Crypto Wallet Heists Are Rising — Is Your Institution Next? | by Chewtoro | The Capital | Mar, 2025

The recent breach at Bybit has once again cast a harsh spotlight on the vulnerabilities of institutional wallet security. Investigations revealed that Bybit’s CEO, Ben Zhou, unknowingly authorized a routine transaction that ultimately handed control of the account to hackers. Exploiting weaknesses in a widely used free storage software, the attackers were able to manipulate transaction approvals to their advantage.

A critical flaw in the security setup became evident when Zhou was forced to approve the transaction blindly — his approval hardware was out of sync with the storage software, leaving no way to verify its legitimacy. This incident raises pressing questions: Can institutions implement stronger safeguards to prevent such breaches, or are sophisticated wallet heists an inevitable risk in the digital asset space?

Cryptocurrency wallets come in various forms, ranging from software-based options — both custodial and non-custodial — to more secure hardware wallets. Beyond storing cryptocurrencies, these wallets also serve as gateways for managing non-fungible tokens (NFTs), interacting with decentralized applications, and more.

However, no single wallet brand or type offers foolproof security. To effectively safeguard digital assets, institutions must adopt a multi-layered defense strategy — one that enhances protection without compromising usability.

• Smart Contract Exploits — Weaknesses in smart contracts can be exploited by hackers to drain funds.
• Technology & Key Management — Poorly secured private keys or outdated security protocols increase risk.
• Blind Signing — Approving transactions without full visibility can expose users to malicious manipulation.
• Administrative Access — Mismanaged permissions or compromised access controls can lead to unauthorized breaches.

As crypto heists grow more sophisticated, institutions must rethink their security strategies to stay ahead of emerging threats.

Smart Contract Exploits

While blockchain technology offers rapid execution and eliminates intermediaries, its decentralized nature also creates opportunities for hackers to exploit vulnerabilities in consensus mechanisms — particularly at the smart contract level. Over the years, major attacks have demonstrated how devastating these weaknesses can be. The 2021 Cream Finance flash loan attack and the 2020 bZx protocol exploit are just two high-profile examples. More recently, research from TRM Labs found that the total value stolen in crypto hacks and exploits during the first half of 2024 has doubled compared to the same period in 2023.

Among the most common attack vectors are:

• Reentrancy Attacks — A malicious contract repeatedly calls another before the initial transaction is finalized, allowing funds to be drained.
• Access Control Exploits — Improperly secured smart contracts grant unauthorized users the ability to extract funds or manipulate functions.
• Integer Overflow and Underflow — Attackers manipulate numerical values within contracts, enabling excessive withdrawals or unintended token multiplications.

The only effective defense against these exploits is continuous, automated monitoring to detect vulnerabilities in real time, alongside frequent and rigorous code audits to identify and address potential weak points before attackers can exploit them. As crypto-related attacks grow more sophisticated, institutions must stay ahead with proactive security measures.

Technology & Key Management

With various approaches to managing cryptographic keys, there is no universal solution that fits every institution’s needs. From single-signature (single-sig) to multi-signature (multi-sig) and Multi-Party Computation (MPC), each method comes with distinct advantages and trade-offs. The ideal choice depends on factors such as the wallet’s intended use, regulatory requirements, and operational constraints.

At its core, key management revolves around the use of encryption keys to authorize transactions. Typically, there are two types: private keys, which are held securely by the user and grant ownership of assets, and public keys, which are visible on the blockchain and serve as addresses for transactions.

For institutions, relying on a single-sig model poses significant security risks, as a single private key controls access to funds. Instead, many opt for a multi-sig approach, which requires multiple private keys — held on separate devices — to approve a transaction. This enhances security by reducing single points of failure. However, one key limitation of multi-sig is that it is often designed for a single blockchain, making it less adaptable for institutions operating across multiple chains.

MPC offers a more advanced solution by breaking the private key into multiple “shards” distributed across different parties or devices. Because no single entity ever possesses the full key, this approach significantly reduces the risk of compromise while ensuring greater flexibility across different blockchain networks. As institutions scale their digital asset operations, robust key management remains a critical pillar of wallet security.

Blind Signing

At first glance, blind signing — approving a transaction without fully understanding its details — seems like an obvious risk to avoid. However, in practice, it is sometimes unavoidable. Many wallets struggle to standardize transaction data into a readable format, making it difficult for users to verify what they are signing. This creates an opportunity for attackers to manipulate transactions, often leading to unauthorized fund transfers or smart contract exploits.

To mitigate the risks associated with blind signing, institutions can implement several safeguards. Using dedicated hardware devices with air-gapped features — which remain physically isolated from the internet — adds an extra layer of security against network-based threats. Additionally, cryptographically enforced security policies can help enforce second-level verification, ensuring that transactions meet predefined security criteria before approval. Establishing strict approval parameters and limiting transaction permissions can further reduce the likelihood of fraudulent activity.

As cyber threats become more sophisticated, institutions must rethink their approach to transaction approvals, ensuring that blind signing does not become a gateway for financial losses.

Administrative Access

Since transaction approvals ultimately rely on human decision-making, institutions must trust that approvers act in the company’s best interest. However, security risks don’t just stem from external attackers — developers and security teams with administrative access can also pose threats, whether through negligence, misconfigurations, or malicious intent. Those with high-level access often have the ability to define approval flows and transaction scopes during wallet setup, making them potential points of failure in security.

While it’s difficult to eliminate human error or insider threats entirely, institutions can implement safeguards to minimize risk. Biometric authentication, such as Face ID or fingerprint scanning, can help verify user identity and prevent unauthorized approvals. Additionally, enforcing strict role-based access controls (RBAC) ensures that no single individual has excessive control over transaction processes. By combining these measures, institutions can reinforce administrative security and reduce the risk of insider-related breaches.

As institutional involvement in digital assets grows, so do the risks. From smart contract exploits and poor key management to blind signing risks and administrative vulnerabilities, crypto wallet security remains a complex but critical challenge. The recent wave of high-profile hacks underscores a harsh reality: no single security measure is enough.

Institutions must adopt a multi-layered defense strategy — one that includes rigorous code audits, continuous transaction monitoring, hardware-based approvals, and biometric authentication. By proactively addressing vulnerabilities and enforcing stricter security policies, organizations can significantly reduce the risk of costly breaches.

The question is no longer whether institutions will be targeted, but whether they are prepared when the attack comes. In an industry where a single security lapse can mean millions in losses, complacency is not an option.