Gate has launched Gate Security Academy, a series on digital-asset security. In its first installment, the exchange’s security team and blockchain security firm CertiK discussed how institutions can manage large crypto holdings. Their central point: protecting private keys is only one part of custody. Transaction approvals, access controls, third-party tools, recovery plans and daily operations must work together, or a gap in one step can undermine the controls around it.
Institutional risks extend beyond stolen keys
For individual wallet users, security often centers on protecting private keys and seed phrases, spotting phishing attempts and verifying transactions. Institutions must also coordinate permissions across employees, systems and external providers while maintaining custody, business continuity and compliance. As asset holdings grow, even a small process weakness can have greater consequences.
Common risks include overly concentrated permissions, a mismatch between an approved transaction and the one actually executed, compromised devices or third-party software, collusion among employees and operational errors. When investigating an incident, organizations need to establish not only whether a key was stolen but also how an attacker gained access or persuaded a system to sign a malicious transaction.
CertiK cited a 2025 incident in which the front end of a Safe wallet was compromised. Signers saw what appeared to be a routine transfer, but the transaction they signed replaced the wallet’s implementation contract, leading to stolen assets. The case shows why multiple signatures alone may not prevent a loss: signers must be shown the same transaction that is ultimately approved and executed.
Gate’s security team groups institutional risks into three areas: tools, people and processes. Tampered open-source software, cloud services or development tools can expose wallets. Impersonation, employee misuse of privileges and failure to revoke access promptly after staff leave create personnel risks. Attackers may also spend time studying a company’s technology stack and targeting employees with access. Process gaps include bypassing approvals during emergencies, leaving temporary permissions in place, using live business data in test environments and exposing internal tools to the public internet for convenience.
Multisig, MPC and approvals need independent controls
Multisignature wallets require authorization from multiple keys, limiting the impact of a single compromised key. Multi-party computation (MPC) splits signing capability among separate key shares rather than storing or using a complete private key in one place. Internal approval processes address a different question: whether a transaction serves a legitimate business purpose.
CertiK said institutions should check whether these controls are genuinely independent. If multiple keys are controlled by the same team or administrator group, apparent decentralization may still conceal concentrated authority. And if the transaction shown on screen differs from the one received by the signing system, an approval process may not stop an unauthorized transfer.
CertiK’s technical analysis of the Gnosis Pay incident found a flaw in an authorization-validation module that allowed an unauthorized transaction to pass verification. The case illustrates why reviews should cover more than private keys and signature algorithms: identity checks, transaction validation, permission changes and recovery procedures also matter.
Gate said most of its own assets are held in offline, network-isolated multisignature cold wallets. Its hot wallets combine multisig and MPC and have balance limits, with funds above those limits moved to cold storage. Gate Vault, the company’s custody product for institutional clients, uses MPC and a 2-of-3 signing arrangement. The three key shares are held by the user’s device, Gate and an independent third party; any two parties must participate to complete a transaction. Each Gate Vault withdrawal also has a 48-hour waiting period, during which users can freeze a transfer if they identify a suspicious or mistaken transaction.
Transaction controls and account permissions
CertiK recommends a continuous chain of controls for each transaction. At initiation, institutions should verify the business purpose, counterparty, recipient address and amount. During approval, they should confirm that the transaction being reviewed matches the one submitted for signing. Signing and custody procedures should protect keys, devices and access rights. After execution, teams should monitor for unusual transactions and reconcile on-chain records with internal accounts. Each step should have a designated owner and records that can be independently cross-checked.
Some important risks do not directly move assets but can change who controls them. Examples include modifying a withdrawal whitelist, raising transaction limits, replacing signers or updating wallet software. Institutions should also test recovery plans regularly. If key employees leave, devices fail or a service provider becomes unavailable, organizations need to be able to restore control under multi-person authorization requirements without turning recovery into a back door around routine permissions.
Gate said its platform supports permission tiers across main and subaccounts, including viewing, trading and approval rights. Custody subaccounts for asset managers allow delegated teams to execute agreed strategies but do not grant withdrawal rights. Under this arrangement, investors cannot create API keys for automated operations and cannot view the team’s holdings, open orders or trading history during the delegation period. Gate also said its API keys can have separate read, trading and withdrawal permissions. Because institutional trading is often automated, separating these rights is a key part of account management.
Proof of reserves and regulatory checks
CertiK said regulators assessing platforms look at customer-asset custody, account reconciliation, access management, anti-money-laundering measures and incident response. Central bank digital currency systems also require checks on the integrity of issuance and ledger records, continuity of payments and accurate recovery after a failure. CertiK said it signed a memorandum of understanding with the National Bank of the Kyrgyz Republic to explore security assessments for the digital som, formal verification, cybersecurity and operational resilience, as well as digital-asset regulation, anti-money-laundering controls and custody.
Gate’s security team said platform assessments should also examine whether customer assets are separated from company funds and whether ownership can be established if a problem occurs. Gate said its proof-of-reserves system combines Merkle trees with zero-knowledge proofs, allowing users to verify that their assets are included in reserves without exposing personal information.
Gate’s latest reported figures put total reserves at $8.688 billion, for an overall reserve ratio of 118.49%. Bitcoin reserves stood at 25,727 BTC, with a reserve ratio of 121.60%; Ethereum reserves were 449,042 ETH, with a ratio of 123.78%. A ratio above 100% means the disclosed reserves for the relevant assets exceed corresponding customer balances.
When assessing an exchange, CertiK advises institutions to check which services, systems and software versions are covered by security audits, whether identified vulnerabilities have been fixed, and who can move assets or change critical permissions. For custody services, they should also examine key control, asset reconciliation, backup and recovery arrangements, and reliance on third parties. CertiK said its Skynet service aggregates on-chain and off-chain signals and updates security scores over time. The available description says the score covers six dimensions but does not list them in full.