Some of the best-documented failures in bitcoin and crypto custody offer practical lessons for any company. We describe each one calmly, from official or company sources, and focus on the control that would have helped. We name companies, not people.
Keys kept on an online server
Mt. Gox, 2011 to 2014
The US Department of Justice says the exchange stored its wallets and private keys on a server, that unauthorised access began around September 2011, and that about 647,000 bitcoins were stolen by May 2014. The exchange stopped operating in 2014.
The control that helps
- Keep signing keys off internet-connected servers.
- Reconcile on-chain balances against internal records regularly, so a slow drain is spotted.
- Do not leave more on any exchange than the policy allows.
Large automated withdrawals
Bitfinex, 2016
The Department of Justice says a hacker breached the exchange's systems and made more than 2,000 unauthorised transactions, moving 119,754 bitcoin. More than 94,000 were later recovered and seized.
The control that helps
- Set transfer limits and alerts, so large or unusual movements need extra approval.
- Require more than one signer for every payment.
One person in control
QuadrigaCX, 2016 to 2019
A review by Ontario Securities Commission staff found that from 2016 one person had sole control of the platform, with no internal oversight. Clients lost at least C$169 million. Most of the shortfall came from fraud, not from keys lost on a death.
The control that helps
- No single person should be able to move funds alone, or be the only one who knows how.
- Independent oversight and segregation of duties matter as much as technology.
Client assets not kept separate
FTX, 2022
The SEC alleged that customer funds were diverted to an affiliated trading firm, where they were commingled and used for undisclosed investments and other spending.
The control that helps
- Check how a provider segregates client assets before using it.
- Do not assume deposit protection applies to a crypto platform.
Source: SEC: Press release 2022-219: SEC charges against the founder of FTX, FSCS: Cryptoassets: are they covered, and what is the risk?, FDIC: Fact sheet: what the public needs to know about FDIC deposit insurance and crypto companies.
A disguised signing request
Bybit, February 2025 (an Ethereum multisig)
The FBI says about $1.5 billion in virtual assets was stolen. The Safe Ecosystem Foundation says a compromised developer machine was used to present a malicious transaction disguised as a normal one.
The control that helps
- Signers should check every detail of a transaction on the signing device itself, not only on a computer screen.
- Multisig needs independent checks by each signer, not just multiple clicks.
Source: FBI: Public service announcement, 26 February 2025: theft of about $1.5 billion in virtual assets from Bybit, Safe Ecosystem Foundation: Statement on the Bybit incident: compromised developer machine and disguised transaction.
Customer contact details leaked
Ledger, 2020
Ledger says names, postal addresses and phone numbers of about 272,000 customers were leaked, and phishing emails and texts followed.
The control that helps
- Never type recovery words into a website, app or email reply.
- Treat unexpected messages about your wallet as suspicious and verify them independently.
Source: Ledger: Message from the CEO on the 2020 customer data leak, NCSC: Phishing: spot and report scam emails, texts, websites and calls.
Weak randomness in a device
Coinkite advisory, July 2026
Coinkite says a firmware bug in affected releases meant seeds generated on those devices had less randomness than intended, and that some weakened seeds were regenerated offline and funds taken. It says the devices were not hacked or remotely accessed.
The control that helps
- Keep firmware updated from the maker's official source and read its advisories.
- Generate each key of a multisig on a separate device, so one weakness is not enough to move funds.
Source: Coinkite: COLDCARD security advisory: weakened seed generation in affected firmware (July 2026).
Put the lessons into practice
The practices that apply to every model in the custody guide, the key ceremony walkthrough and the board checklist turn these lessons into steps.
Two related guides cover the people and the logins around the wallet: keyholder safety and privacy and securing the accounts around company bitcoin.
Sources
Primary sources only. Each link was checked on 29 October 2026. Rules change, so confirm the current version with your adviser.
- US Department of JusticePress release, 9 June 2023: charges over the hacking of the Mt. Gox exchange
- US Department of JusticePress release, 8 February 2022: seizure of bitcoin stolen in the 2016 Bitfinex hack
- Ontario Securities CommissionQuadrigaCX: a review by staff of the Ontario Securities Commission (2020)
- SECPress release 2022-219: SEC charges against the founder of FTX
- FBIPublic service announcement, 26 February 2025: theft of about $1.5 billion in virtual assets from Bybit
- Safe Ecosystem FoundationStatement on the Bybit incident: compromised developer machine and disguised transaction
- LedgerMessage from the CEO on the 2020 customer data leak
- NCSCPhishing: spot and report scam emails, texts, websites and calls
- CoinkiteCOLDCARD security advisory: weakened seed generation in affected firmware (July 2026)
- FSCSCryptoassets: are they covered, and what is the risk?
- FDICFact sheet: what the public needs to know about FDIC deposit insurance and crypto companies
One email. The whole library.
Policy checklist, board paper, recovery drill record, document pack and the rest, in one send. Then one short Thursday lesson for small companies in the UK and the US.
Free. One email with the whole template library, then one short lesson each Thursday. Unsubscribe at any time. See our privacy notice.
This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.
Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.
Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.