Sources checked 10 November 2026. This page explains how the online accounts around a company's bitcoin can be attacked and the controls that national security agencies recommend. It is not security or legal advice and not a recommendation to buy, sell or hold bitcoin. If anything here conflicts with a linked source, the source wins.
Short answer
A 2 of 3 multisig protects the coins on the blockchain, but the accounts around it control how money and addresses reach the wallet: company email, exchange and broker logins, the phone numbers used for codes, the domain that carries the email, the password manager and the accounting software. Most thefts start with one of these. Protect the important ones with hardware security keys or another phishing-resistant method, take text message codes out of recovery where you can, lock the domain at the registrar, and require two people for any change to withdrawal addresses.
Map the accounts first
| Account | What an attacker could do with it | Controls to look at |
|---|---|---|
| Company email, especially admin accounts | Reset other passwords, read approvals, send a fake invoice or a swapped address from a real mailbox. | Security keys for admins and keyholders, a separate admin account, alerts on new forwarding rules and sign-ins. |
| Exchange or broker login | Withdraw bitcoin or cash, or add a new withdrawal address. | Security keys, a withdrawal allow list with a delay on new addresses, two-person approval if offered, no text message recovery. |
| Mobile numbers of directors and keyholders | Take over the number with a SIM swap and receive reset codes. | Remove the number as a recovery route where possible, and ask the carrier about account PINs and port-out protection. |
| Domain name and DNS | Redirect company email or the website, or set up convincing phishing pages. | Registrar lock, a security key on the registrar account, automatic renewal, a named owner. |
| Password manager | Open every other account. | A long unique master password, a security key, and emergency access set out in the continuity plan. |
| Accounting and banking software | Change payee details or hide a transaction. | Security keys or app codes, approvals for payee changes, monthly reconciliation to the wallet. |
Our judgement, not a rule: write this map down as part of the key register, with the owner of each account and how it is recovered. See continuity.
Choose your country for the official guidance.
UK: what the NCSC recommends
The National Cyber Security Centre recommends setting up 2-step verification on important accounts, so that a stolen password alone is not enough. It notes that some services let you use security keys, which are small devices you can buy. Its guidance for organisations covers multi-factor authentication for corporate online services, and its small organisations guide covers the basics of protecting a business.
Source: NCSC: Setting up 2-Step Verification (2SV), including security keys, NCSC: Multi-factor authentication for your corporate online services, NCSC: Small organisations guide to cyber security.
The NCSC says a password manager stores passwords safely, so each service can have a unique password. Its phishing guidance for organisations describes layered defences, because no single control stops every phishing email. For domains, it says registrars may offer a lock so that a domain cannot be changed until the lock is removed, and suggests knowing the registrar's procedure for reclaiming a hijacked domain and keeping the registration documents.
Source: NCSC: Top tips for staying secure online: managing your passwords (password managers), NCSC: Phishing attacks: defending your organisation, NCSC: Managing public domain names, including registrar locks.
If an account is taken over or money is lost, report it to Report Fraud, run by the City of London Police. See if company bitcoin is lost or stolen.
US: CISA, the FCC and IC3
CISA calls phishing-resistant multi-factor authentication the gold standard and says FIDO or WebAuthn authentication is the only widely available phishing-resistant method, using either a separate physical token or an authenticator built into a device. It lists SIM swaps and weaknesses in the phone network among the ways attackers obtain codes sent by text message or voice, and says app-based codes or push with number matching are the best options for small and medium businesses that cannot yet move to phishing-resistant methods.
Source: CISA: Implementing phishing-resistant MFA (fact sheet, October 2022, PDF).
The FCC added rules at 47 CFR 64.2010(h) requiring mobile carriers to use secure methods to authenticate a customer before a SIM change, and to train staff on SIM swap fraud. The eCFR text notes that compliance with that paragraph is not required until a compliance date is set, so do not assume your carrier already follows it; ask what protection it offers.
Source: eCFR: 47 CFR 64.2010(h): carrier rules for SIM change requests.
Report internet crime, including account takeovers and theft, to the FBI's Internet Crime Complaint Center.
Source: FBI IC3: Internet Crime Complaint Center: file a complaint.
Hardware security keys in practice
- Give each director and keyholder two security keys: one on their key ring and a spare stored separately, both registered on every important account.
- Register keys on the email admin, exchange, registrar, password manager and accounting accounts first.
- Where a service allows it, remove text message codes and security questions as recovery routes once security keys work.
- Keep recovery codes offline with the company records, not in the same place as the bitcoin recovery material.
- Security keys protect logins. They are not bitcoin signing devices, and the two should not be confused in the key register.
The domain and email
ICANN explains that the status codes clientTransferProhibited, clientDeleteProhibited and clientUpdateProhibited help to prevent unauthorised transfers, deletions or updates to a domain. Ask your registrar which of these it sets and how it confirms a request to lift them. A lost domain can mean lost email, and lost email can mean every password reset goes to someone else.
Source: ICANN: EPP status codes: what they mean, including clientTransferProhibited.
Two people for changes that move money
- Adding or changing a withdrawal address at a provider.
- Changing the bank account or payee details in the accounting software.
- Removing a security key or adding a new administrator.
- Changing the domain's name servers or contact email.
See approvals and provider controls.
Common questions
Our bitcoin is in a 2 of 3 multisig. Do accounts still matter?
Yes. An attacker who controls the email or the exchange account can redirect purchases, swap addresses in invoices or approvals, and trick keyholders into signing. The multisig stops one person moving the coins; the accounts decide what they are asked to sign.
Are text message codes better than nothing?
CISA says any form of MFA is better than none, but text messages are exposed to SIM swaps. Use them only where nothing stronger is offered.
Should keyholders use personal email for company accounts?
Our judgement, not a rule: no. Use company accounts the company can recover and remove when someone leaves.
Common mistakes
- One security key per person and no spare.
- A director's mobile number as the recovery route for the exchange account.
- The domain registered to a former employee's personal account.
- Bitcoin recovery words stored in the password manager.
- No record of which accounts exist and who owns them.
Read next
- Keyholder safety and privacy, the people behind the keys.
- Scams targeting companies, how account attacks are used.
- Sending bitcoin safely, checks before any send.
- If bitcoin is lost or stolen, the first hours.
- Security lessons, what past incidents teach.
- Continuity, when a keyholder leaves.
Sources
Primary sources only. Each link was checked on 10 November 2026. Rules change, so confirm the current version with your adviser.
- NCSCSetting up 2-Step Verification (2SV), including security keys
- NCSCMulti-factor authentication for your corporate online services
- NCSCSmall organisations guide to cyber security
- NCSCTop tips for staying secure online: managing your passwords (password managers)
- NCSCPhishing attacks: defending your organisation
- NCSCManaging public domain names, including registrar locks
- Report Fraud (City of London Police)Report Fraud: report cyber crime and fraud (in Scotland, report via 101)
- CISAImplementing phishing-resistant MFA (fact sheet, October 2022, PDF)
- eCFR47 CFR 64.2010(h): carrier rules for SIM change requests
- FBI IC3Internet Crime Complaint Center: file a complaint
- ICANNEPP status codes: what they mean, including clientTransferProhibited
One email. The whole library.
Policy checklist, board paper, recovery drill record, document pack and the rest, in one send. Then one short Thursday lesson for small companies in the UK and the US.
Free. One email with the whole template library, then one short lesson each Thursday. Unsubscribe at any time. See our privacy notice.
This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.
Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.
Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.