Institutional Wallet Security: What BitGo Secures Around the Key

Ahmed Elmasry, Senior Product Manager at BitGo, on The Security Table

BitGo built much of its reputation in institutional custody on the 2-of-3 multisig model it pioneered: BitGo holds one key, the customer holds another, and a backup key sits in cold storage. Ahmed Elmasry, Senior Product Manager at BitGo, still spent most of episode 13 of The Security Table explaining why institutional wallet security now depends on everything around the key.

His argument came up in every answer, whether the topic was quantum risk, AI agents, transaction signing or interface design. Keys remain foundational, and wallet security now has to cover the access permissions, policies, approvals and signing flows around them, along with the person reading the screen.

Smart contracts carry the same kind of layered, irreversible risk, so each of Ahmed's points on custody, post-quantum cryptography, AI agent security and transaction signing has a direct parallel in smart contract security.

Wallet Security Has Become a System Security Problem

Ahmed described the shift as wallet security becoming less of a cryptography problem and more of a system security problem. BitGo now looks at the whole transaction lifecycle, from access permissions and policies through approvals to the final signature, and asks what an attacker could actually do if any one of those layers were compromised.

That view also shapes how BitGo plans for threats it can't see yet. AI, quantum computing and attack techniques nobody has used so far all point toward an architecture that can take on new protection layers without the whole system being rethought each time a new risk shows up.

A bank can spot fraud three days later and reverse a wire, but digital asset transfers are generally irreversible, so every layer has to hold before the transaction happens.

Smart contract code is one of those layers for every protocol an institution touches, and it's just as final. Once a flaw in a deployed contract is exploited and funds move, there's rarely a way to pull them back, which is why Olympix focuses on the code before it ships.

Post-Quantum Cryptography: Preparing Without Betting on a Date

Estimates for when quantum computers will threaten today's cryptography range from a couple of years to more than a decade, and Ahmed thinks much of the industry is stuck trying to predict the date. BitGo puts its effort into two things it can act on now.

The first is post-quantum cryptography itself. In May, BitGo demoed a post-quantum signature on Ethereum testnet using ML-DSA, the lattice-based signature scheme NIST published as FIPS 204 in August 2024. Ahmed was clear that the demo doesn't make BitGo's Ethereum wallets quantum-secure today. New cryptography needs time to mature, get audited and be tested against real-world use cases before anyone trusts it with significant assets, and BitGo would rather do that work now than experiment with it during an emergency.

The second is the customer. A client holding billions in Bitcoin who asks what BitGo is doing about quantum won't be satisfied with “it's not happening tomorrow.” The standard advice is to avoid reusing addresses, so BitGo built that advice into the product: quantum-resistant wallet capabilities that let customers measure their exposure and move assets to fresh addresses in a couple of clicks.

That move from guidance to product is worth borrowing well beyond custody. Advice in a best-practices doc leaves each team to work out its own exposure by hand, while a product that measures it shows exactly where they stand and gives them a direct way to act. Olympix applies the same idea to smart contract security. Teams set their own thresholds, such as zero high or medium findings, a minimum branch coverage or a minimum mutation score, and get a live view of where their entire codebase stands against them.

AI Agent Security: Putting the Boundaries in the Cryptography

AI agents are valuable in financial systems because they can act without a human approving each step, and Ahmed pointed out that requiring approval for every decision would defeat much of their purpose. Giving them that autonomy safely depends on where their limits live.

BitGo is opinionated about putting those limits at the cryptography level as well as the application level. If an agent holds private keys and can make decisions, sign transactions or spin up new wallets, the policies governing it are authorized by humans at the cryptographic level and inherited automatically by every wallet it creates. However the application around the agent is configured, the agent stays inside those bounds.

Once an agent is acting, BitGo wants a strong observability layer showing what it signs, where it fails and any anomalies. BitGo's developer console lets people monitor their API integrations, webhook events and access tokens today, and it was built expecting that the actors on the other side won't always be human. Ahmed expects the observer to eventually be an agent too, with one agent monitoring another.

Smart contract security runs on the same principle. A property enforced mathematically holds up better than one that depends on how something is configured, which is why formal methods matter for contract security. Olympix infers a contract's invariants, the properties it should always respect, from the code and the documents around it, then works to break them. When one breaks, the result is a concrete counterexample a developer can reproduce.

Transaction Intent: When a Valid Transaction Is the Wrong One

A secure key doesn't help much if the person holding it is tricked into signing the wrong transaction. Ahmed's point was that a transaction can be cryptographically valid and still be the wrong one, so BitGo protects intent through several layers.

• Admin quorum. Pending approvals require a quorum of admins, so one socially engineered user can't move assets alone.
• User intent. When users sign with their private key, they also attest the transaction with a passkey, creating a cryptographic authorization tied to the amount and destination that rules out a man-in-the-middle swap.
• Organization intent. BitGo is moving its policy engine into a secure enclave, where every policy configuration and update has to be authorized by user keys, including the admin quorum, and validated inside the enclave and HSM.
• Fraud detection. BitGo compares the login IP, country, device and timing of each signature against normal behavior and can add a verification step when something doesn't match.

Smart contracts have their own version of the gap between validity and intent. A function can compile and execute exactly as written while still allowing something its developers never meant to allow, such as a sequence of calls that drains a pool. Closing that gap means stating what the contract should always do and testing whether any execution path can break it. Olympix derives that intent from the code and everything around it, including threat models, whitepapers, design docs and past audits, so the checks reflect what the team set out to build.

Address Poisoning and Why Good UX Is a Security Control

Ahmed's hot take, which he tied to his own product background, is that bad UX is one of the most underestimated security risks. The strongest cryptography and defenses in the world still pass through a human, and an overwhelming or confusing interface turns that human into a new layer of risk.

He gave two examples. BitGo's policy engine is deliberately granular, with every control a customer could think of, and a confusing interface on top of it leads to misconfigured policies. Ahmed considers those more dangerous than having no policies at all, because they give customers a false sense of security.

The second is transaction signing. Users are told to make sure they know what they're signing, but a destination address is a long string of characters, and an attacker who changes only the first and last few characters can create a lookalike nobody reliably spots by eye. That's how address poisoning works, and it's costly: in December 2025, one trader lost nearly $50 million in USDT after sending funds to a poisoned address.

Ahmed's conclusion is that good UX is a security control in its own right.

Developer security tooling is held to the same standard. A finding protects a protocol only when the engineer reading it can see what breaks and act on it, which is why Olympix reports a broken invariant as the specific execution that breaks it, something a team can reproduce and fix directly.

Smart Contract Security: The Same Logic Applies to the Code Underneath

BitGo secures the custody layer: keys, policies, approvals, signing and the people using them. Every protocol an institution interacts with adds another layer below that, the smart contract code that moves funds once a transaction lands.

That code shares the properties Ahmed described. Losses through an exploited contract are as hard to reverse as a mistaken transfer. Contracts are layered too, since they interact with oracles, bridges and other protocols that were each built and reviewed separately. And they benefit from the same move BitGo made with quantum risk, turning best practice into something a team can measure.

Audits are a necessary part of that picture, and each one covers the scope it was given. Exploits tend to emerge where an audited scope meets the rest of the system, or where two separately audited components interact. Olympix tooling works alongside auditors during development, inferring invariants across the whole codebase, attacking the paths that look dangerous, and showing teams where everything they've written stands against the security thresholds they've set before anything ships.

For institutions moving onchain, the custody layer and the code layer both sit inside the transaction lifecycle Ahmed described, and both have to hold before the transaction happens, because neither can be undone after it.

Frequently Asked Questions

What Does Institutional Wallet Security Cover?

Institutional wallet security covers how custodians protect digital assets held on behalf of institutions. Key management is still the foundation, and according to BitGo's Ahmed Elmasry it now extends across the whole transaction lifecycle, including access permissions, policy configuration, approvals, signing and the interface people use to authorize transactions.

Is ML-DSA Quantum-Resistant?

ML-DSA is the lattice-based digital signature algorithm NIST published as FIPS 204 in August 2024, and NIST says it's believed to be secure even against an adversary with a large-scale quantum computer. BitGo demoed an ML-DSA signature on Ethereum testnet in May while it continues testing the cryptography before trusting it with significant assets.

What Is an Address Poisoning Attack?

In an address poisoning attack, a scammer creates a lookalike address that matches the first and last characters of one the victim uses, then plants it in the victim's transaction history. If the victim copies the wrong address from that history, the funds go to the attacker, and onchain transfers generally can't be reversed.

How Should AI Agents Be Secured When They Control Wallets?

BitGo's approach is to enforce an agent's limits at the cryptographic level, with human-authorized policies that every wallet the agent creates inherits automatically, and to pair that autonomy with an observability layer that shows what the agent signs, where it fails and any anomalies.

How Does Smart Contract Security Relate to Wallet Security?

Wallet security protects the custody layer, and smart contract security protects the code that moves funds once a transaction lands. Both sit in the same transaction lifecycle, and losses at either layer are hard to reverse, so both need to be secured before anything ships or signs.