Digital asset security in practice: controls, governance and incident response

Max Grabner, Head of Product at Range, joined Cregis MicUp Vol. 21, a panel on digital asset security in practice, on X Spaces on October 21, 2026. Bojun Li, Deputy Marketing Director at Cregis, hosted the panel with Dmytro Matviiv, CEO of HackenProof, and Bobby from GoPlus Security. Listen to the full recording on X or read the announcement from Cregis.

The discussion focused on the operational decisions around each transaction: who prepares it, who can change it, who approves it and what happens when something goes wrong. Across hidden risks, incident response and AI, the speakers returned to failures of control and process.

Range addresses those decisions as an end-to-end financial control platform for regulated companies using stablecoins, digital assets and fiat. We start with your regulatory and reporting requirements, turn them into operational controls on each transaction and orchestrate the risk and compliance providers you already use. Monitoring, reconciliation and reporting run from the same record, including alerts on the smart contracts and multisigs that hold your funds.

Test the security you assume you have

Max's diagnosis was that the software is often not the weak point. Leave retail users aside, he said, and serious crypto businesses still run treasuries and governance contracts without adequate controls, alerting or monitoring. "People just don't take it seriously." When teams adopt multisigs without governing or monitoring how transactions are created, he said, "you can't be surprised when things go wrong."

He pointed to traditional finance's understanding of transaction governance. Institutions may not understand blockchains or care whether a wallet uses an HSM, MPC or a multisig. They do understand the questions that precede a transaction: "Before we do a transaction, who has to sign? Who has to approve? What should that look like?" Many DeFi protocols keep deferring that work even once their TVL runs to nine figures, Max said: "We're gonna think about this later."

For Dmytro Matviiv, the biggest hidden risk is the gap between what a company believes is secure and what it has tested. Looking at recent hacks, he said, "we see operational security as the biggest issue." An audit does not tell you who manages your keys, where they are stored or who made your hardware. He described someone he knows losing money after attackers copied his SIM card and used a separate Telegram account to substitute their own payment details. "So there might be some gap where you even don't expect to have it."

Bobby from GoPlus Security identified the risk as "trusting a process that nobody checks again." Before a transaction reaches a protected signer, someone has prepared the payment, chosen the address and approved the request. The private key, he said, "is only just one part of protecting the funds." An audit also describes code at the time it was checked. Bobby urged teams to examine "who can change your payment?", which outside systems they trust and when they last checked that those systems are still safe to use.

Define access and approvals for each transaction type

Max's starting point was basic: use something better than an in-browser wallet and give multisig signers hardware wallets. The advice is familiar, he acknowledged, but "the place to start is to actually do it." Then define the people and approvals required for each use case, such as a mint or a redemption.

Regulation helps make those controls explicit. MiCA, Max said, requires a business to "have client and own fund segregation and to prove that out". He tied that requirement to its purpose: "the reason a lot of it exists is exactly to protect end clients when things go wrong." Those controls also need ongoing assurance. Much like a SOC 2 Type II report, Max said, "you have to have ongoing controls and assurances that you're actually doing these things." He called it "the boring truth of this subject sometimes."

Dmytro borrowed from the way banks rank risk. Identify the function whose failure would cost the most in money and reputation, then focus on "the most critical part of your business". Check whether you could recover from its loss and still serve clients the next day. If one person controls access to critical infrastructure, divide that risk across several parties. Rotate keys and passwords, since an unchanged password can leak through an unprotected website or Wi-Fi network.

Bobby proposed tracing one payment from request to transfer. Who can create it, change the recipient or approve it? How much could one mistake put at risk? Use those answers to limit access and the amount exposed, and "keep daily operations funds separated from long term reserves." Give each person and system only the access it needs. Verify a supplier's wallet address change through a separate channel, Bobby said: "we have to confirm it with a known contact."

Prepare for containment and communication before an incident

Max emphasized preparation, then honest communication with clients and customers once an incident occurs. In his experience, that openness has produced the best results. Companies often approach Range after a hack, and he encouraged teams to seek help across the ecosystem to trace funds and alert potential off-ramps. His advice: "quite frankly, just try not to get there and do stuff in advance."

Some response options depend on the contract's design. An audit should already have examined pause functionality, perhaps with a 24-hour back-off. Without those controls, Max said, teams have few options when something goes wrong. Building and launching with best practices is essential: "if you don't do that, you're not serious and you're asking for trouble."

For teams without a recovery plan, Dmytro recommended contacting SEAL 911 as soon as possible to connect with providers who help find attackers. Containment remains urgent after the initial loss: "attackers can be inside of your infrastructure", he warned, and a second attack can follow within days or weeks. He also urged teams to "try to be transparent with your community" as soon as information is available, rather than waiting a day or two for marketing or legal to polish a statement.

Bobby's containment advice was specific: stop affected systems from moving more funds, remove unsafe access and preserve logs and transaction records. If funds must move, verify both the destination and the transfer process first. The environment may still be compromised, and the address an app displays may not be the real one. Updates should state what is known, what is still being checked, what users should do and when they will hear more. His caution for that stage: "don't promise the funds will be recovered" while the cause or full impact remains unknown.

Know what an AI agent can access before it moves funds

Dmytro expects agentic payments to grow quickly. His advice was to limit the financial exposure: "allow AI to take risk that you can cover from your pocket." Before an agent moves funds, check whether it understands the source and destination wallets and whether its access extends across your infrastructure or stays within an isolated scope.

Bobby described how AI can review more code and repeat checks more frequently, the approach GoPlus Security takes with DeepScan. People still need to understand the business context, assess important findings and decide on fixes.

The same access questions apply before a transaction reaches the signer. As Bobby warned, "AI can really influence a transfer without holding a key", so define separately what an AI system can read, change and execute, and check its important actions.

Build transaction governance before you need it

The controls that limit an incident are set before it: who can create, change, approve and sign a transaction. Range turns those decisions into pre-execution controls for regulated companies, with multisig monitoring and alerting on the smart contracts that hold your funds, and an audit trail for every decision. To map that against your own treasury, talk to our team.