Insider Threat Programs for Crypto Exchanges: A Template

By the Guardian team Updated November 2026 6 min read

Quick answer. Treat support agents as privileged users. Name an owner and tier access by what each role can reach. Require dual control on sensitive actions, watch for bulk lookups, vet vendor staff, and cut access when people leave.

Watch: Insider Threat Programs for Crypto Exchanges: A Template 1:39

Video transcript

At Coinbase and Kraken, insiders misused legitimate support access, and extortion followed. Here is a program template built from both.

Coinbase said a threat actor appeared to have paid support staff for customer data. Its preliminary cost estimate was about 180 million to 400 million dollars.

Kraken disclosed two cases of support employees improperly accessing customer data, news outlets reported. The lesson: your support agents are privileged users.

Tier every role by what it can see or move. Signing needs a quorum, and vendor staff get the same controls as employees.

For support tools, mask data by default, bind every lookup to an open ticket, and cap lookups per agent per shift.

Anything that moves funds or changes account control needs a second person from a different team, like large withdrawals or two-factor resets.

Monitor behavior, not just logins. Alert on lookup volume, lookups without a ticket, remote access tools and uploads to personal cloud.

When someone leaves, cut access and tokens the same day, remove them from signer sets and rotate keys. Then review their last 90 days.

Write it down with an owner and review cycle for each line. Decide your extortion stance in advance. Coinbase and Kraken both refused to pay.

Guardian's OpSec audit maps every path to your funds, joiners and leavers included. Read the full template below, or talk to Guardian.

In May 2025, Coinbase disclosed that a threat actor appeared to have paid support staff to collect customer data.

In April 2026, Kraken disclosed two cases of support employees improperly accessing customer data, news outlets reported. Both were followed by extortion demands.

This guide turns both cases into a program template.

Insider Risk at Exchanges

CERT at Carnegie Mellon defines insider threat as the potential for someone who has or had authorized access to use it, maliciously or unintentionally, to harm the organization.

At an exchange, insiders can reach three things worth taking: customer data, account actions and signing keys.

Coinbase, May 2025

Coinbase's SEC Form 8-K says that on May 11, 2025, a threat actor emailed claiming to hold customer data and demanding money.

The filing says the actor appears to have obtained it by "paying multiple contractors or employees working in support roles outside the United States."

It included names, contact details, masked Social Security and bank numbers, ID images and transaction history. Passwords and private keys were not compromised.

Coinbase said its monitoring had caught the access in the previous months, and that it fired those involved. Its preliminary cost estimate was about $180 million to $400 million.

CNBC reported that Coinbase refused to pay a $20 million ransom demand. A filing with Maine's attorney general showed at least 69,461 affected customers, TechCrunch reported.

Kraken, April 2026

On April 13, 2026, Kraken's chief security officer, Nick Percoco, said on X that a criminal group was extorting the exchange, American Banker and BleepingComputer reported.

In two separate cases, a support employee had improperly accessed limited customer data. About 2,000 client accounts, roughly 0.02% of users, were potentially viewed.

The first case followed a February 2025 tip about a video showing access to Kraken's client support systems.

Kraken revoked access, notified affected clients and refused to pay. Percoco said "funds were never at risk."

What the cases share

In both, insiders misused legitimate access to support tooling, and extortion followed. At Coinbase, the data was also used to trick customers.

Access Tiers and Least Privilege

Tier every role by what it can see or move, support agents included.

Tier	Example roles	What it reaches	Minimum controls
0: Signing	Key holders, signing service operators	Wallet keys and withdrawal approval	Quorum, dedicated devices, no single person
1: Production	SRE and platform engineers	Cloud, databases, deploy pipeline	Just-in-time access, approval, session logs
2: Account actions	Senior support, compliance	Email, 2FA and address changes; holds	Dual control, reason code, customer notice
3: Customer data	Frontline support, including vendors	Masked profiles and ticket history	Masked by default, ticket-bound, rate limits
4: Corporate	Everyone	Email, chat, documents	SSO, MFA, managed devices

NYDFS Part 500 sets a floor for covered entities. Section 500.7 requires them, based on their risk assessment, to limit privileged accounts, review all user access privileges at least annually and promptly terminate access following departures.

For support tooling, add three rules.

Mask by default. Unmask one field, for one ticket, with a logged reason.
Bind lookups to tickets. Agents open an account only through an open case for that customer.
Cap volume. Set a lookup limit per agent per shift, and alert above it.

Dual Control on Sensitive Actions

Any action that moves funds or changes who controls an account needs a second person, from a different team. CERT's practice 15 is "Enforce Separation of Duties and Least Privilege."

Withdrawals above a threshold, or to a new address
Changes to withdrawal address allowlists
Email, phone or 2FA resets, and lifting security holds
Bulk exports of customer data
Grants of Tier 0 or Tier 1 access
Changes to wallet thresholds or signing policy
Production deployments

For signing flows, see our signing interface guide and the key management checklist.

Monitoring and Detection

Monitor behavior, not just logins. CERT recommends monitoring workforce actions, correlating data sources and setting a baseline of normal behavior.

Signal	Example
Lookup volume	An agent opens 300 accounts in one shift
Lookups without a ticket	Accounts opened with no matching case
Screen capture	Recording software on a support machine
Remote access tools	Remote desktop software you did not install
Impossible logins	One account, many IPs and countries, minutes apart
Data leaving	Uploads to personal cloud or private repositories
Off-hours privilege	Production access outside a change window

Route every alert to a named responder. Have legal review the monitoring, and tell staff what is watched.

Hiring, Vendors and Offboarding

Hiring

In May 2025, Kraken described identifying a North Korean applicant for an engineering role. Red flags included a changed name, an ID that appeared altered, remote Mac desktops and a VPN.

The FBI says North Korean IT workers have copied company code and extorted employers. Its January 2025 alert recommends:

Verifying identity at interview, onboarding and during employment
Checking for phone numbers and emails reused across applicants
Auditing the hiring checks of staffing firms
Hiring and onboarding in person where possible

Vendor staff

Coinbase's insiders were "contractors or employees" in support roles outside the US. The same filing says Coinbase was opening a new US support hub.

Give vendor staff named accounts in your identity provider, never shared logins.
Start them in Tier 3, with the same masking, caps and monitoring.
Write background checks, monitoring, breach notice and audit rights into the contract.

Our vendor due diligence questionnaire covers what to ask before you sign.

Offboarding

CERT's practice 20 is a comprehensive termination procedure. At an exchange, it should cover:

Same-day removal from the identity provider, VPN and hardware keys
Revoked API keys, tokens and sessions
Removal from every signer set, then key or share rotation
Rotation of shared secrets they could see
A review of their last 90 days of access

The Program Template

Copy this into your policy set, with an owner for each line.

Component	What to write down	Review
Owner	A named lead, with HR, legal, compliance and support	Annually
Critical assets	Keys, customer data, account actions, production, source code	Annually
Role map	Every staff and vendor role, mapped to a tier	Quarterly
Access rules	Masking, ticket binding, just-in-time admin	Quarterly
Dual control	The actions above, with thresholds	Quarterly
Monitoring	Each signal, its threshold and its responder	Monthly
Hiring and vendors	Identity checks, contract terms, audit rights	Annually
Offboarding	The same-day checklist, with signer rotation	Every departure
Response	Contain, preserve evidence, notify, call law enforcement	Twice a year
Training	Insider awareness and a confidential reporting channel	Annually

Rehearse it. Run one tabletop where a support agent is offered a bribe, and one where a signer leaves on bad terms.

Decide your extortion stance in advance. Coinbase and Kraken both refused to pay.

How Guardian Helps

Guardian's OpSec audit maps every path to your funds and reviews how your team actually holds, approves and changes them, including how joiners and leavers are handled.

Managed Security keeps that threat model current. Its security operations team reviews every multisig transaction before it is signed.

Its evidence includes access reviews exported from your identity provider and cloud accounts. Offchain, Sentry watches your domains, DNS, certificates, cloud and code host.

Frequently Asked Questions

What is an insider threat at a crypto exchange?

CERT defines insider threat as the potential for someone who has or had authorized access to use it, maliciously or unintentionally, to harm the organization. At an exchange, that means misuse of customer data, account actions or signing keys.

What happened in the Coinbase insider breach?

Coinbase's May 2025 SEC filing says a threat actor appears to have paid support contractors or employees outside the US to collect customer data, then demanded money. Coinbase preliminarily estimated costs of about $180 million to $400 million.

What did Kraken disclose in April 2026?

Per American Banker and BleepingComputer, two Kraken support employees improperly accessed limited customer data in separate cases, and about 2,000 accounts were potentially viewed. Kraken refused to pay a criminal group extorting it and said funds were never at risk.

How often should an exchange review access?

NYDFS Part 500 requires covered entities to review all user access privileges at least annually and to terminate access promptly after departures. We suggest quarterly reviews for signing, production and account-action roles.

Sources

Find out who can reach your funds

Guardian maps every path to your funds, reviews who can walk it, and keeps watch with a security operations team.

Talk to Guardian Explore Managed Security