Crypto treasury governance works when the board writes the rules, the CFO runs them, and no single signer, vendor or adviser can move the money alone. The Security Alliance’s multisig framework uses four signatures out of seven as its example for a large treasury, and wants at least one signer from outside the organisation on any high-value multisig. The cost of getting it wrong is concrete: one exchange theft, about $1.5 billion, made up roughly 44% of the crypto Chainalysis counted as stolen in 2025.
Who decides this
The board owns the treasury policy: what the treasury is for, how it is split between wallets and custodians, who can sign, and what limits apply. The CFO runs it day to day and reports against it. The board is accountable for the design and for changing it. The CFO is accountable for keeping it, and for telling the board when practice has drifted from the paper.
What should the treasury policy say before any money moves?
The treasury policy should classify every wallet by value and urgency, set a signer threshold and spending limit for each class, and name who can change those settings. Everything else follows from that table.
The Security Alliance (SEAL) framework gives a workable starting point. It grades multisigs by financial exposure, from under $100k up to over $10M, and by how fast they must act, from 24 to 48 hours down to under two hours (SEAL planning guide). It then gives example thresholds for common use cases. Where a wallet sits between two classes, it advises picking the stricter one.
| Wallet class | Exposure (SEAL) | Example threshold (SEAL) | Response time | What the board decides |
|---|---|---|---|---|
| Large treasury | $1M–$10M (High) | 4 of 7 | Routine, 24–48 hours | Who holds the seven keys |
| Small treasury | $100k–$1M (Medium) | 3 of 5 | Routine | Monthly spend ceiling |
| Capital allocation | High | 3 of 5 | 2–12 hours | Which counterparties are pre-approved |
| Emergency freeze | Critical, over $10M | 2 of 4 | Under 2 hours | That it can pause but never move funds |
The table is the policy’s core. We would add three lines to it: who may change a threshold, how many board members must approve that change, and how the change is recorded.
Should the treasury sit in a multisig, with a custodian, or both?
We would use both for most funded organisations: a regulated custodian for reserves that rarely move, and multisig controls for the operating balance the team spends from. Keeping everything in one place concentrates the risk.
The choice is not only about security. It is also about who carries liability and what the auditor can test.
| Self-run multisig | Regulated custodian | Hybrid | |
|---|---|---|---|
| Who holds keys | Named signers | The custodian, under contract | Custodian for reserves, signers for operations |
| Liability for loss | The organisation | Set by contract and, in some regimes, by law | Split by wallet |
| Speed | Fast, if signers are available | Slower; follows the custodian’s process | Fast where it needs to be |
| Evidence for the board | On-chain, plus internal records | Custodian statements | Both |
| Main weakness | Signer and interface compromise | Counterparty and segregation risk | More moving parts to reconcile |
Regulators set useful benchmarks for custodian selection. New York’s financial regulator issued guidance in January 2023 telling the custodians it licenses to keep customer assets apart from their own, to use sub-custodians only after due diligence and its prior approval, and to disclose how assets are held (Jones Day). In the EU, MiCA Article 75 requires a custodian to segregate client assets so its creditors cannot reach them, and makes it liable for losses it causes, capped at market value at the time of loss (MiCA Article 75).
There is an EU limit to watch. ESMA said in April 2026 that MiCA bars authorised service providers from delegating custody to entities that are not themselves authorised (ESMA statement). The transitional period ended on 1 July 2026. An organisation that is itself a regulated service provider should take counsel’s view before choosing a custodian.
How should the multisig itself be configured?
Separate multisigs by function, give every signer a hardware wallet and a key used for nothing else, and put a timelock in front of anything that changes rules rather than spends money.
SEAL’s key takeaways are blunt on these points (SEAL key takeaways). It says every signer should use a hardware wallet. Each signer should use a different address for each multisig, because keys sharing a seed phrase fall together. Signers should decode and check what a transaction does, not only confirm its hash.
For treasuries specifically, SEAL recommends keeping most assets in a cold wallet and spreading very large holdings across at least three cold wallets (SEAL treasury requirements). Its general timelock guidance sets a default minimum delay of three days and reserves 7 to 14 days or more for major changes that affect user funds. For treasuries, it wants a party outside the organisation monitoring timelocked transactions.
Signer independence is where most boards are weakest. The Ronin bridge breach of March 2022 shows why. An attacker gained five of the nine validator keys; four were held by one company, and a fifth signature came through access that had never been revoked (Ronin postmortem). About 173,600 ETH and 25.5M USDC were drained. A threshold only protects the treasury if the signers really are independent of each other.
What should the board see, and how often?
The board should see a quarterly treasury report that reconciles every wallet and custodian account, lists every signer and change, and flags any breach of policy.
Quarterly is a sensible floor. MiCA already requires authorised custodians in the EU to send clients statements at least every three months, so the data exists. The report should include a signer register, with each change minuted, and the access-control inventory SEAL recommends: every privileged role, what it can do, and what happens if it is compromised.
Signer changes need their own rule. When a signer leaves, their key should come off every multisig within days, and the threshold should be checked again the same week. SEAL’s runbook warns that a threshold change shifts both security and the ability to act at once (SEAL threshold runbook). That is why we would have the board approve it, not the signers alone.
Theft data argues for taking this seriously. Chainalysis counted over $3.41 billion stolen in 2025 through early December, and the single $1.5 billion Bybit theft was about 44% of that (The Block, on Chainalysis data). The FBI attributed that theft to North Korea (NBC News). Chainalysis also found private key breaches at centralised services made up 88% of stolen value in the first quarter of 2025. Professional security did not prevent them.
What goes wrong: five advisers, one blind spot each
Most treasury failures are not caused by a missing control. They happen in the gap between controls that different firms each own.
Picture a typical setup. The custodian reviewed its own platform. A security firm set up the multisig. The auditor tested balances at year end. Counsel checked the custody agreement. A contractor wrote the signing runbook. Each did good work, and each signed off on its slice. Nobody checked that a former employee still held a key, that two signers kept their keys on the same laptop, or that the emergency wallet could move funds as well as pause them.
The fix is one owner for the whole picture. The CFO should hold a single map of every wallet, account, signer and permission, reviewed by the board each quarter. Every adviser’s work should be checked against that map, not only against its own scope.
How Alcyone approaches it
Alcyone’s role is the plan, not the keys. The custody and security work belongs with specialists. What Alcyone adds is a single plan in which every part has a named owner, so the treasury policy, the token allocation and the launch calendar are written to fit each other. That is how Alcyone’s Web3 strategy advisory is built. Its partners built and operate Team Finance, the TrustSwap Launchpad, The Crypto App and Panthea, and Alcyone states that clients are under no obligation to use those products.
For organisations that want a regulated custodian inside that policy, Panthea’s institutional custody platform provides the technology and product layer, while custody is held by Blockfort AG, a Swiss-regulated financial intermediary and VQF member, in segregated accounts. Panthea does not claim Blockfort is authorised under MiCA, so an EU service provider bound by ESMA’s delegation limit should not treat this as a way to delegate its own custody.