Executive Summary
A leading bank in a G20 economy with a large retail and digital customer base expanded into regulated digital-asset services through a crypto exchange and an institutional custody platform. The move extended the bank’s operating model beyond traditional financial applications into services where digital-asset movement is irreversible and a security failure can create direct financial loss, service disruption, and lasting reputational damage.
The bank selected CertiK as a long-term Web3 security partner rather than engaging a provider for a single penetration test. CertiK advised on security architecture and threat models, independently assessed the exchange and custody businesses, validated protected custody operations on site, and remained involved through remediation and product-security decisions. The collaboration helped the bank establish a stronger security foundation for both businesses and a repeatable approach for future releases and operational changes.
Key Challenges
Extending Banking Security Practices to Web3 and Digital-Asset Operations
The bank already had mature security practices for conventional banking applications, infrastructure, and payment services. Digital-asset exchange and custody introduced a different risk model: asset transfers can be irreversible, business activity depends on blockchain networks, and critical custody functions rely on specialized technology and operational controls that are not normally present in traditional banking environments.
Managing Cross-System Risk Across Exchange, Custody, and Banking Infrastructure
The bank was developing two digital-asset businesses in parallel: a crypto exchange and a custody platform. The services were interconnected through customer workflows, internal approval processes, asset movements, and integrations with existing banking systems. Their security boundaries therefore could not be evaluated effectively in isolation.
A weakness in one part of this environment could create downstream risk to customer assets, financial processes, or critical services. The bank needed security risks to be evaluated across complete customer and operational journeys, including dependencies and handoffs between systems, rather than solely within individual applications or infrastructure components.
Maintaining Security Continuity as the Platforms Evolved
The security profile of a digital-asset platform changes as new releases, integrations, operating procedures, and attack techniques emerge. An assessment performed at a single point in time could identify risks within the reviewed version, but it would not by itself address subsequent architectural or operational changes.
The bank therefore needed a security approach that preserved knowledge of the platforms' architecture and operating model over time. Continued access to Web3 security expertise was important for remediation decisions, subsequent changes, and new security questions as the exchange and custody businesses matured.
CertiK’s Solution
Providing Web3 Security Guidance from Architecture Through Implementation
CertiK worked with the bank and relevant technology providers to understand how customer activity, internal approvals, and digital-asset operations moved across the exchange, custody, and existing banking systems. This allowed the team to identify where trust and responsibility changed hands, clarify the security assumptions behind the operating model, and focus the review on the business scenarios with the greatest financial and operational impact.
CertiK then translated Web3-specific risks into practical security priorities for the bank. Threat modeling examines how attackers or insiders might interfere with high-risk asset operations, misuse privileged access, exploit weaknesses between connected services, or undermine recovery and governance processes. The resulting guidance supported both immediate assessment activities and broader product-security decisions. CertiK also helped align responsibilities across internal teams and vendors so that security requirements remained consistent from architecture discussions through implementation and deployment.
Conducting an End-to-End Assessment of Exchange and Custody Operations
CertiK assessed the exchange as a complete business service rather than a collection of separate applications. Penetration testing followed realistic customer and administrator journeys and focused on whether weaknesses in identity, permissions, business logic, or connected services could affect customer accounts, financial accuracy, or critical operations. Where appropriate, dynamic testing was supplemented by manual analysis and source-assisted review to determine the practical impact of identified weaknesses.
For custody, CertiK evaluated whether the HSM-backed platform and its operating model provided the expected level of protection for high-risk asset activities. The review examined the security of core custody workflows, the bank’s integration with the platform, governance and approval controls, and the operational assumptions required to preserve the HSM-based trust model. CertiK also conducted an on-site assessment of protected data-center and cold-vault operations to compare the intended design with actual deployment and operating practice.
Combining the two workstreams allowed CertiK to assess how the exchange depended on custody and where additional safeguards were required at business handoffs. This provided broader assurance than isolated application tests while avoiding unnecessary repetition between the exchange and custody reviews.
Supporting Remediation, Retesting, and Ongoing Security Decisions
CertiK maintained direct communication with the bank throughout the engagement. The team answered technical questions, discussed practical remediation options, reviewed relevant changes, and validated applicable updates.
Beyond the formal assessment scope, CertiK provided ad-hoc consultation on Web3 attack patterns, custody security, and lessons from real-world incidents. This gave the bank access to security expertise when product or operational questions arose rather than limiting support to a fixed testing window. Recurring discussions helped the bank prioritize changes according to their potential effect on customer assets, business continuity, and institutional risk rather than technical severity alone.
Value Delivered
A Security Baseline Across Both Exchange and Custody Businesses
The engagement established a unified security baseline for the reviewed exchange and custody businesses. It gave the bank a clearer understanding of how security responsibilities were divided among internal teams and technology providers, which controls required independent validation, and which assumptions had to be maintained through day-to-day operations.
Greater Protection for Customer Assets and the Bank’s Reputation
By assessing complete customer and operational journeys, CertiK helped reduce the risk that a weakness in the exchange, an integration, or a business handoff could undermine the bank’s custody protections. This strengthened the bank’s ability to protect customer assets, preserve financial accuracy, maintain service reliability, and safeguard institutional trust as it expanded into digital-asset services.
A Long-Term Product-Security Partnership
The collaboration created a foundation for recurring consultation, future release reviews, retesting, and assessment of new integrations. Because CertiK retained knowledge of the platform’s architecture and operating model, subsequent work could focus more quickly on changed functionality and emerging risks rather than restarting discovery for every engagement.
Building a Secure Crypto Exchange or Custody Platform?
CertiK supports financial institutions through Web3 security strategy, architecture and threat-model review, application and infrastructure penetration testing, custody-system assessment, on-site operational review, remediation verification, and recurring product-security support.
