Crypto OpSec for Founders and Teams: A Practical Baseline

By the Guardian team Updated November 2026 6 min read

Quick answer. Give anyone near keys a managed, encrypted device and two hardware keys per critical account, with no SMS recovery. Verify every hire, recruiter and meeting invite, use encrypted team chat, and keep quiet about who holds keys.

Watch: Crypto OpSec for Founders and Teams: A Practical Baseline 1:42

Video transcript

OpSec starts on day one, long before a crypto team can afford a security hire.

TRM Labs says North Korea accounts for 85 percent of crypto hack value in 2026 so far. Only 13 of its 100 incidents were code exploits.

The usual opening is a fake recruiter with a coding test. Its malware steals keys and tokens that lead to signing systems.

One laptop can be enough. The Bybit theft, about 1.5 billion dollars by the FBI's count, traced back to a developer's laptop.

Put signers, leaders and developers with production access on managed, encrypted devices. Give signers a clean signing device, and keep seed phrases off daily devices.

CISA calls FIDO the only widely available phishing-resistant authentication. Use two hardware keys per critical account, with no SMS fallback.

Hiring attacks run both ways. Keep recruiter coding tests off company devices, verify candidates live on video, and never make a remote hire a multisig signer.

Some attacks skip cryptography, like the 2025 kidnapping of Ledger co-founder David Balland. Never travel with seed phrases, and keep quiet about who holds keys.

No team does it all at once. Over four weeks, start with accounts, then devices, people and your public footprint, ending with a tabletop exercise.

Guardian's OpSec Audit maps every path to your funds and ranks the changes. Read the full article, or talk to Guardian.

North Korea accounts for 85% of crypto hack value in 2026 so far, TRM Labs says. Only 13 of the 100 incidents TRM attributes to it were code exploits.

TRM describes the usual opening: "A fake recruiter or investor approaches a target and convinces them to download a coding test." The test delivers malware that yields SSH keys, session cookies and cloud tokens, which lead to the signing systems.

So OpSec starts on day one, long before a team can afford a security hire. This baseline draws on the Security Alliance (SEAL) frameworks, FBI and CISA guidance, and public incidents.

Devices and Endpoints

Start with the machines. SEAL calls unmanaged personal devices "a primary vector for credential theft and lateral movement".

One laptop can be enough. Safe{Wallet}'s investigators traced the Bybit theft to a developer's laptop, compromised in February 2025 through a downloaded Docker project.

The attackers then used hijacked AWS session tokens to get past MFA. The FBI puts the theft at about $1.5 billion.

SEAL matches device control to role risk:

Tier	Who gets it	What it gives you
Managed device	Signers, leadership, treasury, developers with production access	EDR, remote wipe, disk encryption, central logs
Virtual desktop	Global contractors	Sensitive work stays off the personal machine
Enterprise browser	General staff, short-term contractors	Extension allowlisting and isolated work sessions

The baseline for every device, from SEAL and the FBI:

Full disk encryption and automatic updates.
Screen lock after 5 minutes on computers and 30 seconds on phones.
A separate admin account, never admin rights for daily work.
For signers, a clean device used only for signing.
No wallet apps, seed phrases or seed screenshots on daily phones and laptops.
Code from outsiders runs only in a virtual machine on a non-company device.

Accounts and Hardware Keys

Next, logins. CISA calls FIDO/WebAuthn "the only widely available phishing-resistant authentication".

It rates SMS and voice codes as open to phishing, SS7 and SIM swap attacks, to be used only as a last resort. App codes are better, but a fake login page can still collect them.

SEAL's hardware key routine:

Buy two keys. Label one Primary and one Backup, and store them apart.
Register both on email, code host, registrar and DNS, cloud, custody and social accounts.
Turn off SMS fallback and keep recovery codes offline.
Test recovery before you need it.

Passkeys need care. SEAL warns that a passkey stored in a personal account with SMS recovery leaves you worse off, not better.

Keys stop phished logins, not stolen sessions. SEAL's rule for remote workers suits everyone: access tokens should expire "within hours, not weeks".

Separate personal and treasury risk

A cold recovery email on a different provider, never shared, used only on a secure device.
A dedicated email, SIM and device for anything that controls assets.
Root accounts kept cold, shared through an enterprise password manager, rotated when someone leaves.

Hiring and Fake Recruiters

Hiring attacks run both ways. Fake recruiters approach your team, and fake candidates apply to you.

Fake recruiters and investors

The FBI's red flags for North Korean approaches include:

Unexpected offers from prominent firms, with unrealistically high pay.
A "pre-employment test" that means running unfamiliar code.
Custom software for a simple video call.
Requests to move the conversation to another messaging app.

Make one rule absolute: no coding tests or shared projects on a company device.

Fake candidates

The FBI says North Korean IT workers have copied company code and extorted employers once discovered. Some used AI and face-swapping in video interviews.

In 2025, Kraken described advancing one such applicant on purpose. The applicant switched names on the first call, used remote Macs over a VPN, and struggled with live questions about their claimed city.

Verify identity live on video with the physical ID, and onboard in person where you can.
Check GitHub history, and look for phone numbers and emails reused across resumes.
Never make a remote hire a multisig signer, as SEAL advises.
Give package publishing rights only to fully vetted staff.

For the full program, see our insider threat template.

Communications and Meetings

Set up channels before you need them. SEAL recommends Signal as the primary signer channel, with a backup on another platform.

Signal: registration lock, a PIN, a hidden phone number and verified safety numbers.
Telegram: Two-Step Verification, a passkey and a hidden number. No end-to-end encryption by default.
Zoom: remote control off, browser joins, and no accessibility permissions on macOS.
Meeting links: never install "meeting software" or run a "fix" from an invite.

For how attackers turn these channels against signers, and how to verify a request, see social engineering attacks on multisig signers.

Travel and Physical Safety

Some attacks skip cryptography altogether. In January 2025, Ledger co-founder David Balland and his partner were kidnapped in France for a crypto ransom, AFP reported. Police freed both.

SEAL calls these wrench attacks, and assumes attackers use open-source research to find key-holders. Make yourself hard to find, and hard to profit from.

On the road

Never travel with seed phrases.
Carry only the primary hardware wallet, in your carry-on.
Know how to disable biometrics quickly, and use a PIN at borders.
Post trip photos after you return. Cover crypto stickers and skip the swag.

At home and at work

Remove your home address, family details and travel patterns from public sources.
Keep a small "give-up" wallet you can surrender, wired to a silent alert.
Require a second approver before anyone moves more than 1 to 5% of treasury.

A 30-Day Hardening Plan

No team does all of this at once. This order starts with accounts and devices, where the cases above began.

Week	Focus	Done when
1	Accounts	Two hardware keys on every critical account; SMS recovery off
2	Devices	Signers and leads on managed, encrypted devices; signing devices issued
3	People	Recruiter, meeting and hiring rules briefed; Signal contacts verified
4	Exposure	Public footprint cleaned; travel rules written; one tabletop run

Use a lost laptop for the first tabletop. SEAL suggests quarterly tabletops for coercion and insider scenarios.

How Guardian Helps

Guardian's OpSec Audit maps every path to your funds and reviews how your team actually holds, approves and changes them.

It covers custody and key ceremonies, privileged roles, multisig signing, access and change control, and people and response. You receive a threat model and a ranked list of changes, each tied to the path it closes.

For regulated programs, the Digital Asset Assurance Pilot assesses the operational security model: who approves what, and how joiners and leavers are handled.

Managed Security keeps that threat model current. Its operational security coverage spans nine domains and 118 controls, including keys, signers, secrets and devices.

Frequently Asked Questions

What is crypto OpSec?

Operational security for crypto teams: protecting the people, devices and accounts that can reach keys, funds and admin powers. SEAL frames it as a cycle: identify critical assets, analyze threats, assess weaknesses, weigh the risk and apply controls.

Is an authenticator app enough for crypto accounts?

Not for critical accounts. CISA rates app codes as open to phishing and calls FIDO/WebAuthn the only widely available phishing-resistant method. Put two hardware security keys on email, code host, registrar, cloud and custody accounts.

How do I spot a fake recruiter or job candidate?

The FBI flags unexpected offers with unrealistically high pay, tests that mean running unfamiliar code, and requests to switch messaging apps. Fake candidates change names, reuse contact details and struggle with live questions about where they claim to live.

Should crypto founders travel with a hardware wallet?

Only if needed. SEAL says to bring the primary hardware wallet alone, in your carry-on, and never to travel with seed phrases. Know how to disable biometrics quickly, and keep backups at home.

Sources

Find every path to your funds

Guardian's OpSec Audit maps the keys, signers and people around your funds and ranks the changes that close each path.

Talk to Guardian Explore the assurance pilot