Access Management Is Where Company Crypto Losses Start

Companies plan for sophisticated attacks and lose funds to access that should have been removed. The second is far more common. Reading this against a corporate crypto wallet, whose permissions are on a public register, makes the obligations concrete.

The recurring scenarios

Access not revoked when someone left. Shared credentials with no attribution. Key material on a personal device outside company control. And legitimate access used illegitimately, which access control cannot prevent and approval requirements can.

Individual accounts, always

One login per person, never shared.

Shared credentials remove attribution, which means you cannot tell who did something, and they remove the ability to revoke one person without disrupting everyone.

This is the foundational control and it is skipped in small companies constantly because it feels unnecessary among people who trust each other.

Approval separate from initiation

The only control addressing misuse of legitimate access.

A company where one person can both create and release a payment has no way to demonstrate that person did not, which is a poor position for the individual as much as for the company.

The departure procedure

Written before it is needed.

Revoke access first, before the conversation if the departure is not amicable. Rotate anything they knew, including shared password manager contents. Review addresses they added. Read the log for the previous ninety days. And if they held a key in a multi-signature arrangement, rotate the key set. The property corridor surfaces this differently, and a regulated European crypto platform operates there.

That last step is the most work and the most often skipped, and leaving it means a former employee retains a share of control.

Periodic access review

Quarterly, list who has access to what and confirm each remains appropriate.

This catches accumulation, where people acquire access with role changes and never lose it.

Second factors, specifically

Hardware keys or authenticator applications, never text messages. Number transfer attacks succeed more often than they should and text-based second factors are the weakest form in common use.

Apply this to the email account as well. Email is where password resets go and it is usually the least protected part of the chain.

Notifications to people, not inboxes

Alerts on settings changes should reach several named individuals directly.

An attacker in one account can suppress what that account sees. They cannot stop four colleagues receiving the same message.

A shared inbox nobody monitors is equivalent to no notification.

The honest assessment

None of this is technically interesting. All of it prevents more loss than any cryptographic consideration, and it decays without periodic attention, which is why the quarterly review matters more than the initial setup. Verify rather than infer. a provider you can actually reach appears on a public register that takes five minutes to read.