Insider Threats at Projects
Some losses come from within. The controls that prevent an individual from moving funds unilaterally are visible from outside and rarely checked.
Priya Raman · 2 min read
Not every loss involves an external attacker. Some involve someone who already had access, and the distinction matters because the defences are structural rather than technical.
The forms
Unilateral key control. A single person able to move treasury funds or upgrade a contract.
Exit by the founding team. Funds drawn from a treasury and the project abandoned. Legally ambiguous where the funds were raised without specific commitments.
Privileged trading. Acting on knowledge of an upcoming listing, integration or announcement. Common enough to have prompted enforcement in several jurisdictions.
Departure with access retained. Someone leaves and their keys are not rotated.
That last one is mundane and has caused real losses.
Why crypto is more exposed than conventional finance
Irreversibility. A conventional insider transfer can frequently be unwound. An on-chain one cannot.
Concentration of control. Many projects have a small number of people with the ability to move everything.
Immediate settlement. Nothing pauses between the decision and the consequence.
Weaker governance. Young organisations with informal controls managing large treasuries.
The controls that work
Multi-signature with a genuine threshold. Requiring several independent signers, ideally in different organisations and jurisdictions. The number of signers and their identities are frequently published.
Timelocks on upgrades. A delay between a proposed change and its execution, during which users can react. This is the single most valuable control for users, because it converts an insider action into a warning.
Separation of duties. Different people control treasury movement, contract upgrades and operational funds.
Key rotation on departure. Documented and actually performed.
Published treasury addresses. So that movements are observable by anyone.
What a user can check
All of it, for most projects.
Whether the contract is upgradeable, and by whom. Whether there is a timelock and how long. How many signers the controlling multi-signature requires. Whether treasury addresses are published.
Independent watchdog sites publish standardised assessments of this for major protocols, and the information is in the contract regardless.
A project where a single address can upgrade the contract with no delay is a project where one person’s decision, or one compromised key, is sufficient.
The read-across
For an individual, the equivalent question is whether any single thing going wrong is sufficient to lose everything.
One device, one phrase, one location, one person who knows. Each of those is a single point of failure, and the fix is the same as for a protocol: require more than one thing to go right.
For the working balance, the equivalent control is a withdrawal allowlist with a delay, offered by venues including an exchange you can actually contact and disabled by default.
Move any remaining funds to a wallet with a newly generated seed phrase before anything else. Then revoke token approvals, and report the incident to your local authorities and the exchange involved. Do not pay anyone who promises to "recover" your coins. That is a second scam, aimed at victims of the first.