Gatecoin Hack

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Gatecoin Homepage/Logo

Gatecoin was one of the first regulated digital asset exchanges. This didn’t stop the hack of 185,000 ETH and 250 BTC. According to a forensic analysis, the exchange may have been the victim of a man-in-the-middle attack. The malicious external party involved in this breach managed to alter their system so that BTC and ETH deposit transfers bypassed the multisig cold storage and went directly to the hacker’s wallet during the breach period. The company fired their CTO, managed to raise $500k in order to reopen, and ultimately repaid all customers. They were saved by maintaining large cold wallet reserves which appear to have been properly stored, and appear to have dealt with the issue transparently. Having hot wallet insurance would have further assisted with the recovery. A system like Proof of Reserves or an automated alert system could have allowed the issue to be noted sooner.

This exchange or platform is based in Hong Kong, or the incident targeted people primarily in Hong Kong.

About Gatecoin

Founded and established in 2013 in Hong Kong, Gatecoin primarily focused on Bitcoin and Ethereum markets. Gatecoin was a regulated and secure financial institution specializing in blockchain assets. Gatecoin emphasized compliance and transparency, boasting KYC and AML processes supported by a major compliance solutions provider. In 2015, Gatecoin launched a new Bitcoin exchange which featured robust security measures. These measures include segregated client bank accounts, multi-signature cold storage, and continuous monitoring by an external IT security firm. The company emphasizes its commitment to regulatory compliance, operating under a Hong Kong Money Service Operator license and adhering to AML/KYC rules. Gatecoin's segregated bank accounts ensure that clients' funds are kept separate from operational expenses, minimizing counterparty risks.

The platform promises deep liquidity through a market maker rebate program and features an instant buy/sell option for seamless currency swaps. The exchange allows users to trade Bitcoin against USD, Euro, and HKD, with plans to integrate Ripple into its platform soon. Users can easily buy and sell bitcoin, ether (Ethereum), and DAO tokens worldwide with various fiat currencies, benefiting from public live-data streaming, a fully documented REST API, and dedicated customer support. The exchange's trading system is decentralized, modular, scalable, and highly secured, employing bank-grade security procedures and segregated client accounts. Moreover, Gatecoin offers a smart and mobile-optimized interface for intuitive trading experiences, continually enhancing its platform for user convenience and efficiency.

Aurélien Menant was the CEO of Gatecoin through 2015 and 2016. Looking ahead from 2015, Gatecoin expressed aims to expand its business to the US and Europe, focusing on obtaining the necessary licenses and developing innovative digital currency trading services and payment methods to enhance user experience. Gatecoin planned the introduction of a white-labeled debit card that could be reloaded instantly online using bitcoins, providing users with a convenient way to spend their digital currency worldwide without incurring foreign transaction fees.

The Reality

The Gatecoin server infrastructure was insecure against outside vulnerabilities. It would also appear that Gatecoin was not monitoring their balance integrity on an ongoing basis, and was unaware of an intrusion into their system for several days.

What Happened

Between May 9th and May 12th, 2016, funds sent to Gatecoin were diverted to an external wallet controlled by an attacker.

Key Event Timeline - Gatecoin Hack

Date	Event	Description
January 30th, 2015 4:10:26 AM MST	Segregated Bank Account Launch	CoinTelegraph announces that Hong-Kong based Gatecoin Limited has launched a new Bitcoin exchange with stringent security measures, including segregated client bank accounts, multi-signature cold storage, and continuous monitoring and audit by an external IT security firm. Segregated bank accounts ensure that clients' funds are kept separate from operational expenses, minimizing counterparty risks. Gatecoin CEO Aurélien Menant emphasized the rarity of this practice in the crypto space, stating that it dramatically reduces risks for clients. The company, operating with a Hong Kong Money Service Operator license and complying with AML/KYC rules, has secured a unique banking structure due to its regulatory compliance. Gatecoin offers trading in Bitcoin against USD, Euro, and HKD, with plans to integrate Ripple into its platform soon. Additionally, it is introducing a white-labeled debit card, usable worldwide without foreign transaction fees, reloadable with bitcoins online instantly. Gatecoin aims to expand its services to the US and Europe, focusing on obtaining necessary licenses and developing innovative trading services and payment methods to enhance customer experience.
May 9th, 2016 1:38:25 AM MDT	Bitcoin Transaction	One of the bitcoin transactions involved in the theft for 12 BTC.
May 9th, 2016 4:01:19 AM MDT	Bitcoin Transaction	One of the bitcoin transactions involved in the theft for 1 BTC.
May 9th, 2016 5:29:24 AM MDT	Bitcoin Transaction	One of the bitcoin transactions involved in the theft for 200 BTC.
May 9th, 2016 12:14:07 PM MDT	Bitcoin Transaction	One of the bitcoin transactions involved in the theft for 45.6 BTC.
May 9th, 2016 12:23:11 PM MDT	Bitcoin Transaction	A smaller bitcoin transaction involved in the theft for 6.18 BTC.
May 9th, 2016 12:38:16 PM MDT	Bitcoin Transaction	A smaller bitcoin transaction involved in the theft for 2.12 BTC.
May 9th, 2016 1:54:26 PM MDT	Palantine King Downtime Post	Palantine King posts on their website noting that Gatecoin, a significant player in DGD trading volumes which they actively trade, abruptly went offline after displaying a maintenance page for an hour. Despite calls for tweet updates during the maintenance, none were provided, fueling speculation of a hack. While the hack remains unconfirmed, early indicatorsI suggest it as a likely scenario. Given Gatecoin's substantial role in DGD trading, the incident could have significant consequences for DGD's price, particularly if hackers engage in unbalanced selling. The situation is unfolding, and further updates are awaited.
May 9th, 2016 2:30:43 PM MDT	Reddit Downtime Discussion	Palantine King posts their concerns about the Gatecoin downtime on Reddit. One user expressed that they are also having trouble with a withdrawal which hasn't come through yet.
May 9th, 2016	Breach Begin	The reported date that that breach began at "late night HKT". There was a "disruption of [the Gatecoin] service caused by a server reboot". They "strongly believe that the breach is linked to this event".
May 10th, 2016 10:04:00 AM MDT	Palantine King False Alarm	Palantine King posts the final update to their website, concluding that there was no problem with the Gatecoin exchange other than a temporary server outage, based largely on official information received from Gatecoin.
May 12th, 2016	Breach Ended	The reported date that the breach ended on "Thursday evening HKT".
May 13th, 2016	Cited Date	The date of the hack cited by Kyle Gibson. On "Friday night HKT" is when the team "detected some suspicious transactions and immediately suspended [thei]r services to investigate".
May 13th, 2016 4:50:00 PM MDT	CoinDesk Article Released	CoinDesk reports that Gatecoin faces turmoil after reportedly experiencing a hack, resulting in losses from its connected wallets. CEO Aurélien Menant confirmed the incident and assured users of efforts to refund customers affected by the breach. Users are faced with uncertainty and concern regarding the security of their funds. Gatecoin's assurance of conducting a full forensic investigation to identify the root cause of the issue is a positive step, but the timeline for resolution and the extent of the losses remain unclear.
May 14th, 2016 5:22:56 AM MDT	Official Statement Released On Reddit	In a Reddit post, Gatecoin confirmed a breach of its system resulting in the loss of 15% of its crypto-asset deposits, valued at approximately $2 million. The breach occurred between May 9 and May 12, 2016, with suspicious transactions detected on May 13 prompting the suspension of services. Despite storing most funds in multi-signature cold wallets, hackers bypassed this security measure, diverting ETH and BTC deposits to hot wallets during the breach. Gatecoin plans to release a platform for clients to withdraw remaining funds by May 28, 2016, with the exact date for ETH withdrawals pending confirmation. The exchange assures the security of DGD, REP, and DAO funds, while working to raise additional funds to reimburse affected customers. Gatecoin expresses gratitude for community support and pledges to provide updates via Twitter, Reddit, and its homepage.
May 14th, 2016 5:37:00 AM MDT	Official Statement On Twitter and Homepage	An update is provided on Twitter, which links to the Gatecoin homepage as an official statement about the hack. The Gatecoin homepage is later captured providing an official statement about the breach. Loss figures are provided as 15% of its crypto-asset deposits, totaling ETH 185,000 and BTC 250 (equivalent to USD 2 million) between May 9 and May 12, 2016. The breach occurred due to a system alteration that allowed ETH and BTC deposits to bypass multi-signature cold storage and go directly to the hot wallet. The compromised wallet addresses and Bitcoin transactions have been identified. Gatecoin suspended its services upon detecting suspicious transactions and is working with Tehtri Security to investigate the breach thoroughly. A platform enabling clients to withdraw remaining funds in various currencies will be released, and efforts are underway to raise additional funding to cover losses and reimburse affected customers. Gatecoin expresses gratitude for the community's support and pledges to provide updates through various channels.
May 16th, 2016 3:11:00 AM MDT	Gatecoin on Withdrawal Of REP Tweet	A Gatecoin agent account responds to a customer inquiry about the ability to withdraw the REP tokens from their account. They note that they are planning to build a custom interface to facilitate these withdrawals by March 28th.
May 16th, 2016 10:27:00 AM MDT	CoinDesk Article On Breach	CoinDesk reports that Gatecoin has disclosed the cyberattack on its hot wallets, with the loss of funds estimated at $2 million. The breach, believed to have begun on May 9th and continued for three days, led to the theft of 185,000 ethers and 250 bitcoins. Gatecoin acknowledged that its security measures, including multi-signature cold wallets, were compromised, allowing funds to bypass cold storage and go directly to hot wallets during the breach. The incident coincided with TheDAO's crowdsale, raising concerns about the security of Ethereum-based tokens. Gatecoin plans to establish a portal for withdrawing DAO-related tokens in two weeks but did not specify a timeline for processing bitcoin and ether withdrawals.
May 18th, 2016 9:50:02 AM MDT	Homepage 404 Error	The present homepage is captured displaying a 404 error.
May 20th, 2016 1:36:34 AM MDT	Update Post Made	Gatecoin provides an update regarding the hot wallet breach investigation, fund withdrawals, and frequently asked questions (FAQ). The company expresses sincere apologies for the breach and appreciates the patience of clients and the community. Notably, client data remains safe, and the investigation is ongoing with cooperation from authorities. Progress has been made in fundraising efforts, aiming to reimburse stolen ETH and BTC funds. Gatecoin offers a bounty for the return of stolen funds and addresses various user concerns through the FAQ section, promising updates on withdrawal availability, DGD token safety, and exchange relaunch plans. CEO Aurélien Menant signs off with gratitude for continued patience and understanding from users.
May 28th, 2016	Withdrawal Platform Promised	The original Reddit announcement promised a withdrawal site would be made available on May 28th. The promised withdrawals were for remaining funds in BTC, DAO, DGD, REP, USD, EUR and HKD.
June 20th, 2016 2:07:35 AM MDT	Freezing Ethereum Wallets	A Reddit thread discusses freezing the hacker's ethereum wallet addresses, since they are known at the time.
September 15th, 2017	Gatecoin Banking Freeze	Gatecoin bank accounts are frozen without prior notice being provided. Details about the suspension were not provided in a phone call the exchange received from a Hang Seng Bank representative at the time.
November 20th, 2017 4:46:00 AM MST	CoinTelegraph Banking Freeze Report	CoinTelegraph reports on Gatecoin losing its banking services. Despite the surge in customer base and Bitcoin price rally, Gatecoin experienced a banking freeze in September without prior notice, forcing it to seek foreign banking support to continue operations. This incident highlights the challenges faced by cryptocurrency businesses in accessing banking services, with many relying on foreign banks to operate amidst domestic restrictions. Additionally, the resistance from Hong Kong's banking sector contrasts with its interest in blockchain technology, as evidenced by the participation of twenty local banks in a trade network with Singapore utilizing blockchain.
March 2nd, 2019 11:00:14 PM MST	Bloomberg Banking Services Issues	Using Gatecoin as an example, Bloomberg reports that crypto companies are facing challenges in accessing basic banking services from mainstream institutions like HSBC and JPMorgan Chase, despite attracting investments from large institutions. This issue persists globally, from New York to Hong Kong, hindering the growth and development of the digital-assets industry.
March 13th, 2019 12:26:16 PM MDT	Reddit Thread On Bankruptcy	A Reddit thread discusses a liquidation of Gatecoin. Users are frustrated and unable to access their funds. Some users suspect foul play, while others scramble to recover whatever they can. The situation sparks a mix of anger, desperation, and a few glimmers of hope for resolution.
March 14th, 2019 8:50:00 AM MDT	CoinTelegraph Article On Bankruptcy	CoinTelegraph reports that following ongoing banking problems and a tumultuous history marked by a major hack in May 2016, Hong Kong-based cryptocurrency exchange Gatecoin has been ordered to undergo compulsory liquidation. The exchange, which lost around $2 million in cryptocurrencies during the hack, announced its winding-up order on March 13, leading to an immediate cessation of operations. Gatecoin attributed its financial difficulties to issues with a Payment Service Provider (PSP), which it claimed failed to process transfers promptly, causing substantial losses and ultimately rendering the exchange unable to sustain its operations. Despite efforts to recover funds and mitigate losses, Gatecoin's struggles persisted, leading to its final liquidation.
March 14th, 2019 7:00:17 PM MDT	CoinDesk Article On Bankruptcy	CoinDesk reports that Hong Kong-based cryptocurrency exchange Gatecoin is set to cease operations and enter liquidation following a prolonged struggle to recover funds lost amid a dispute with a former payment services provider. The announcement, made via the company's website, cited ongoing banking issues since September 2018 as a primary reason for the shutdown. Despite efforts to resume operations with alternative processors and banks, Gatecoin faced insurmountable challenges, leading to a court order to wind up immediately. The exchange assured customers of its intent to distribute remaining assets to creditors but left uncertainties regarding reimbursement for those affected by the 2016 cyberattack that resulted in the loss of significant cryptocurrency holdings.
April 1st, 2019 2:45:11 AM MDT	TheNextWeb Article	TheNextWeb reports on Gatecoin has finally met its demise as liquidators take control of the company after facing a series of hacking incidents and banking troubles. Established in 2013 in Hong Kong, Gatecoin primarily focused on Bitcoin and Ethereum markets. However, in 2016, it suffered a significant loss of 185,000 ETH and 250 BTC due to a hack on its hot wallets, followed by banking disruptions in 2017 when its Hong Kong-based accounts were frozen. With the appointment of official liquidators, Gatecoin's journey comes to a definitive end, marking the closure of one of the pioneering exchanges in the cryptocurrency landscape.

Technical Details

The breach occurred due to a system alteration that allowed ETH and BTC deposits to bypass multi-signature cold storage and go directly to the hot wallet.

Breach Of Multi-Signature Systems

"We have previously communicated the fact that most clients’ crypto-asset funds are stored in multi-signature cold wallets. However, the malicious external party involved in this breach, managed to alter our system so that ETH deposit transfers by-passed the multi-sig cold storage and went directly to the hot wallet during the breach period. This means that losses of ETH funds exceed the 5% limit that we imposed on our hot wallets."

Wallets Used By Thief

The forensic examination identified several wallets and transactions which were involved in the theft:

• Wallet 0x1HnJry8tmN4BW5UFqYR8L4xWgtJZ7ghExU (Unmentioned)
  • Transaction 2f41b858712149df089c21d4e1c036e0a465335c5a29be38df8e945a51e4d809
• Wallet 0x04786aada9deea2150deab7b3b8911c309f5ed90
• Wallet 0xc062dceed93087c9112ff7b02d53e928e49cec09
• Wallet 0x1342a001544b8b7ae4a5d374e33114c66d78bd5f
  • Transaction 4a1b96b166de37860195af37b6396a0516b009536e0f332006ca61b4fab0cd08
• Wallet 0xd4914762f9bd566bd0882b71af5439c0476d2ff6
• Wallet 0x132ymu2ufMP3mDCo9qwKc173PV2Bbm4T2g (Unmentioned)
  • Transaction d494c7ca3a03f30c121b02f558b068d3597092454ad325bc320383f070d536bc
  • Transaction 90622fc9968b79c90a9ac26f11d13d8dd97ba5b7e9c103594873e6306f7357ea
  • Transaction 271c51ff2e6c84c565c94d79872a79d77726fccd47192b6c8f6745f7482e281a
  • Transaction 435e0cc79372eef5f43d8d81320940165ea1a0828adab3fdb9822a17caffaf2b

Total Amount Lost

On May 14th, Gatecoin announced that the losses were 15% of their client funds with a total of 185,000 ETH and 250 BTC reported. News sources such as CoinDesk and TheNextWeb reported the full loss amount.

Kyle Gibson reported only the amount at 250 bitcoin, with an estimated value of $2,500,000 USD. The theft of any Ethereum amount was not mentioned in his report.

Gatecoin stated that the lost cryptocurrency was "equivalent to USD 2 million" in their Reddit post. According to CoinTelegraph, the amount lost "during the hack" was "around $2 million in cryptocurrencies". CoinDesk estimated that amount as $2.14m at "press time".

Table Of Reported Theft Transactions

BTC	Transaction	Wallet
12	d494c7ca3a03f30c121b02f558b068d3597092454ad325bc320383f070d536bc	132ymu2ufMP3mDCo9qwKc173PV2Bbm4T2g
1	90622fc9968b79c90a9ac26f11d13d8dd97ba5b7e9c103594873e6306f7357ea	132ymu2ufMP3mDCo9qwKc173PV2Bbm4T2g
200	2f41b858712149df089c21d4e1c036e0a465335c5a29be38df8e945a51e4d809	1HnJry8tmN4BW5UFqYR8L4xWgtJZ7ghExU
45.6	4a1b96b166de37860195af37b6396a0516b009536e0f332006ca61b4fab0cd08	1342a001544b8b7ae4a5d374e33114c66d78bd5f
6.18	271c51ff2e6c84c565c94d79872a79d77726fccd47192b6c8f6745f7482e281a	132ymu2ufMP3mDCo9qwKc173PV2Bbm4T2g
2.12	435e0cc79372eef5f43d8d81320940165ea1a0828adab3fdb9822a17caffaf2b	132ymu2ufMP3mDCo9qwKc173PV2Bbm4T2g

The total amount lost has been estimated at $2,500,000 USD.

Immediate Reactions

Gatecoin promptly shut down its exchange and ports after suspecting a potential leak in its hot wallets and started an investigation. Gatecoin communicated with its users through various channels, including Slack and Twitter. CEO Aurélien Menant provided updates via Slack, informing users about the incident and the measures being taken to address it. Gatecoin provided updates on the status of its website through Twitter, informing users about the high risk of a leak in some of its hot wallets and the decision to take the website offline as a precautionary measure.

Forensic Security Examination

The platform initiated a full forensic investigation to identify the root cause of the issue and determine the extent of the breach. Gatecoin involved the services of third party Tehtri Security to conduct a forensic examination.

CoinDesk Article and Statement

CoinDesk was one of the first to report on the hack. Gatecoin issued a statement to CoinDesk, acknowledging the suspected leak in its hot wallets and the decision to shut down the exchange and ports as a precautionary measure. The statement outlined the ongoing forensic investigation and the exchange's commitment to minimizing further potential losses.

"News emerged last week of yet another security event in the digital currency exchange ecosystem, this time impacting a Hong Kong-based service involved in the sale of assets related to Ethereum-based decentralized autonomous organizations (DAOs). As reported on Friday, Gatecoin experienced a cyberattack on its hot wallets that resulted in the loss of funds. A new update from the exchange team indicated that as much as $2m was lost, confirming rumors that circulated soon after the hack became apparent."

Updates To Homepage

An update was provided on the Gatecoin homepage. It highlighted the loss of 15% of its crypto-asset deposits, totaling USD 2 million in Ethereum and Bitcoin, between May 9 and May 12, 2016. This breach was attributed to a system alteration that allowed deposits to bypass multi-signature cold storage and go directly to the hot wallet. In response, Gatecoin suspended its services, initiated a forensic investigation with Tehtri Security, and identified the compromised wallet addresses and Bitcoin transactions. To mitigate the impact on users, Gatecoin plans to release a bespoke platform for fund withdrawals and is working to raise additional funding to cover losses and reimburse affected customers. They express gratitude for the community's support and pledge to provide updates through various communication channels. The homepage later appeared to be offline with a 404 error.

Official Statement On Reddit

On May 14th, a day after noticing the suspicious transactions and shutting down their services, Gatecoin issued a public statement through Reddit.

The Gatecoin team greatly appreciates the patience of all users and stakeholders while we work with Tehtri Security to confirm all of the details related to the breach and ensure that our systems can be moved to a new, clean, thoroughly tested, and monitored infrastructure before services can resume.

We sincerely apologize for all the concern experienced by our clients and for the inconvenience caused while clients wait for their fund withdrawals to be processed. Gatecoin would also like to express our gratitude to the community of exchanges that have very kindly volunteered to help identify the parties responsible for the stolen funds.

Ultimate Outcome

Gatecoin experienced significant banking disruptions in 2017, and ultimately entered bankruptcy in 2019. The exchange is remembered in various historical records.

Banking Disruptions in 2017

Gatecoin experienced banking disruptions in September 2017 when its Hong Kong-based bank accounts at Hang Seng Bank were frozen without any prior notice. The bank representative who phoned with the news was not able to provide details about the suspension at the time. The exchange subsequently moved to use a foreign bank based in Singapore.

Exchange Enters Bankruptcy

Hong Kong-based cryptocurrency exchange Gatecoin was reportedly ordered to undergo compulsory liquidation on March 13th, 2019, although the court issuing the order was not specified. The exchange announced its winding-up order on March 13, leading to an immediate cessation of operations. Gatecoin attributed its financial difficulties to issues with a Payment Service Provider (PSP), which it claimed failed to process transfers promptly, causing substantial losses and ultimately rendering the exchange unable to sustain its operations. TheNextWeb reported on April 1st that Gatecoin had finally met its demise as liquidators take control of the company after facing a series of hacking incidents and banking troubles. Despite efforts to recover funds and mitigate losses, Gatecoin's struggles persisted, leading to its final liquidation. With the appointment of official liquidators, Gatecoin's journey comes to a definitive end, marking the closure of one of the pioneering exchanges in the cryptocurrency landscape.

CoinDesk reports that Hong Kong-based cryptocurrency exchange Gatecoin is set to cease operations and enter liquidation following a prolonged struggle to recover funds lost amid a dispute with a former payment services provider. The announcement, made via the company's website, cited ongoing banking issues since September 2018 as a primary reason for the shutdown. Despite efforts to resume operations with alternative processors and banks, Gatecoin faced insurmountable challenges, leading to a court order to wind up immediately. The exchange assured customers of its intent to distribute remaining assets to creditors but left uncertainties regarding reimbursement for those affected by the 2016 cyberattack that resulted in the loss of significant cryptocurrency holdings.

Inclusion On Hack Lists

The attack was included on lists put together by Kyle Gibson, BitcoinExchangeGuide.com, and SlowMist.

Total Amount Recovered

Gatecoin reassured users from the start that it would seek to refund customers following the loss. While the CEO initially indicated uncertainties regarding the exact amount of funds taken, Gatecoin affirmed its intention to refund affected users.

There do not appear to have been any funds recovered in this case.

Ongoing Developments

The Gatecoin platform declared bankruptcy.

Individual Prevention Policies

When using any third party custodial platform (such as for trading), it is important to verify that the platform has a full backing of all assets, and that assets have been secured in a proper multi-signature wallet held by several trusted and trained individuals. If this can't be validated, then users should avoid using that platform. Unfortunately, most centralized platforms today still do not provide the level of transparency and third party validation which would be necessary to ensure that assets have been kept secure and properly backed. Therefore, the most effective strategy at present remains to learn proper self custody practices and avoid using any third party custodial platforms whenever possible.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

Work with other industry platforms to set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.