Gate and CertiK explore institutional asset security in new educational series

Gate has introduced Gate Security Academy, a series focused on security risks in crypto. The first installment, produced alongside CertiK, examines how large-scale digital asset protection works for institutions.

For individual users, safeguarding crypto can be as straightforward as securing a seed phrase. For an institution managing tens of billions of dollars, the challenge grows considerably.

Where should such holdings be kept? Who must sign off on a transaction? Who is allowed to move funds in a multisignature setup? And if an attacker exploits a vulnerability somewhere, can the organisation detect the threat and halt the loss in time?

These questions lie at the centre of institutional digital asset security.

In this edition of Gate Security Academy, CertiK and Gate’s security team join the discussion, shifting the focus from personal wallets to institutional asset management. From the perspective of an independent security auditor and a crypto trading platform, the conversation covers how institutions can maintain smooth operations while keeping asset risk under control.

About the Guests

CertiK: CertiK is a Web3 security company trusted by regulators, financial institutions, and Web3 innovators worldwide. Since its founding in 2017, CertiK has served clients across more than 150 countries and regions, identified over 119,000 vulnerabilities in code, and helped safeguard more than $600 billion in digital assets.

Gate Security Team: Gate’s security team is responsible for developing and maintaining the platform’s account, trading, and asset security systems. The team also provides ongoing support to institutional clients in areas such as access control, API integration, and asset custody.

Founded in 2013, Gate was one of the first major exchanges to commit to 100% proof of reserves and currently serves more than 62 million users worldwide.

Q1. What is the biggest difference between managing a personal wallet and an institutional wallet? Where do institutional security failures typically occur, and how do the risks differ from those faced by individual users?

CertiK:

The core distinction is in how asset control is organised.

For individual users, wallet security largely comes down to protecting private keys, recognising threats, and verifying transactions. Institutions, however, must coordinate multiple roles, systems, and external service providers under clearly defined authorisation rules. They also bear responsibility for asset custody, business continuity, and compliance.

Scale amplifies the impact of any failure, and dependencies across teams and systems multiply the ways things can go wrong.

Common risks for individual users include compromised recovery phrases, phishing attacks, and malicious transaction approvals. Institutions face these same threats, but must also guard against excessive concentration of privileges, mismatches between what is approved and what is actually executed, compromised devices or third-party software, insider collusion, and operational errors.

When investigating an institutional security incident, it is not enough to conclude that a private key was compromised. Investigators must also determine how the attacker gained access to the key, or how the attacker managed to trick a system into signing a malicious transaction without obtaining the key itself.

A major incident in 2025 illustrates this risk. Attackers tampered with the Safe wallet frontend, causing signers to see what appeared to be a legitimate transfer while actually signing a malicious transaction that replaced the wallet’s implementation contract. Multiple authorised signers approved the transaction, yet the assets were still stolen.

What matters is not just how many people signed. Institutions must also verify that what signers see, what they approve, and what they ultimately sign are exactly the same transaction.

Evaluating institutional security therefore requires examining the entire chain of control: who initiates a transaction, who verifies its contents, who can sign, and who can change the rules — and whether each of these controls genuinely checks the others.

Gate Security Team:

Personal wallet security is relatively straightforward. Most protective measures revolve around one central principle: keeping your recovery phrase and private keys out of the wrong hands.

Institutional security is much more complicated. It involves multisignature arrangements, multiple levels of access, and frequent transactions. Institutions need to make sure employees in different roles can use funds for legitimate business purposes, while preventing any one person from moving assets without authorisation.

The two are simply not comparable in difficulty.

In publicly reported incidents, cases where the cryptography itself was broken are extremely rare. Most failures happen elsewhere in the process. Broadly speaking, they fall into three categories.

The first involves compromised tools. If an attacker tampers with open-source software, a cloud service, or a development tool used by an organisation, its wallets can be exposed as well.

The second involves people. This includes impersonation to obtain access, employees abusing their privileges, and former employees retaining permissions that should have been revoked.

Attackers do not always need to break into a system directly. Often, it is easier to get close to someone who already has access.

The same principle applies to institutions. Attackers may study job postings to learn about a company’s technology stack, identify relevant employees through code-hosting platforms, or establish relationships with staff at industry events. This preparation can continue for months before an attack takes place.

The third involves weaknesses in operational procedures. Examples include bypassing normal approval requirements during an emergency, failing to revoke temporary access, using real business data in test environments, or exposing internal tools to the public internet for convenience.

None of these is especially sophisticated. But at an institution holding significant assets, any one of them can lead to serious losses.

Q2. Institutions commonly use multisignature wallets, MPC custody, and internal approval procedures to protect assets. What problems does each approach solve, and what risks should institutions watch out for?

CertiK:

These three mechanisms address different aspects of security.

Multisignature wallets require authorisation from multiple keys, reducing the risk associated with a single compromised key. Multiparty computation (MPC) distributes signing capabilities across separate key shares, reducing the risks of storing or using a complete private key in one place. Internal approval procedures determine whether a transaction should be carried out from a business perspective.

What institutions need to verify is whether these three layers actually check one another in practice.

For example, if multiple keys are controlled by the same team or the same set of administrator privileges, the signing threshold may appear distributed while the underlying risk remains concentrated.

Similarly, even if MPC key shares are stored separately, institutions must examine whether device registration, identity verification, and recovery privileges can all be controlled by one person.

The same applies to approval procedures. If employees approve what appears on a screen, but the signing system receives a different transaction, the approval process cannot effectively prevent unauthorised asset transfers.

In its technical analysis of the Gnosis Pay incident, CertiK found that a flaw in an authorisation validation module allowed unauthorised transactions to pass validation.

This demonstrates why security assessments must go beyond private keys and signing algorithms. They must also cover identity verification, transaction validation, permission changes, and recovery procedures.

Gate Security Team:

These are exactly the issues we design around at Gate.

For Gate’s own asset management, the vast majority of assets are held in multisignature cold wallets, kept offline and air-gapped.

Our hot wallets combine multisignature protection with MPC, distributing private key management across multiple components. Hot wallets are also subject to balance caps: any amount above the cap is immediately swept to cold storage.

For our users, we offer different security solutions depending on their needs.

For institutional clients, we offer Gate Vault, which combines MPC with a 2-of-3 signing scheme.

Put simply, the signing key is divided into three shares, held separately by the user’s device, Gate, and an independent third party. Any transaction requires two of the three shares, so no single party can move the assets alone.

Every outgoing transfer from Gate Vault is also held for 48 hours, during which the user can freeze it. In institutional settings, operational mistakes and signatures made under duress do happen. The delay creates a window in which suspicious or unintended transfers can be identified and stopped before the assets leave.

Q3. How should institutions build a comprehensive security management framework? Which areas are most commonly overlooked?

CertiK:

Institutions should establish a continuous chain of controls around every transaction.

At the initiation stage, they need to verify the business purpose, counterparty, destination address, and transaction limits.

During approval, the relevant personnel must understand what the transaction actually does, and the approved details must match the final transaction submitted for signing.

At the signing and custody stages, institutions must protect keys, devices, and operational permissions.

After execution, they should monitor for unusual transactions and reconcile on-chain records with internal accounting records.

Every step needs a clearly designated owner, along with records that can be cross-checked against one another.

Some of the most overlooked risks involve actions that do not directly transfer assets but can change who controls them.

These include modifying withdrawal address whitelists, increasing transaction limits, replacing authorised signers, or updating wallet software.

Recovery procedures also require dedicated planning and regular testing.

If a key employee leaves, a device fails, or a service provider becomes unavailable, the institution must be able to regain control of its assets while preserving appropriate multi-person authorisation requirements.

A recovery path must never become a backdoor around everyday access controls.

Gate Security Team:

On Gate, institutions typically manage funds through a combination of main accounts and subaccounts, with different permissions assigned to employees according to their responsibilities.

For example, some employees may only be allowed to view account information, others may be authorised to trade, while designated personnel handle approvals.

This structure supports day-to-day operations while reducing unnecessary risks to funds.

For asset managers, we also provide dedicated managed subaccounts.

These are designed to address a common concern: an investor may want a professional team to manage their assets without giving that team the ability to withdraw the funds.

Under this arrangement, once an investor creates a managed subaccount, they cannot create API keys themselves for automated operations. The trading team can execute agreed trading strategies but does not have withdrawal permissions.

For the duration of the mandate, the investor also cannot view the trading team’s positions, open orders, or trading history, so the team’s strategy stays confidential.

API permissions matter just as much.

Most institutional trading is programmatic, with manual orders a small fraction, so our API keys support granular permissions: read, trade, and withdraw can each be enabled separately.

Q4. When regulators assess a platform or project, which security and compliance issues matter most?

CertiK:

Regulators first need to determine whether a platform can maintain control over assets, keep critical services running, and clearly demonstrate how risks are detected and handled when incidents occur.

For trading platforms, this includes client asset custody, account reconciliation, access management, anti-money laundering controls, and incident response.

For central bank digital currency (CBDC) systems, the integrity of issuance and ledger records, continuity of payments, and accurate recovery after failures are especially important.

Although these systems serve different purposes, both require evidence that can be tested and independently verified.

These are also among the practical issues involved in CertiK’s recent collaboration with the National Bank of the Kyrgyz Republic.

Under a signed memorandum of understanding, the two parties intend to explore areas including security assessments of the digital som, formal verification, cybersecurity and operational resilience, as well as digital asset regulation, anti-money laundering, and custody.

In practical assessments, regulators need concrete evidence.

Who controls critical permissions? Have high-risk vulnerabilities been remediated? How are suspicious transactions handled? After a simulated system failure, can services and accounting records be accurately restored?

The answers show whether the controls actually work.

Gate Security Team:

We see these issues firsthand when applying for and maintaining licenses across jurisdictions.

When people discuss platform security, they often focus on how advanced the technology is.

But from a regulatory perspective, another question is just as important: are customer assets segregated from the platform’s own funds? And if something goes wrong, can the platform clearly identify which assets belong to whom?

This is where proof of reserves comes in.

For everyday users, it helps them verify whether a platform holds sufficient assets to cover customer balances. For regulators, it can also provide useful evidence when assessing how a platform manages its assets.

Gate combines Merkle trees with zero-knowledge proofs, allowing users to verify that their assets are included in the reserve calculation while protecting their personal information.

According to the latest published figures, Gate holds total reserves of $8.688 billion, with an overall reserve ratio of 118.49%.

Its Bitcoin reserves stand at 25,727 BTC, with a reserve ratio of 121.60%, while Ethereum reserves total 449,042 ETH, with a reserve ratio of 123.78%.

In simple terms, a reserve ratio above 100% means that the platform’s disclosed reserves for the relevant assets exceed the corresponding customer balances.

Q5. How can institutions assess whether a trading platform is secure? What information can they independently check and verify?

CertiK:

When evaluating a platform, institutions should first determine whether the available security evidence actually covers the services, systems, and software versions they intend to use.

Which components were included in the audit? Have identified vulnerabilities been fixed? Who can transfer assets or modify critical permissions?

If custody services are involved, institutions should also understand how key control, asset reconciliation, backup and recovery, and third-party dependencies are managed.

At CertiK, we use Skynet to organise complex on-chain and off-chain signals into more accessible, continuously updated security scores.

For Web3 projects, these scores cover six dimensions: code security, fundamental health, operational resilience, community trust, market stability, and governance strength.

This helps institutions quickly identify areas that warrant further investigation.

Institutions can also use Skynet to review publicly available CertiK audit reports, examine specific findings and their remediation status, and verify whether an audit’s scope matches the version currently deployed.

Exchanges and wallets are assessed against their own criteria.

For internal access controls and custody arrangements that cannot be evaluated through publicly available information, institutions should still request supporting documentation from the platform and verify the relevant controls through due diligence or controlled testing.

Gate Security Team:

Institutions can start with three areas.

The first is proof of reserves.

Gate, for example, has open-sourced its reserve verification tool on GitHub. With their own verification data, users can check locally whether their account balances have been correctly included in the reserve calculation.

The second is the bug bounty program.

In other words: is the platform willing to pay outside researchers to find its weaknesses?

Institutions should look at whether the program is long-running, whether the rewards are reasonable, and whether the platform responds promptly to reported issues.

Gate has run a long-standing bug bounty program and welcomes security researchers from around the world to report vulnerabilities.

The third is licensing.

Institutions should verify which countries and regions have granted the platform relevant licenses, which legal entities hold those licenses, and whether the licenses remain valid.

A license doesn’t make a platform risk-free, but it does mean the platform is required to meet the applicable regulatory standards in that jurisdiction.

Q6. For an institution that is just beginning to allocate funds to digital assets, what should its first security priorities be?

CertiK:

The first step is to define the purpose of the allocation and establish clear risk limits.

Institutions should determine which assets they intend to hold, which platforms, blockchains, and counterparties they will use, and what limits should apply to individual transactions and overall exposure.

They should then clearly assign responsibility for transaction initiation, approval, signing, reconciliation, and incident response.

When deciding between self-custody, third-party custody, or a combination of the two, they also need to establish which permissions each party will control.

Before making the first transfer, institutions should verify the recipient and destination address.

In its research on institutional digital asset counterparties, CertiK has emphasised that an on-chain address alone does not establish who is behind it or who controls it.

Address ownership, historical risk indicators, and counterparty information must be examined together.

Once platform due diligence is complete, institutions can start with a small pilot to run trading, withdrawals, and reconciliation end to end.

They should also rehearse how to respond to device failures or service disruptions.

Exposure should then be scaled up based on the results.

Gate Security Team:

For institutions that are just beginning to allocate funds to digital assets, we have four recommendations.

First, separate funds by purpose.

Funds needed for daily trading, medium-term reserves, and long-term holdings should be managed separately, with different limits on how they can be used.

Ideally, this structure should be planned before opening an account. Once operations are already underway, changing how funds are managed can become much more difficult.

For long-term holdings that won’t be touched, institutions can also consider custody solutions with a 48-hour withdrawal delay.

That additional waiting period provides time to review and respond to potentially suspicious activity.

Second, separate duties.

Initiating a transfer, approving it, and executing it should ideally not all be handled by the same person.

Using subaccounts and employee permission settings, institutions can establish this basic separation of duties without building anything in-house.

Third, strictly control API keys used for automated operations.

Withdrawal permissions should be disabled by default.

Every API key should have a clearly defined purpose and a designated owner, and institutions should establish in advance when that key must be revoked or deleted.

Fourth, conduct thorough due diligence before choosing a platform.

As we discussed earlier, institutions should check whether the platform’s proof of reserves can be independently verified, who is responsible for custody of the funds, whether a bug bounty program is in place, and whether the relevant licenses remain valid.

These are all questions that should be answered before assets are committed.

Whether it’s a personal wallet or an institutional treasury, more money and more people mean more complex risk.

But regardless of the setting, the fundamental goal of security remains the same: identify risks early and, wherever possible, prevent them from turning into actual losses.

That is also the message we hope to convey through Gate Security Academy.

Security should not become a priority only after something goes wrong. It should be a habit in every operation and every decision.

Our thanks to CertiK and the Gate Security Team for sharing their insights.

About Gate

Gate, founded in 2013 by Dr. Han, is one of the world’s leading cryptocurrency and integrated financial services platforms, spanning financial and everyday use cases including asset management, trading and payments. Serving over 62 million users globally, it supports trading across 5,400+ digital assets and 12,800+ stock assets and ETFs, while providing access to a comprehensive range of TradFi assets, including metals, stocks, indices, forex, and commodities to meet users’ end-to-end needs across asset holding, trading, and spending. As an industry benchmark, Gate was among the first platforms to implement 100% Proof of Reserves. Its ecosystem includes Gate Money, Gate Wallet, Gate Ventures, Gate for AI Agent, and a wide range of products and services.