Crypto in business: the 7 essential security rules

With crypto, there is generally no counter where you can contest a botched transaction: an error or a theft is often final. The good news is that most risks can be reduced with a few simple rules that can be applied without an IT team. Here are the seven we consider essential.

Rule 1 – Strictly separate business and personal

Use accounts, email addresses and, if possible, devices dedicated to the business’s activity. A business wallet or account should not be linked to your personal email or used for experiments. This separation limits the damage if one of the two is compromised, and makes the accounting easier.

Rule 2 – Enable multi-factor authentication everywhere

A password alone is not enough. ANSSI recommends favouring multi-factor authentication and, among the factors, those based on possession of an object (a physical security key, for example)^[1]. Combine it with a password manager, as recommended by ANSSI and the CNIL, so that you use a long, unique password for each service^[1][2].

Rule 3 – Protect keys and recovery phrases

If you manage a wallet yourself, the recovery phrase (a sequence of words) gives access to all the funds. A few principles:

• Don’t photograph it, don’t enter it on any website, don’t send it to anyone, including a so-called “support” agent.
• Keep it offline, on a durable medium, in at least two separate secure locations.
• Plan who can access it if you are unavailable, and under what conditions.

Rule 4 – Require dual approval

No significant outgoing payment should depend on a single person. Set a threshold above which a second person approves the transaction, or use a solution that requires several approvals. This rule protects as much against fraud and coercion as against a simple typing error.

Rule 5 – Check every address, test before paying large amounts

Crypto addresses are long and unreadable: an error or a malicious substitution during a copy-paste is possible. Before any transfer:

• Compare the beginning and the end of the address with a reliable source, through a second channel (a call, a verified message).
• Check the expected network (blockchain).
• First send a small test amount.
• Keep a list of approved addresses and limit changes to it.

Rule 6 – Stay alert to phishing and fake support

Scams often rely on urgency: a fake email from “customer service”, a fake link, a fake adviser asking you to install software or share a code. Adopt good habits: don’t click from a message you receive, access services via your bookmarks, never share a confirmation code, and check that a provider is authorised via the AMF white list^[3]. If in doubt, stop the transaction and call the provider back on a number you have found yourself.

Rule 7 – Organise access rights, updates and incident response

Security is also a matter of organisation. In practice:

• Limit rights to what is strictly necessary and remove the access of anyone who leaves the business.
• Keep the devices and applications you use up to date.
• Write a one-page “what to do if something goes wrong”: who to alert, which access to cut off, what evidence to keep.

ANSSI’s IT hygiene guide, which sets out 42 security measures, is a useful basis for structuring this work^[4].

The most common mistakes

In small organisations, incidents rarely come from a sophisticated attack. They tend to come from ordinary situations: a single employee holding all the access, a recovery phrase kept in an email or a photo, a payment approved in a hurry because a message seemed urgent, or a former employee whose account was never closed. Each of these situations is fixed by a rule from the list above. Review it once a quarter, as a team, as a routine check: that is often when you spot what has changed without anyone noticing.

Where to start?

If you were to do only three things this week: enable multi-factor authentication on all crypto-related accounts, set up dual approval for outgoing funds, and write down where and how the recovery keys are stored. The rest can follow step by step.

Quick self-assessment

• Separate business accounts and devices
• Multi-factor authentication enabled and password manager in place
• Recovery phrases stored offline, in two locations
• Dual approval threshold defined
• Written address verification procedure
• Team trained to recognise phishing
• Access rights reviewed and incident plan written