Digital Asset Custody Risks

While some investors choose to self-custody their digital assets, this approach requires a strong understanding of the underlying technology, security controls and operational risks. For many investors, using a regulated institutional custodian can help reduce these complexities by providing multiple layers of security, governance and oversight.

Understanding common custody risks and adopting good security practices can help reduce the likelihood of financial loss.

How digital asset theft can occur

• Technology vulnerabilities
  Attackers exploit weaknesses in software, hardware or security controls to gain unauthorised access to systems or sensitive information.
• Compromised credentials
  Private keys, seed phrases or login credentials may be exposed, stolen or improperly protected, allowing attackers to access digital assets.
• Single points of failure
  Security arrangements that rely on a single device, individual or process may become vulnerable if that control is compromised.
• Social engineering
  Fraudsters impersonate trusted organisations or individuals to obtain sensitive information, credentials or account access.
• Unauthorised transactions
  Attackers use stolen credentials, compromised private keys or exploited vulnerabilities to initiate asset transfers without the owner's knowledge or consent.

Common warning signs:

• Requests for sensitive information
  Any request for passwords, authentication codes, private keys or wallet seed phrases should be treated as suspicious.
• Unverified communications
  Unexpected emails, messages or calls requesting urgent action should always be independently verified.
• Pressure and urgency
  Fraudsters often create a sense of urgency to encourage victims to act before verifying a request.
• Unexpected links or attachments
  Be cautious when opening links or downloading attachments from unsolicited communications.
• Unfamiliar email addresses
  A communication may appear legitimate but originate from an unfamiliar or suspicious email address.

What you should do:

Understand Your Custody Solution
Know how private keys are generated, stored and protected.

Verify Communications
Independently verify requests relating to your accounts, assets or transactions through trusted channels (e.g. those provided for in the contractual set up with your custody provider).

Review Sender Email Addresses
Check the sender's full email address rather than relying solely on the displayed name. You can do this by clicking on the email address to have it fully displayed.

Example

Displayed name: AMINA Support
Actual sender address: support@amina-security-help.com

A legitimate AMINA communication will come from an @aminagroup.com email address or an official AMINA subdomain (e.g., communication.aminagroup.com).

Use layered security
Choose solutions that incorporate multiple independent security controls.

Contact trusted sources
If something does not seem right, contact your Relationship Manager through a known and trusted communication channel that is approved for communications under your contractual relationship.

What you should NOT do:

Do not share sensitive credentials
Never disclose passwords, authentication codes, private keys or wallet seed phrases.

Do not act under pressure
Avoid taking action based on urgent requests without first verifying their legitimacy.

Do not rely on a single security control
No single device, application or process can eliminate all security risks.

Do not trust display names alone
Always review the underlying email address before responding to a communication.

Do not transfer assets without verification
Never transfer assets based solely on instructions received by email, phone call or message.

Remember, strong security comes from defence in depth, where multiple independent controls work together to reduce risk. While self-custody may be appropriate for experienced users who fully understand the associated risks, many investors choose to rely on regulated institutional custody solutions to help safeguard their digital assets.

Stay vigilant and stay safe with AMINA.

_{This article has been prepared by AMINA Bank AG (“AMINA”) in Switzerland. AMINA is a Swiss licensed bank and securities dealer with its head office and legal domicile in Switzerland. It is authorized and regulated by the Swiss Financial Market Supervisory Authority (“FINMA”). This document is published solely for educational purposes; it is not an advertisement nor a solicitation or an offer to buy or sell any financial investment or to participate in any particular investment strategy. This article is for publication only as permitted by applicable law. It is not directed to, or intended for distribution to or use by, any person or entity who is a citizen or resident of or located in any locality, state, country or other jurisdiction where such distribution, publication, availability or use would be contrary to law or regulation or would subject AMINA to any registration or licensing requirement within such jurisdiction. No representation or warranty, either express or implied, is provided in relation to the accuracy, completeness or reliability of the information contained in this document, except with respect to information concerning AMINA. The information is intended as general information. AMINA does not undertake to update or keep current this information. This article may not be reproduced, or copies circulated without prior authority of AMINA. AMINA accepts no liability whatsoever for any claims or lawsuits from any third parties arising from the use or distribution of this article.}