asset risk at a manageable level.
About the Guests
CertiK: CertiK is a Web3 security company trusted by regulators, financial institutions, and Web3 innovators worldwide. Since its founding in 2017, CertiK has served clients across more than 150 countries and regions, identified over 119,000 vulnerabilities in code, and helped safeguard more than $600 billion in digital assets.
Gate Security Team: Gate’s security team is responsible for developing and maintaining the platform’s account, trading, and asset security systems. The team also provides ongoing support to institutional clients in areas such as access control, API integration, and asset custody.
Founded in 2013, Gate was one of the first major exchanges to commit to 100% proof of reserves and currently serves more than 62 million users worldwide.
Q1. What is the biggest difference between managing a personal wallet and an institutional wallet? Where do institutional security failures typically occur, and how do the risks differ from those faced by individual users?
CertiK:
The fundamental difference lies in how control over assets is organized.
For individual users, wallet security largely comes down to protecting private keys, recognizing threats, and verifying transactions. Institutions, however, must coordinate multiple roles, systems, and external service providers under clearly defined authorization rules. They also bear responsibility for asset custody, business continuity, and compliance.
Scale amplifies the impact of any failure, and dependencies across teams and systems multiply the ways things can go wrong.
Common risks for individual users include compromised recovery phrases, phishing attacks, and malicious transaction approvals. Institutions face these same threats, but must also guard against excessive concentration of privileges, mismatches between what is approved and what is actually executed, compromised devices or third-party software, insider collusion, and operational errors.
When investigating an institutional security incident, it is not enough to conclude that a private key was compromised. Investigators must also determine how the attacker gained access to the key, or how the attacker managed to trick a system into signing a malicious transaction without obtaining the key itself.
A major incident in 2025 illustrates this risk. Attackers tampered with the Safe wallet frontend, causing signers to see what appeared to be a legitimate transfer while actually signing a malicious transaction that replaced the wallet’s implementation contract. Multiple authorized signers approved the transaction, yet the assets were still stolen.
What matters is not just how many people signed. Institutions must also verify that what signers see, what they approve, and what they ultimately sign are exactly the same transaction.
Evaluating institutional security therefore requires examining the entire chain of control: who initiates a transaction, who verifies its contents, who can sign, and who can change the rules — and whether each of these controls genuinely checks the others.
Gate Security Team:
Personal wallet security is relatively straightforward. Most protective measures revolve around one central principle: keeping your recovery phrase and private keys out of the wrong hands.
Institutional security is much more complicated. It involves multisignature arrangements, multiple levels of access, and frequent transactions. Institutions need to make sure employees in different roles can use funds for legitimate business purposes, while preventing any one person from moving assets without authorization.
The two are simply not comparable in difficulty.
In publicly reported incidents, cases where the cryptography itself was broken are extremely rare. Most failures happen elsewhere in the process. Broadly speaking, they fall into three categories.
The first involves compromised tools. If an attacker tampers with open-source software, a cloud service, or a development tool used by an organization, its wallets can be exposed as well.
The second involves people. This includes impersonation to obtain access, employees abusing their privileges, and former employees retaining permissions that should have been revoked.
Attackers do not always need to break into a system directly. Often, it is easier to get close to someone who already has access.
The same principle applies to institutions. Attackers may study job postings to learn about a company’s technology stack, identify relevant employees through code-hosting platforms, or establish relationships with staff at industry events. This preparation can continue for months before an attack takes place.
The third involves weaknesses in operational procedures. Examples include bypassing normal approval requirements during an emergency, failing to revoke temporary access, using real business data in test environments, or exposing internal tools to the public internet for convenience.
None of these is especially sophisticated. But at an institution holding significant assets, any one of them can lead to serious losses.
Q2. Institutions commonly use multisignature wallets, MPC custody, and internal approval procedures to protect assets. What problems does each approach solve, and what risks should institutions watch out for?
CertiK:
These three mechanisms address different aspects of security.
Multisignature wallets require authorization from multiple keys, reducing the risk associated with a single compromised key. Multiparty computation (MPC) distributes signing capabilities across separate key shares, reducing the risks of storing or using a complete private key in one place. Internal approval procedures determine whether a transaction should be carried out from a business perspective.
What institutions need to verify is whether these three layers actually check one another in practice.
For example, if multiple keys are controlled by the same team or the same set of administrator privileges, the signing threshold may appear distributed while the underlying risk remains concentrated.
Similarly, even if MPC key shares are stored separately, institutions must examine whether device registration, identity verification, and recovery privileges can all be controlled by one person.
The same applies to approval procedures. If employees approve what appears on a screen, but the signing system receives a different transaction, the approval process cannot effectively prevent unauthorized asset transfers.
In its technical analysis of the Gnosis Pay incident, CertiK found that a flaw in an authorization validation module allowed unauthorized transactions to pass validation.
This demonstrates why security assessments must go beyond private keys and signing algorithms. They must also cover identity verification, transaction validation, permission changes, and recovery procedures.
Gate Security Team:
These are exactly the issues we design around at Gate.
For Gate’s own asset management, the vast majority of assets are held in multisignature cold wallets, kept offline and air-gapped.
Our hot wallets combine multisignature protection with MPC, distributing private key management across multiple components. Hot wallets are also subject to balance caps: any amount above the cap is immediately swept to cold storage.
For our users, we offer different security solutions depending on their needs.
For institutional clients, we offer Gate Vault, which combines MPC with a 2-of-3 signing scheme.
Put simply, the signing key is divided into three shares, held separately by the user’s device, Gate, and an independent third party. Any transaction requires two of the three shares, so no single party can move the assets alone.
Every outgoing transfer from Gate Vault is also held for 48 hours, during which the user can freeze it. In institutional settings, operational mistakes and signatures made under duress do happen. The delay creates a window in which suspicious or unintended transfers can be identified and stopped before the assets leave.
Q3. How should institutions build a comprehensive security management framework? Which areas are most commonly overlooked?
CertiK:
Institutions should establish a continuous chain of controls around every transaction.
At the initiation stage, they need to verify the business purpose, counterparty, destination address, and transaction limits.
During approval, the relevant personnel must understand what the transaction actually does, and the approved details must match the final transaction submitted for signing.
At the signing and custody stages, institutions must protect keys, devices, and operational permissions.
After execution, they should monitor for unusual transactions and reconcile on-chain records with internal accounting records.
Every step needs a clearly designated owner, along with records that can be cross-checked against one another.
Some of the most overlooked risks involve actions that do not directly transfer assets but can change who controls them.
These include modifying withdrawal address whitelists, increasing transaction limits, replacing authorized signers, or updating wallet software.
Recovery procedures also require dedicated planning and regular testing.
If a key employee leaves, a device fails, or a service provider becomes unavailable, the institution must be able to regain control of its assets while preserving appropriate multi-person authorization requirements.
A recovery path must never become a backdoor around everyday access controls.
Gate Security Team:
On Gate, institutions typically manage funds through a combination of main accounts and subaccounts, with different permissions assigned to employees according to their responsibilities.
For example, some employees may only be allowed to view account information, others may be authorized to trade, while designated personnel handle approvals.
This structure supports day-to-day operations while reducing unnecessary risks to funds.
For asset managers, we also provide dedicated managed subaccounts.
These are designed to address a common concern: an investor may want a professional team to manage their assets without giving that team the ability to withdraw the funds.
Under this arrangement, once an investor creates a managed subaccount, they cannot create API keys themselves for automated operations. The trading team can execute agreed trading strategies but does not have withdrawal permissions.
For the duration of the mandate, the investor also cannot view the trading team’s positions, open orders, or trading history, so the team’s strategy stays confidential.
API permissions matter just as much.
Most institutional trading is programmatic, with manual orders a small fraction, so our API keys support granular permissions: read, trade, and withdraw can each be enabled separately.
Q4. When regulators assess a platform or project, which security and compliance issues matter most?
CertiK:
Regulators first need to determine whether a platform can maintain control over assets, keep critical services running, and clearly demonstrate how risks are detected and handled when incidents occur.
For trading platforms, this includes client asset custody, account reconciliation, access management, anti-money laundering controls, and incident response.
For central bank digital currency (CBDC) systems, the integrity of issuance and ledger records, continuity of payments, and accurate recovery after failures are especially important.
Although these systems serve different purposes, both require evidence that can be tested and independently verified.
These are also among the practical issues involved in CertiK’s recent collaboration with the National Bank of the Kyrgyz Republic.
Under a signed memorandum of understanding, the two parties intend to explore areas including security assessments of the digital som, formal verification, cybersecurity and operational resilience, as well as digital asset regulation, anti-money laundering, and custody.
In practical assessments, regulators need concrete evidence.
Who controls critical permissions? Have high-risk vulnerabilities been remediated? How are suspicious transactions handled? After a simulated system failure, can services and accounting records be accurately restored?
The answers show whether the controls actually work.
Gate Security Team:
We see these issues firsthand when applying for and maintaining licenses across jurisdictions.
When people discuss platform security, they often focus on how advanced the technology is.
But from a regulatory perspective, another question is just as important: are customer assets segregated from the platform’s own funds? And if something goes wrong, can the platform clearly identify which assets belong to whom?
This is where proof of reserves comes in.
For everyday users, it helps them verify whether a platform holds sufficient assets to cover customer balances. For regulators, it can also provide useful evidence when assessing how a platform manages its assets.
Gate combines Merkle trees with zero-knowledge proofs, allowing users to verify that their assets are included in the reserve calculation while protecting their personal information.
According to the latest published figures, Gate holds total reserves of $8.688 billion, with an overall reserve ratio of 118.49%.
Its Bitcoin reserves stand at 25,727 BTC, with a reserve ratio of 121.60%, while Ethereum reserves total 449,042 ETH, with a reserve ratio of 123.78%.
In simple terms, a reserve ratio above 100% means that the platform’s disclosed reserves for the relevant assets exceed the corresponding customer balances.
Q5. How can institutions assess whether a trading platform is secure? What information can they independently check and verify?
CertiK:
When evaluating a platform, institutions should first determine whether the available security evidence actually covers the services, systems, and software versions they intend to use.
Which components were included in the audit? Have identified vulnerabilities been fixed? Who can transfer assets or modify critical permissions?
If custody services are involved, institutions should also understand how key control, asset reconciliation, backup and recovery, and third-party dependencies are managed.
At CertiK, we use Skynet to organize complex on-chain and off-chain signals into more accessible, continuously updated security scores.
For Web3 projects, these scores cover six dimensions: code security, fundamental health, operational resilience, community trust, market stability, and governance strength.
This helps institutions quickly identify areas that warrant further investigation.
Institutions can also use Skynet to review publicly available CertiK audit reports, examine specific findings and their remediation status, and verify whether an audit’s scope matches the version currently deployed.
Exchanges and wallets are assessed against their own criteria.
For internal access controls and custody arrangements that cannot be evaluated through publicly available information, institutions should still request supporting documentation from the platform and verify the relevant controls through due diligence or controlled testing.
Gate Security Team:
Institutions can start with three areas.
The first is proof of reserves.
Gate, for example, has open-sourced its reserve verification tool on GitHub. With their own verification data, users can check locally whether their account balances have been correctly included in the reserve calculation.
The second is the bug bounty program.
In other words: is the platform willing to pay outside researchers to find its weaknesses?
Institutions should look at whether the program is long-running, whether the rewards are reasonable, and whether the platform responds promptly to reported issues.
Gate has run a long-standing bug bounty program and welcomes security researchers from around the world to report vulnerabilities.
The third is licensing.
Institutions should verify which countries and regions have granted the platform relevant licenses, which legal entities hold those licenses, and whether the licenses remain valid.
A license doesn’t make a platform risk-free, but it does mean the platform is required to meet the applicable regulatory standards in that jurisdiction.
Q6. For an institution that is just beginning to allocate funds to digital assets, what should its first security priorities be?
CertiK:
The first step is to define the purpose of the allocation and establish clear risk limits.
Institutions should determine which assets they intend to hold, which platforms, blockchains, and counterparties they will use, and what limits should apply to individual transactions and overall exposure.
They should then clearly assign responsibility for transaction initiation, approval, signing, reconciliation, and incident response.
When deciding between self-custody, third-party custody, or a combination of the two, they also need to establish which permissions each party will control.
Before making the first transfer, institutions should verify the recipient and destination address.
In its research on institutional digital asset counterparties, CertiK has emphasized that an on-chain address alone does not establish who is behind it or who controls it.
Address ownership, historical risk indicators, and counterparty information must be examined together.
Once platform due diligence is complete, institutions can start with a small pilot to run trading, withdrawals, and reconciliation end to end.
They should also rehearse how to respond to device failures or service disruptions.
Exposure should then be scaled up based on the results.
Gate Security Team:
For institutions that are just beginning to allocate funds to digital assets, we have four recommendations.
First, separate funds by purpose.
Funds needed for daily trading, medium-term reserves, and long-term holdings should be managed separately, with different limits on how they can be used.
Ideally, this structure should be planned before opening an account. Once operations are already underway, changing how funds are managed can become much more difficult.
For long-term holdings that won’t be touched, institutions can also consider custody solutions with a 48-hour withdrawal delay.
That additional waiting period provides time to review and respond to potentially suspicious activity.
Second, separate duties.
Initiating a transfer, approving it, and executing it should ideally not all be handled by the same person.
Using subaccounts and employee permission settings, institutions can establish this basic separation of duties without building anything in-house.
Third, strictly control API keys used for automated operations.
Withdrawal permissions should be disabled by default.
Every API key should have a clearly defined purpose and a designated owner, and institutions should establish in advance when that key must be revoked or deleted.
Fourth, conduct thorough due diligence before choosing a platform.
As we discussed earlier, institutions should check whether the platform’s proof of reserves can be independently verified, who is responsible for custody of the funds, whether a bug bounty program is in place, and whether the relevant licenses remain valid.
These are all questions that should be answered before assets are committed.
Whether it’s a personal wallet or an institutional treasury, more money and more people mean more complex risk.
But regardless of the setting, the fundamental goal of security remains the same: identify risks early and, wherever possible, prevent them from turning into actual losses.
That is also the message we hope to convey through Gate Security Academy.
Security should not become a priority only after something goes wrong. It should be a habit in every operation and every decision.
Our thanks to CertiK and the Gate Security Team for sharing their insights.
About Gate
Gate, founded in 2013 by Dr. Han, is one of the world’s leading cryptocurrency and integrated financial services platforms, spanning financial and everyday use cases including asset management, trading and payments. Serving over 62 million users globally, it supports trading across 5,400+ digital assets and 12,800+ stock assets and ETFs, while providing access to a comprehensive range of TradFi assets, including metals, stocks, indices, forex, and commodities to meet users’ end-to-end needs across asset holding, trading, and spending. As an industry benchmark, Gate was among the first platforms to implement 100% Proof of Reserves. Its ecosystem includes Gate Money, Gate Wallet, Gate Ventures, Gate for AI Agent, and a wide range of products and services.
For more information, please visit: Website | X | Telegram | LinkedIn| Instagram | YouTube
Disclaimer:
This content does not constitute an offer, solicitation, or recommendation. You should always seek independent professional advice before making investment decisions. Note that Gate may restrict or prohibit certain services in specific jurisdictions. For more information, please read the User Agreement.
The post Gate & CertiK: How Do Institutions Secure Tens of Billions of Dollars in Digital Assets? appeared first on BeInCrypto.
