Security Audit for a Family Office: A Crypto Checklist

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. A security audit for a family office tests every path to its crypto: custody and key ceremonies, signer devices, people, email and phone takeover, physical risk, vendors and incident plans. It ends with a ranked list of fixes.

Watch: Security Audit for a Family Office: A Crypto Checklist 1:45

Video transcript

Family offices are already targets. An audit tests every path to the family's crypto and ranks the fixes.

In Deloitte's 2024 report, 43 percent of family offices had suffered a cyberattack in the previous 12 to 24 months.

The audit reaches past the office into households, covering custody, signer devices, people, email and phone, physical exposure, vendors and incident plans.

Then hold each wallet and custodian to the Security Alliance goal: no single coerced person can drain the reserves.

Use three of five signers or more for material moves, keep cold keys out of homes, and cap hot wallets. Heirs should recover access with no one holding a full key.

Email is the usual way in. Deloitte found 93 percent of offices hit by an attack had faced phishing. Protect accounts with hardware security keys, not SMS.

Physical attacks on crypto holders are rising, 170 in 2025, up from 106, by Guardian's count of Jameson Lopp's list. Scrub home addresses and keep a give-up wallet.

Deloitte found 31 percent had no incident response plan. Plan for a SIM swap, a lost device, coercion and a drained wallet, then rehearse quarterly.

You finish with an inventory, a threat model, findings ranked by risk, and a fix list with owners, then a retest.

Guardian's OpSec audit maps every path to your funds. Read the full checklist, or talk to Guardian at guardian.security.

Family offices are already targets. In Deloitte's 2024 Family Office Cybersecurity Report, 43% had suffered a cyberattack in the previous 12 to 24 months, and 25% three or more.

Digital assets raise the stakes. Transfers are hard to reverse, and the people who hold keys can be found and pressured.

This checklist covers what to test and what to receive. Our crypto OpSec baseline covers the team side.

What the Audit Covers

A family office audit reaches further than a company's. The principals, their households and their advisors are all part of the attack surface.

Cover eight areas:

Custody: where assets sit and who can move them.
Key ceremonies: how keys were made, split and stored.
Signer devices and travel.
People: principals, family, staff and advisors.
Email and phone accounts that reset everything else.
Physical exposure of principals and homes.
Vendors with access to data or approvals.
Incident and succession plans.

Custody and Key Ceremonies

Start with an inventory. List every wallet, exchange account and custodian, the balance it holds and who can approve a transfer.

Then hold each one to the Security Alliance (SEAL) goal: "no single coerced individual can drain strategic reserves under pressure."

Custody checks

Record the model for each holding: custodian, multisig, MPC or a single hardware wallet.
Flag any single key, device or person that can move material value.
For multisig, read owners and threshold onchain and compare them with the design.
Use at least 3-of-5 or 4-of-7 signers for material moves, as SEAL suggests.
Keep cold keys in bank vaults or secure facilities, never at home or the office.
Cap hot wallets; SEAL suggests daily limits under $10,000.
Confirm departed staff and advisors hold no keys or shares.

Key ceremonies

Ask for the record of each key ceremony: the script, attendees, devices, and addresses checked by a second person.

Our key ceremony guide lists the full evidence.

Succession

Then test the hardest case: a principal dies or cannot act. Heirs or trustees should recover access under a documented plan, with no one ever holding a full key.

People, Devices and Travel

People

List everyone who can approve, sign, see balances or reach a principal. SEAL's family safety guidance names children, drivers and assistants among the people to protect and brief.

Who knows what the family holds, and where the keys are?
Is there a joiner and leaver process for staff and advisors?
Do family members know to say nothing and text a safe word to an emergency contact?
Can one person move more than 1% to 5% of treasury without a second approver? SEAL's checklist says no one should.

Signer devices

SEAL says multisig operations "must be performed on devices dedicated only to these transactions and verification tools."

Give each signer a dedicated signing device, used for nothing else.
Reach transaction requests through bookmarks, never through links in messages.

Travel

SEAL's travel and family safety rules:

Never bring written seed phrases.
Carry hardware wallets and security keys in your carry-on.
For high-risk trips, disable biometrics and use a PIN.
No wallet signing during trips; share photos after you return.

Email and Phone Takeover

Email is the usual way in. Deloitte found that 93% of family offices hit by an attack had faced phishing.

Phone numbers come next. The FBI received 1,611 SIM swap complaints in 2021, with more than $68 million in adjusted losses.

Put two hardware security keys on every critical account, stored apart.
Turn off SMS as a recovery or second factor wherever the service allows.
Check that no recovery path depends on a phone number.
Use a separate email and phone for anything that controls assets.
Confirm every transfer request by calling back a known number.

Physical Risk

Wrench attacks skip technology and target people. Jameson Lopp's public list records 170 physical attacks on crypto holders in 2025, up from 106 in 2024, by our count.

In January 2025, Ledger co-founder David Balland and his partner were kidnapped from his home in France, AFP reported. Police freed both.

SEAL's coercion framework recommends:

Scrub home addresses, vehicle plates, routines and geotagged photos from public profiles.
Hold high-value assets through business entities.
Fit discreet panic buttons at home and in vehicles, linked to a monitoring service.
Keep a small give-up wallet, its duress PIN wired to a silent alert.
Train drivers and assistants to vary routes and report surveillance.

Our wrench attack guide covers the full set.

Vendors and Advisors

Vendors hold the data attackers want. In May 2025, Coinbase said a threat actor paid contractors or employees in support roles outside the US for customer data.

The data included addresses and balance snapshots.

Yet Deloitte found 68% of family offices had not adopted know-your-vendor protocols.

For each custodian, exchange, IT provider, accountant, lawyer and travel agent, check:

What it holds: addresses, balances, travel plans, ID copies.
Who at the vendor can see it, and behind what login protection.
Who can instruct a transfer, and how the vendor verifies it.
Withdrawal allowlists and approval rules at each custodian and exchange.
That access ends the day the relationship does.

Read each provider's assurance reports for what they cover and leave out. Our guide to audits, attestations and assurance explains which report proves what.

Incident Plans

Many offices are underprepared. Deloitte found 31% had no cyber incident response plan, and only 26% called theirs robust.

Write a plan for each of these:

A phished email account or a SIM swap.
A lost or stolen signing device.
A signer who leaves on bad terms.
A coercion attempt, which SEAL says to treat as a life-safety emergency first.
A drained wallet: who calls the custodian, the exchanges and SEAL 911.

After an incident, SEAL advises rotating signers, moving funds out of exposed wallets and engaging law enforcement through counsel.

Then rehearse. SEAL's checklist calls for quarterly tabletop exercises on coercion, kidnapping and insider threats.

Deliverables and Scope

At the end, you should hold:

An inventory of every holding and who can move it.
A threat model of every path to the assets, onchain and off.
Findings ranked by what they put at risk.
A fix list with owners and dates, then a retest.

Scope, and so cost, grows with the number of custodians, wallets, signers, locations, household members, staff and vendors.

How Guardian Helps

Guardian's OpSec audit maps every path to your funds and reviews how your team actually holds, approves and changes them.

It covers the threat model, custody and key ceremony, privileged roles, multisig signing, access and change control, and people and response.

You receive the threat model and a ranked list of changes, each tied to the path it closes.

Managed Security keeps that threat model current and reviews every multisig transaction before it is signed. Its operational security coverage spans nine domains and 118 controls.

Frequently Asked Questions

What does a security audit for a family office include?

A review of every path to the family's crypto. It covers custody, key ceremonies, signer devices, people, email and phone accounts, physical exposure, vendors and incident plans, and ends with a ranked list of fixes.

How is it different from a company security audit?

It covers households, not just an office. Family members, drivers and assistants can leak information or be pressured. Heirs must also be able to recover access without one person holding a full key.

Does multisig protect a family office from a wrench attack?

It limits what an attacker can take. If material moves need several signers in different places, coercing one person cannot drain the reserves. It does not protect the person, so add personal and family safety controls.

How often should a family office test its security?

SEAL's coercion checklist calls for quarterly tabletop exercises on coercion, kidnapping and insider threats. Review custody, signers and vendor access whenever someone joins or leaves, a device is lost or a custodian changes.

Sources

Find every path to your family's assets

Guardian maps the keys, signers and people around your funds and ranks the changes that close each path.

Talk to Guardian Explore Managed Security