# Operational Risk Beats Hacking Risk, and the Numbers Show It

> Attention goes to exploits. Most customer losses have come from mundane failures of process and governance.

- Source: https://custodywatch.com/operational-risk-beats-hacking/
- Published: 2026-10-14
- Author: Rhea Castellan
- Publication: Custody Watch — Who is holding it, and on what terms
- Topic: custody
- Tags: custody, risk, governance

---

The industry talks about security and loses money to administration. The pattern is consistent enough to be worth stating plainly.

## What gets the attention

Exploits, bridge compromises and key theft. Dramatic, technically interesting, and well covered.

These are real and they are not where most customer value has been destroyed.

## What has actually destroyed the most

Misuse of client assets, undisclosed lending, related-party exposure, and failures of basic governance. Mundane, slow, and detectable by an auditor with access.

In several of the largest failures the systems were never breached. The controls were simply absent.

## Why the attention is misallocated

Technical failures have a visible event. Governance failures have a slow accumulation and a sudden disclosure, and the disclosure is usually the bankruptcy filing.

A venue can also demonstrate security investment. Demonstrating governance is harder and sells less well.

## What this implies for assessment

Questions about key management matter less than questions about who can authorise a movement of client assets and who checks.

An exchange with excellent cryptography and no separation between client funds and the trading desk is more dangerous than the reverse.

## The four governance questions

Can client assets be lent or pledged, and does anyone verify that they are not. Who authorises large movements. Who reconciles the ledger against on-chain holdings, and how often. And who outside the firm sees the result.

## What a regulator contributes

Exactly these obligations. Client asset rules, reconciliation requirements, reporting, and inspection.

That is not glamorous and it is the control that maps to the actual loss distribution. [A regulated venue rather than an unlicensed one](https://collectnexchange.cy/compliance/cysec-licensed) is addressing the larger category.

## The uncomfortable implication

A customer cannot assess governance from outside. You can read terms, check a register, and ask questions, and you cannot audit a firm.

Which means the decision reduces to who supervises them and how much you leave there.

## The two controls available

Choose a supervised venue and limit the balance. [Exchanges that publish where client assets are held](https://collectnexchange.cy/services/crypto-custody) make the first easier; nothing substitutes for the second.

[Collect & Exchange, which is licensed in Cyprus](https://collectnexchange.cy/), is inside a framework built around the boring failures rather than the dramatic ones.

---

This article explains how something works. It is not financial advice.
Canonical HTML version: https://custodywatch.com/operational-risk-beats-hacking/