Gate & Certik: How Do Institutions Secure Tens Of Billions Of Dollars In Digital Assets?

What Happened

Gate has launched Gate Security Academy, an educational series examining the security risks crypto users face. The first edition, produced together with security firm CertiK, focuses on how institutions protect large digital asset holdings.

Where should those assets be stored? Who needs to approve a transaction? Who has the authority to move funds through a multisignature wallet? And if an attacker exploits a weakness somewhere in the process, can the institution detect the threat and stop the loss before it happens?

When investigating an institutional security incident, it is not enough to conclude that a private key was compromised. Investigators must also determine how the attacker gained access to the key, or how the attacker managed to trick a system into signing a malicious transaction without obtaining the key itself.

Market Context

In this edition of Gate Security Academy, we are joined by CertiK and Gate’s security team to shift the conversation from personal wallets to institutional asset management. From the perspectives of an independent security auditor and a crypto trading platform, we explore how institutions can keep their operations running smoothly while keeping asset risk at a manageable level.

Gate Security Team: Gate’s security team is responsible for developing and maintaining the platform’s account, trading, and asset security systems. The team also provides ongoing support to institutional clients in areas such as access control, API integration, and asset custody.

Why It Matters

In crypto, protecting your own assets may be as simple as keeping your recovery phrase secure. But when an institution is responsible for tens of billions of dollars in assets, the challenge becomes far more complex.

Q1. What is the biggest difference between managing a personal wallet and an institutional wallet? Where do institutional security failures typically occur, and how do the risks differ from those faced by individual users?

Scale amplifies the impact of any failure, and dependencies across teams and systems multiply the ways things can go wrong.

Common risks for individual users include compromised recovery phrases, phishing attacks, and malicious transaction approvals. Institutions face these same threats, but must also guard against excessive concentration of privileges, mismatches between what is approved and what is actually executed, compromised devices or third-party software, insider collusion, and operational errors.

A major incident in 2025 illustrates this risk. Attackers tampered with the Safe wallet frontend, causing signers to see what appeared to be a legitimate transfer while actually signing a malicious transaction that replaced the wallet’s implementation contract. Multiple authorized signers approved the transaction, yet the assets were still stolen.

Details

These are the questions at the heart of institutional digital asset security.

About the Guests

CertiK: CertiK is a Web3 security company trusted by regulators, financial institutions, and Web3 innovators worldwide. Since its founding in 2017, CertiK has served clients across more than 150 countries and regions, identified over 119,000 vulnerabilities in code, and helped safeguard more than $600 billion in digital assets.

Founded in 2013, Gate was one of the first major exchanges to commit to 100% proof of reserves and currently serves more than 62 million users worldwide.

The fundamental difference lies in how control over assets is organized.

For individual users, wallet security largely comes down to protecting private keys, recognizing threats, and verifying transactions. Institutions, however, must coordinate multiple roles, systems, and external service providers under clearly defined authorization rules. They also bear responsibility for asset custody, business continuity, and compliance.

What matters is not just how many people signed. Institutions must also verify that what signers see, what they approve, and what they ultimately sign are exactly the same transaction.

Evaluating institutional security therefore requires examining the entire chain of control: who initiates a transaction, who verifies its contents, who can sign, and who can change the rules — and whether each of these controls genuinely checks the others.

Personal wallet security is relatively straightforward. Most protective measures revolve around one central principle: keeping your recovery phrase and private keys out of the wrong hands.

Institutional security is much more complicated. It involves multisignature arrangements, multiple levels of access, and frequent transactions. Institutions need to make sure employees in different roles can use funds for legitimate business purposes, while preventing any one person from moving assets without authorization.

The two are simply not comparable in difficulty.

In publicly reported incidents, cases where the cryptography itself was broken are extremely rare. Most failures happen elsewhere in the process. Broadly speaking, they fall into three categories.