"Cybersecurity: Understanding the Scope of the Threat to Digital Assets," Banking on Blockchain Podcast, Episode 1
In the opening episode, DWT partners Steve Gannon and Michael Borgia discuss cybersecurity risks in the digital asset ecosystem, including the scale and evolving nature of crypto-related threats, common attack methods, and the legal and regulatory frameworks that apply. They also explore practical steps organizations and their boards can take to strengthen cybersecurity oversight, governance, and preparedness.
Topics Covered
- The growing scale of crypto-related theft and fraud, including social engineering, supply chain attacks, compromised key infrastructure, and physical coercion
- How AI is increasing the sophistication and speed of impersonation schemes and vulnerability detection
- Cybersecurity considerations for hot wallets, cold wallets, cross-chain infrastructure, and third-party vendor.
- The laws, regulations, and industry standards that currently shape cybersecurity expectations for digital asset businesses
- The role of industry self-regulation, board training, management
Banking on Blockchain is a podcast exploring how blockchain and digital assets are reshaping financial services. Subscribe on Spotify or Apple Podcasts.
Episode Transcript
Steve: Good morning, and welcome to "Banking on Blockchain," a Davis Wright Tremaine podcast exploring how blockchain, digital assets, and modern payment technologies are reshaping financial services. In each episode, DWT attorneys and industry guests unpack the legal, regulatory, and business developments driving this fast-moving space, from bank adoption and stable coins to enforcement actions, infrastructure, and global trends. Designed for financial institutions, fintech companies, investors, and in-house counsel, this series delivers practical perspectives on what's changing and what's ahead.
Steve: In our first episode, we're going to discuss cybersecurity as it relates to crypto, and let me introduce myself. I'm Steve Gannon, a partner at Davis Wright Tremaine, and one of the co-heads of our digital assets and blockchain practice. And with me is my partner, Mike Borgia, one of the co-heads of our cybersecurity practice. So Mike, thanks so much for spending the time with me this morning.
Let's start off with kind of an obvious question. Why should a crypto audience care about cybersecurity enforcement?
Mike: Yeah. Thanks for having me. It's exciting to be here, and there's a ton of stuff that we can talk about. So it's a good place to start, and I think a theme of today, there's a lot of stories that in cybersecurity we tell, and some of them may be true, maybe some of them are apocryphal. But one of them, this reminds me of, is the story about a bank robber and was asked, "Why do you rob banks?" And he said, "That's where the money is." And that is a good answer, I think, to that question of why should you care? Well, because there's a lot of money in crypto, a lot of value, and that makes an extremely attractive target for all types of cybercrime.
And this happens in a lot of ways. Some of it is very sophisticated, looking at flaws in the way cryptographic algorithms are implemented.
But a lot of it also too is really basic, and it's really just a slight twist on your standard fraud. Things like your social engineering emails are kind of like a different version of the Nigerian prince type of thing, and different ways to get people to give up their keys. Just like you might get an email saying, "Hey, please put your password in." Very similar thing. So quite a bit here. It's a place where decentralization, despite having many advantages, can be difficult because there aren't always coordinated responses to these things. So yeah, tremendous value and quite a bit of risk.
Steve: So let's talk a little bit about hacks that have been experienced, because I think it helps to set the table to have kind of a sense of what the magnitude is. So while the magnitude is not really in the same ballpark as traditional fraud, it's not small. And so can you talk a little bit about how much was stolen in hacks in 2025? And I know that there was a pretty famous one where Bybit lost a bunch of value to North Korea state-sponsored hackers. Maybe you can tell the audience a little bit about those things.
Mike: Yeah, there have been a number of studies on this, and of course, a lot of this is going to be underreported. There's going to be a lot of hacks that don't get reported. This is based on what people know, it gets reported to law enforcement authorities, in the news, things like that.
By one analysis, in terms of stolen funds, and not including sort of the social engineering and fraud on individuals getting to give up their keys. One number is 3.41 billion, so pretty substantial.
Now, 1.5 billion of that does come from that Bybit attack that you mentioned. It was a series of, I believe, three attacks against Bybit, and believed to be perpetrated by North Korean actors. But when you look at the broader fraud landscape here, it's even worse. So even just scams, $14 billion in 2025 by one estimate. This is from Chainalysis, and they were projecting in excess of 17 billion in next year, essentially. So it's growing really quickly. And as I said, some of this is very sophisticated and you've got your North Korean actors or others doing this.
But a lot of this, again, is very run-of-the-mill, breaking into places where keys are held, trying to convince people to give up their keys, all sorts of impersonation scams and things like that. So there's quite an ecosystem around these hacks.
Steve: So one of the things, I'll make my own little comment on this, and that is that as the blockchain and crypto ecosystem grows, one of the big challenges from the very beginning in terms of overall utility has been cross-chain interoperability. Because when blockchains don't talk to one another, obviously it's more difficult to do business. And there are a number of entities out there that are very active in building that cross-chain capability, and it's gotten better each year. But there's no evidence that there's ever been a blockchain hacked.
But in order to have the utility that the tool has, it has to be able to communicate across bridges in ways that have just vulnerabilities. And so the premium, it seems to me, going forward for crypto in general is almost a standard third-party risk management exercise where you're sure that your vendors have nailed down their own cybersecurity because if they fail, you can fail.. So in any event, with that public service announcement, I guess I'll ask you to agree to that.
Mike: No, I do, and we'll talk later on about quantum computing and post-quantum cryptography. And I won't spoil it, but one of the things that we're going to have to get into there is that decentralization is tremendously powerful and beneficial in this space in a lot of ways. It has its disadvantages well. And one of the disadvantages comes in when you need a big coordinated effort to change the way things operate, and that's going to be challenged here.
Steve: Right.
Mike: Before we get into that, it's also worth noting how much AI is in play here as well, in general, not just for crypto, but in cybersecurity, and that is bleeding over into the crypto space.
AI is really good at a number of things. But in terms of cybersecurity, it's really good at impersonation attacks. We've all come up in an era where you've seen these emails, and they are in broken English. They don't necessarily make a ton of sense. They're shot everywhere, and they're just hoping, look, someone isn't paying attention, and they click on it.
AI is getting really good at impersonating people. The way they write, the situations they would talk in. We've even seen some really interesting situations. There was a famous case, this is not a crypto case, but you could see how it could be, out of Hong Kong. Guy gets a message says, "Hey, I need you to buy some gift cards," something like that. He says, "No, come on, that's a scam. No way. I know this one." And then he gets invited to a video call where it's got realistic video impersonations of numerous people in this company's management that are like, "No, seriously, come on, we got to get this done." And does it, and it's a huge multimillion-dollar loss.
So we're going to see that. We're also seeing AI being very good at finding vulnerabilities. So for example, right now, again, as you said, there's not really evidence of the underlying cryptography being broken. But if it's problems with implementation or other security issues in the way that companies are operating or individuals are operating, AI is really good at finding those and figuring out ways to exploit them. Sometimes there are things that could've taken a smart security researcher days or weeks, and AI can do it in a matter of hours or a day or something like that. So that is increasing security risks for everyone across the board, and that's going to apply here too, again, for the reason of it's where the money is.
Steve: Sure. Well, let's talk a little bit about the different kinds of attacks that crypto faces. I understand broadly there are four kinds of attacks. Can you chat about those a little bit?
Mike: Yeah. Some of the major ones you are gonna see, again, and if you're a person listening to this and you're familiar with cybersecurity, what I would say is most of this is pretty common stuff. But it's kind of a different take on common stuff. So for example, we've mentioned already social engineering and scams. So this is the most common one, as far as I know at least. Because this doesn't take someone with ... Someone could have incredible sophistication. They don't need to. This is an attack that can be scaled. And this is impersonating someone or doing other types of social engineering to convince someone to give up their private key to transfer a lot of Bitcoin to someone or something. This could even be in the form of, "Oh, I have this information about you, and I'm going to release it to the public. Transfer me Bitcoin." Right? This could be actually trying to breach private information, like a private key, or it could just be a straight scam.
We've also seen these even happen in a new take on the investment romance scam, if you've seen these before, of people posing as potential romantic partners, but also they're somehow very well-connected in terms of investments, and they have all sorts of investment opportunities, seeing that all the time as well. So that's... I put that in one bucket, which is the social engineering type of scam.
Another is something you alluded to already, which is, I guess I can group these together, which is vendors, supply chain attacks, we'd say, right? So this could be a vendor. You're a company that operates in this space. You have a vendor. There's an attack against the vendor, against information that they hold. Maybe they hold key information, maybe they hold wallet information, maybe they hold whatever, and using that to compromise systems. Or maybe they're not related. That's often a tricky way these happen, is it's not even a vendor that is directly related to a cryptocurrency infrastructure. It's a vendor that does something else, but through that vendor, they're able to get information or access to your network. They can pivot into the network, and then they have privileged access into whatever they want, right?
This can also happen with a different type of supply chain attack, often referred to as a software supply chain attack. So this would be your software product uses a code library, right? Maybe it's an open source code library. Maybe it's a code library you've purchased from a vendor. You use vendor code, vendor software, things like that. An attacker puts some kind of malicious code in there, some kind of exploit. You take the code, you put it in your software, your software leverages it in some way, and then you have an exploit.
A really famous example of this for those who might feel like that's a little esoteric, not a crypto example, but a famous one is the SolarWinds attack back in 2019, 2020, where attackers put bugs essentially into code used by this software company that's used for network management and monitoring. So the update was compromised by attackers. The software company pushes the update to its customers. Now, all of a sudden, the attackers have a door into all of those customers, and it's a huge net. So that's another area there.
Another one I would highlight here would be, and this can come in the forms of things we just talked about, but it's worth calling out because it's so important. A compromise of the key infrastructure. Compromising, for example, in Bybit, this is a very basic explanation, but there was a compromise of a wallet vendor's interface. So it falls into a couple categories there. But then they were able to essentially spoof transactions and pull off transactions that weren't actually authorized by the individuals.
As we'll talk about is when we get into quantum computing, and I'm sure as a lot of people already know, cryptocurrency and blockchain technologies in general run on cryptography. That is the backbone of these things. And so these attacks are ways in which an attacker is trying to, again, we haven't seen against industry-standard strong cryptographic algorithms straight-breaking those algorithms yet, and we'll talk about what the yet means. But what we have seen is attackers compromise flaws in implementation, or pull off other types of attacks that allow them to produce the private key from.. and then therefore sign transactions and impersonate authorized people, things like that.
The last category worth mentioning is the most blunt one, and literally is the physical coercion. You literally see kidnappings and all sorts of physical threats and things like that.
Sometimes these are called wrench attacks, which is a bit colorful for me, but I get the point. Actually trying to threaten people with harm or do harm to them to hand over private keys. And unfortunately, they're actually some pretty big ones. By one estimate, $30 million already in 2026. And no doubt that number is actually much higher.
Steve: Yeah. One of the things that is interesting about this is how customers decide they were going to hold their crypto, in what kind of wallet. So if you're a trader, you're going to have a hot wallet, right? You're going to have it connected to the internet because the crypto is going to be going in and out all the time. And as a matter of fact, when you're using—and back to AI—when you begin to use agents to trade, which inevitably I'm sure that's already happening—they've got to be able to go in and out of the wallet constantly. They can't be in a cold wallet.
On the other hand, if you're holding Bitcoin because you just think, "I believe it's going to go up to 200,000," whatever you might believe, it makes sense to hold it in a cold wallet, completely unconnected to the internet, and it makes it a lot harder unless, again, you're the subject of a wrench attack, a lot harder for somebody to penetrate something that's air-gapped. I don't know if it's impossible. I have a hard time imagining how it would be myself, and of course, then you have things that are in between, like multi-sig safety around the wallet, which is, while it's connected to the internet, it's kind of hard to get to.
Mike: You think about these things much like you think about home security, right?
Steve: Yeah.
Mike: You put an alarm system in, you put door locks and stuff like that. No one does that thinking like, "Now it's not possible to rob my house." But when you put that up, it's harder. It's materially harder. And so when a burglar walks by and sees the alarm system sign and whatever, and the door's locked, there's just a calculation they have to do. Like, how much effort is this going to be and what's the risk?
Cyber attackers are very similar. These things aren't impossible, but they're going to have to ask, "How much am I going to get out of this attack versus how much effort am I going to put in?"
This is part of the reason that those simple romance scams and impersonation scams are so popular, because they're not hard to do, and you can shoot them at 10,000 people. And if two or three bite on them, this is not very successful from a percentage standpoint, but that could be a lot of money.
So, is it conceivable that a cold wallet can be breached? Yes. But generally, that's going to be a ton of work, and for a very speculative return.
Steve: Yeah. Right. And something that is, I would imagine one of the things the bad guys have to be worried about is because the crypto stays on a blockchain, and of course, you've got mixers and tumblers that it can get to, but there is going to be a trail, and the analysis tools, you
mentioned Chainalysis, there are others, Elliptic and I think M3 are quite good at tracing it. So there's definitely an arms race going on between the bad guys and the good guys.
Well, let's shift gears a little bit and talk about what kind of rules actually apply to crypto today. So the GENIUS Act got passed in '25 that ordered agencies to go make rules around stablecoins. CLARY Act did not pass, and I think everyone believes that unless somebody can pull a rabbit out of a hat, it's a dead letter probably for some time. And so what kind of rules are ruling the roost today when it comes to cybersecurity related to crypto?
Mike: Yeah. The OCC proposal on the GENIUS Act is maybe the closest thing, I think it is the closest thing I can think of to any kind of crypto-specific cybersecurity rules, and we'll talk about it in a second. In general, we oftentimes with AI right now as well, whether or not there's any AI law, there's still a lot of cybersecurity laws out there, and those apply generally. And that's the case for the crypto industry right now as well.
So there is not generally a crypto cybersecurity law, but there are various things that will be brought to bear. So one is if you operate in the financial services industry, you may well be, especially if you're a bank, but other non-bank financial institutions as well, many other types can be subject to the Gramm-Leach-Bliley Act, GLBA, which has various privacy and security requirements in it. Those are not deeply technical requirements. Sometimes people think, "Oh, well, somewhere I'm going to find some kind of very long list of what type of algorithms and all these things." It's not how it works. It's more of a programmatic set of requirements. And the GENIUS Act proposal from the OCC is similar. We'll talk about that in a moment.
There's also state laws. They're very general, but they're state laws, and FTC, the Federal Trade Commission, similar very general standards around reasonable, appropriate security. There are some laws that will call out a few things like you must encrypt personal data, you must have access controls, right? They're very, very generally stated things. And so the way that the enforcement would happen or even a private lawsuit would happen is a suit would leverage those kind of general standards. It would argue something that a company in the crypto space is doing is not reasonable. There's a lot of money at risk here, and these controls were easily breached, and it's very much like a risk-based argument that would be made. So it's going to happen after a hack. Doesn't have to include a hack, but that's usually how it's going to happen.
Steve: Yeah. So I'm going to now ask you a question that's kind of a two-fer. So given the fact that we don't have comprehensive crypto legislation now with the failure of CLARITY, is there a role for, although by the way, of course, as everybody knows, the agencies are going to attempt to make rules based on existing authority, but where there are gaps, is there a role for the industry to step up and self-regulate? And what might that look like, number one...?
And number two, as that's happening, is there a premium on more and additional board training? Because at the end of the day, the boards are responsible for the activities of the company. And if I were harking back to what happened after the global financial crisis, lots of regulators came knocking on the door of board members saying, "Hey, fellas and ladies, you're not really doing your job here. I don't see the oversight. And by the way, one of the reasons I know there's not much oversight is none of you guys have been trained on these risks." So how do those two things work together?
Mike: Right. So on your first question about industry self-regulation, yeah, I think absolutely, and I mentioned at the beginning of this session that there's a lot of stories that get told in this industry in cyber, and one of them that I really like is the story about the automobile and red flag laws, which I understand in the early days of the automobile where it was driving, it would drive slowly, and it would drive through dirt roads that were busy with people and cows and buggies and whatever, and you had to have someone have a big red flag or something, some kind of marking to say, "Hey, there's a car coming through. Be careful." Now, the problem with this, obviously, is the car's not going very fast. It's not realizing its potential here, obviously.
And that what it took was for the industry to really take off, well, I mean, a number of things. But one thing in particular was a set of standards that people felt made it safe. Traffic laws, right? Which side are we going on? When do you go? When do you yield? Things like that had to get figured out, as well as making the automobile itself safer over time. And you can see, speed limits keep going up and things like that, right?
The more people feel like, hey, these things are safe, there is some kind of thought given to the safety of this, the more people are going to be comfortable using the product, using it more, and pushing it, right? Using it to its fullest extent without worrying about, I don't know if this is safe.
So I think there's real incentive there for the industry to do that and to create maybe a set of rules or standards that people can take some comfort in to look at and say, "Okay, there really is thought about this, and I have reason to believe that this is safe."
And obviously, we see this in many areas in traditional financial services space as well, industry groups and things like that, as well as in the legal industry and lots of places where the thinking is, we need to establish a base level of trust and confidence in this industry, or people really aren't going to want to use it. It's mutually beneficial, even financially for everyone. So I think there is a lot there, especially when it's again decentralized. And so there's also consideration here of, if it doesn't exist, is there even more incentive for a regulator to come in and say, "Well, there's no rules here. I've got to put rules in place." Now, your second question.
Steve: More training.
Mike: Sorry?
Steve: More training. What should boards be doing? This is really important to really train themselves to make sure they're trained and oversight that they should be engaged in
Mike: Plaintiffs' attorneys that do derivative suits are working hard to find a winning theory and a winning case on cybersecurity. They haven't found it yet. There have been some decent settlements. I'm not aware at this point of any major case actually there being a decision in the case that has gone in favor of the plaintiffs, but they are trying, and it makes sense why they would try. The losses from cybersecurity incidents can be substantial, and there's an open question about, and for a lot of companies, are boards paying attention to this stuff? Or is this just seen as some IT thing? So it's very important, and I think that also it's important to recognize that a lot of liability in this space, if you're a board member, can come from, kind of what you were alluding to, Steve, it can come from, I almost call them foot faults.
When you're not seeing liability for directors and officers generally in these types of cases where, oh, they were briefed, and they thought about it, and they talked about it, but maybe they didn't quite get the subtlety of this issue, or they could've done more. You don't tend to see these win under Delaware law, the business judgment rule, and all the various protections that good faith and all the doctrines that can be brought to bear in defense. Where you see these things have some success in other spaces, again, I can't think of any in the private security space, is where this wasn't discussed. For two years, cybersecurity was not discussed. These risks were never discussed. The board was never briefed on them by anyone at the company.
They're the easy ones. And so boards should not fall victim to that. There is a lot you can do with a modest amount of governance here, and that is let's make sure we're getting briefed on this. Let's make sure we're getting trained on it. Let's discuss it. Let's make sure we understand the major risks. We don't need to know every last risk and every little thing in the company. What are the major risks? What does that look like? Do I feel comfortable they're being addressed? This doesn't have to take hours and hours, but again, a little bit can go a very long way here to protect the company and its board.
Steve: Yeah, and I'd actually pile onto that a little bit and say, a key two-word phrase for bank regulators have been "challenge questions." That is, is the board asking questions of the people who are doing the presentations, and are they trying to push and understand a little bit? And I think that's, for board members, it's not only critical that they do that, but that it gets reflected in the minutes. Because if it's not in the minutes, it might as well not exist.
Mike: Exactly. I'd understand from a management, who is in charge of this from a management perspective? And is that person briefing us? That's very, very important to know that if we're talking about a set of risks, in this case, cyber, is there a CISO, a chief information security officer? Who is in charge of this? And if that person's in charge, are they going to brief us? Is it quarterly? Is it annually?
That is very, very important because then, again, it's a very powerful defense to say, "Well, we've got someone whose job it is to think about and mitigate these risks quarterly, annually, whatever that person comes to us, they give us their main risks." They talk about the mitigations. We ask questions. That's really important.
Steve: Yeah. And by the way, another important function for the corporate secretary, because usually board members, as diligent as they are, don't keep in their heads, when was the last time we talked about cyber. Was it two years ago or two months ago? . I can't remember. It's up to the corporate secretary to say, "There's got to be a cadence here, a regular cadence, to make sure that these issues are being put in front of the board, and they have an opportunity to push and pull and ask whatever questions they want.
Mike: Right. And the CISO's getting an opportunity if the CISO thinks, "I think our risks..." If it's like, "Hey, we did this last quarter. I don't think risks are materially different." Okay, that's fine. But, "Hey, I do think our risks are different. Our technology has changed. The risk landscape has changed. Something is big here. Let's make sure they're getting in front of the board." Then we're not saying, well, it's probably fine to do it annually, but you don't want to miss this thing if the CISO is saying, "Hey, I think there's some serious risks here we have to address here." Well, that hasn't happened for nine months, so we'll get to it when we get to it.
Steve: And boards have got to be ready to grapple with a tough question, which is the CISO comes to you and says, we have a vulnerability in our system. And because of the way the system is architected, it's going to take us $20 million of mitigation to close the gap. And the chairman of the board says, that's great. We don't have $20 million. Like, what's plan B? And figuring out, okay, like, what is plan B? And is plan B adequate? And can you show that in retrospect when everyone has their 2020 hindsight glasses on that this was good enough?
So not something that we have an answer to, but something that is inevitable for almost every board. And also, of course, vendors are part of this. We were talking earlier and you mentioned the 2025 Coinbase breach coming from bribed support contractors, which circles back to the concept of third party risk management, which we talked about earlier.