Crypto security for businesses: protecting your keys, your access and your payments

Why crypto requires its own approach to security

A fraudulent bank transfer can sometimes be disputed. A transfer of crypto-assets, on the other hand, is generally irreversible: if an attacker obtains your access, or if you get the address wrong, there is no customer service to call. Security therefore relies on your procedures, not on recourse after the fact.

The foundations

• Separate business and personal. Separate accounts, wallets and devices, and never a company key in a personal account.
• Multi-factor authentication everywhere, preferably with a physical key or a dedicated app rather than SMS.
• Protect the keys and the recovery phrase. Offline, in several copies, in separate locations, with no photo or copy in the cloud.
• Check every address and make a test payment before a large amount.

These rules are detailed in our guide the 7 crypto security rules for businesses.

Multisig and dual approval: don’t depend on a single person

A multisig (multi-signature) wallet requires several approvals to validate a transaction: for example two signatures out of three designated people. For an SME, it is the digital equivalent of a cheque requiring two signatures. Its benefits are concrete:

• a single compromised device is not enough to empty the wallet;
• the absence or departure of one person does not block the business;
• every transaction leaves a record of who approved what.

Multisig is not suitable for every case: it adds complexity and must be tested before significant amounts are placed in it. In a very small organisation, organisational dual approval (one person prepares, another approves) with an authorised custody provider may be enough. We help you choose according to your size, your amounts and your uses.

Access rights, updates and response plan

• Who can do what. Preparing, approving and executing are separate roles. Rights are reviewed whenever someone joins or leaves.
• Up-to-date devices and software, with no unnecessary browser extensions on the computers that handle funds.
• Phishing and fake support. No one from official support will ever ask for your recovery phrase. A written rule known to everyone prevents mistakes under pressure.
• A response plan. What to do, within the hour, if an access is compromised: who to alert, what to cut off, whom to contact.

Where to start: five questions

1. Who in the business can move funds today?
2. Where are the keys and recovery phrases stored, and who has access to them?
3. Can a single person approve a significant transaction on their own?
4. What happens if that person is absent, leaves the business or has their access compromised?
5. Can your teams recognise fake support or a fake supplier?

If you are unsure about more than one answer, a diagnostic helps set priorities before an incident forces you to.

What Si0x does

We start from your actual situation: what you hold or receive, who has access to it, which tools you use. We identify weak points, propose proportionate rules and put them in writing, then we train your teams to apply them. Si0x does not hold your keys and does not manage your funds.

These rules complement those of compliant use: see our support for crypto payments in business and crypto training for businesses to raise your team’s awareness.