Institutional Crypto Is Growing Up.
Why institutional crypto adoption depends on secure digital asset infrastructure.
By Jenny Tseliou, Serenity Technology
On July 18, 2024, the Indian exchange WazirX had almost everything an auditor would ask to see. Its main wallet was a Safe multisig with six signatories. Every transfer needed three approvals from the WazirX team, each signer using a Ledger hardware wallet, followed by a final check from its custody partner Liminal. Destination addresses were restricted by a whitelist.
Four approvals came in. More than $230 million left.
According to WazirX’s own preliminary report, the attack “stemmed from a discrepancy between the data displayed on Liminal’s interface and the transaction’s actual contents.” Every signer performed their role. Each approved what their screen showed them, and what their screens showed them was not what they signed.
That incident is the most useful way into institutional crypto in 2026, because the institutions are arriving now, and they are bringing exactly the structure WazirX already had.
Institutional crypto security is the set of controls that let an organization hold digital assets the way it holds any other asset: authority divided by role, every approval tied to a named person, and a record an auditor can verify. Under the EU’s MiCA regulation, every crypto-asset service provider serving EU clients had to be authorised by 1 July 2026, according to ESMA.
a private key has no job title
Institutions manage money through structure. The person who initiates a payment is not the person who approves it. Approval limits rise with seniority. Two sets of eyes see anything large. When something goes wrong, there is a name in the approval column. These controls are older than computers, and every bank, fund, and corporate treasury is built on them.
A private key recognizes none of that. It recognizes possession. Whoever can produce a valid signature is, as far as the blockchain is concerned, the owner, with no concept of initiator, approver, limit, or role. For an individual that is the point of self-custody. For an organization it is a structural mismatch.
Almost everything institutional custody has built over the past decade, from multisig wallets to multi-party computation to policy engines and approval workflows, is an attempt to make a key behave as if it had an org chart. WazirX shows how far that retrofit has come and where it still breaks.
the institutions arriving in 2026
The regulatory and accounting barriers that kept large institutions at a distance have mostly come down in the past two years.
In the United States, the SEC issued Staff Accounting Bulletin 122 in January 2025, withdrawing the staff guidance that had pushed banks to record crypto held for customers as a liability on their own balance sheets. For a regulated custodian, that guidance made the business close to uneconomic. With it gone, the largest custodians moved. On August 18, 2026, Citi announced Custody+, a platform through which clients will access traditional and crypto custody within the same framework, with bitcoin custody expected to go live before the end of the year. Citi joins BNY and other global custodians that have moved into digital asset custody over the past few years.
In Europe, the change arrived as a deadline. MiCA allowed firms already operating before its full application to keep serving clients during a transitional period, but ESMA confirmed in an April 2026 statement that the period ends at the latest on 1 July 2026, “at which point all CASPs must be authorised.” Several member states, including Germany and Ireland, closed their windows much earlier. Firms without authorisation were told to prepare orderly wind-down plans.
What banks and licensed providers bring to crypto is not better cryptography. The cryptography was never the weak point. They bring the org chart: segregation of duties, named approvers, audit, and legal accountability. That is why their arrival matters, and also why WazirX is the right warning to carry into it. WazirX had the org chart.
what institutional crypto security actually requires
An approval structure only protects anything if two conditions hold for every signature on it.
Get Serenity Technology’s stories in your inbox
Join Medium for free to get updates from this writer.
The first is that each role is held by a specific, identifiable person. In most custody setups, a role is held by a device or a credential: a hardware wallet in a drawer, a key share on a laptop, a login to a policy dashboard. Whoever can operate that device or credential can perform the role. When a role belongs to an object that anyone at the desk can pick up, the approval column records which device signed, and the name next to it is an assumption.
The second is that each approval is a decision about the real transaction. This is where WazirX failed. Hardware wallets protected every key from the signers’ computers, which is what they are designed to do. The decision itself, though, was made by reading an interface, and the interface lied. Four independent-looking approvals were four copies of one decision, made on the basis of the same falsified display.
That is the uncomfortable property of a quorum. Each additional signer adds a person an attacker has to fool, but if every signer reads the same compromised screen, the quorum stops being several judgments and becomes one. It is the same failure that makes three recovery custodians under one authority no safer than one: the parts are distributed on paper and share a single point of failure in practice.
how the approval step gets tied to a person
This is the layer sAxess Pro is built for. sAxess Pro is Serenity Technology’s biometric access control card for organizations. It replaces passwords, SMS codes and PINs with a fingerprint checked on the card, so every sensitive approval is tied to a named person and recorded in an audit trail. In practice it moves a role from an object anyone can operate to a person who has to be physically present, which is what segregation of duties assumed all along. A stolen credential or a compromised laptop cannot produce the approval on its own, and the record of who approved what exists before an auditor asks for it. More detail is in Serenity’s sAxess Pro overview.
The limit matters as much as the benefit. Tying an approval to a person solves the first condition, not the second. A named, physically present signer can still approve a manipulated transaction if the screen in front of them is lying, and WazirX’s signers were real people doing their jobs. Institutions need both: approvals that belong to identifiable people, and a way for those people to verify what they are actually signing, independent of the interface that asks for the signature.
what growing up means
Institutional crypto growing up does not mean institutions buying more of it. The volumes will follow or they will not. It means that the controls finance has used for a century start to apply to the one asset class that was designed without them.
That work has two halves. Regulators and custodians are now building the first: licensing, accountability, and a named approver for every role. The second is harder, and it is the one WazirX exposed. Every signature on the chart has to be a person’s informed decision about the transaction that will actually execute.
The key still does not know what a job title is. The infrastructure around it has to know it on the key’s behalf.
Jenny Tseliou is a contributor at Serenity Technology, covering digital asset security, institutional custody, and access control. Serenity Technology (s.technology, formerly Serenity Shield) builds biometric security and recovery infrastructure for digital assets, including sAxess Pro, a biometric access control card for organizations. Related reading: sAxess Pro: What Enterprise-Grade Biometric Security Actually Looks Like in Practice | Why Biometric Hardware Is Becoming the New Standard for Institutional Crypto Compliance | Digital Asset Recovery: The Missing Layer of Web3 Security
Learn more at s.technology
Common questions
What is institutional crypto security? Institutional crypto security is the combination of custody, access control, and approval processes that lets an organization hold digital assets under the same controls it applies to any other asset. That means dividing authority by role, requiring more than one person for large transfers, tying each approval to a named individual, and keeping a record an auditor can verify.
Can banks hold crypto for clients in 2026? Yes. In the United States, SEC Staff Accounting Bulletin 122 withdrew in January 2025 the guidance that had pushed banks to book customer crypto as a balance-sheet liability, and custodians including BNY and Citi have since moved into digital asset custody. In the EU, crypto-asset service providers must be authorised under MiCA, with the transitional period ending no later than 1 July 2026.
What happened in the WazirX hack? On July 18, 2024, attackers took more than $230 million from a WazirX Safe multisig wallet. The wallet required three WazirX approvals, each on a Ledger hardware wallet, plus a final check by custody partner Liminal. According to WazirX, the data displayed on Liminal’s interface did not match what was actually signed, so the signers approved a transaction they could not see.
How do institutions secure crypto custody? Most combine several approaches. Regulated custodians such as BNY, Citi’s Custody+, Coinbase Custody and Anchorage Digital hold assets on a client’s behalf. Multi-party computation platforms such as Fireblocks and Copper split key material so no single party holds a full key. Smart-contract multisig wallets such as Safe require several approvals on chain. Hardware security modules protect keys inside certified devices. Biometric approval cards such as Serenity Technology’s sAxess Pro tie each approval to a named person’s fingerprint. Each covers a different part of the problem, and larger organizations usually layer two or more.
Is a multisig wallet enough for an institution? Not by itself. A multisig divides authority among several signers, which is necessary, but it assumes each signer makes an independent, informed decision. WazirX had a six-signer multisig with hardware wallets and a third-party policy check, and it still lost more than $230 million because every signer relied on the same manipulated interface. Institutions also need approvals tied to identifiable people and an independent way to verify what is being signed.
