INDUSTRY FACT FILE · BLOCKCHAIN, WEB3 & VIRTUAL DIGITAL ASSETS

Cybersecurity FAQs for Blockchain, Web3 and VDA Businesses

Forty frequently asked questions and answers in five categories, written for Boards and founders, CISOs and Principal Officers, engineering and protocol teams, treasury and custody operations, and fraud, privacy and response teams.

In this document 1.  Category 1: Cyber risk, governance and strategy 2.  Category 2: FIU-IND, CERT-In and regulatory requirements 3.  Category 3: Smart contracts, apps and infrastructure 4.  Category 4: Wallets, custody and signing operations 5.  Category 5: Fraud, AML technology, privacy and incident response

Audience: Boards, founders, CEOs and business leadership

Q1. Why are digital asset businesses such frequent targets?

Because stolen keys turn directly into money that moves in minutes and cannot be recalled. State-linked groups, fraud networks and phishing crews all target exchanges, custodians, protocols and their users, and Chainalysis estimates more than US$3.4 billion was stolen in 2025.

Q2. What are the biggest cyber risks for a VDA or Web3 business?

Compromise of keys, signers and hot wallets, tampered signing interfaces, smart contract and upgrade flaws, bridge and node attacks, account takeover, developer and supply chain compromise, mule accounts and slow detection that misses CERT-In's six-hour window.

Q3. Which public incidents should leadership know about?

WazirX's loss of more than US$230 million in July 2024, CoinDCX's loss of about US$44 million in July 2025, the theft of about US$1.5 billion from Bybit in February 2025 and the Ronin, Wormhole and Nomad bridge thefts of 2022.

Q4. Is digital asset security an IT problem or a leadership problem?

A leadership problem. A single theft can threaten solvency, FIU-IND registration and banking relationships at once. Boards must set limits on hot wallet exposure, approve custody and signing policies, fund audits and monitoring and see evidence that they work.

Q5. What should the Board review each quarter?

Hot and operational wallet exposure, custody and signing policy exceptions, audit findings and closure, smart contract audit status, SOC coverage, incidents reported to CERT-In, FIU-IND compliance status, vendor risks and progress on ISO 27001 and DPDP.

Q6. Who should own cybersecurity in a digital asset business?

A CISO working with the Principal Officer, treasury and custody operations, engineering, fraud and the data protection officer, with a clear Board mandate, a single inventory of wallets, keys, contracts and vendors, and regular reporting.

Q7. How should we prioritise investment?

Protect keys and signers first, then inventory and monitor every wallet, audit contracts and upgrades, secure apps, APIs and developer pipelines, assess vendors, and build 24x7 monitoring and forensic readiness, adding ISO 27001 or SOC 2 over successive cycles.

Q8. How can Codec Networks help?

Codec Networks provides smart contract audits, custody and signing reviews, exchange and node testing, CERT-In empanelled audits that support FIU-IND registration, AML technology reviews, managed SOC with on-chain monitoring and blockchain forensics with fund tracing after an incident.

Audience: CISOs, Principal Officers, compliance, legal and audit teams

Q9. Which VDA businesses are reporting entities under the PMLA?

The March 2023 notification covers exchanging VDAs with fiat or other VDAs, transferring them, safekeeping or administering them or the instruments that control them, and issuer-related financial services, when done for or on behalf of others in the course of business.

Q10. Do offshore platforms serving Indian users need to register?

FIU-IND treats the obligations as activity-based and applicable regardless of physical presence in India. It issued notices to nine offshore exchanges in December 2023, imposed penalties on Binance and Bybit, and reported notices to 25 offshore providers in October 2025.

Q11. What cyber security audit does FIU-IND registration call for?

FIU-IND's circular of 15 September 2025, as widely reported, requires a cyber security audit certificate from a CERT-In empanelled auditor for registration and continued registration. Confirm the current scope and frequency in FIU-IND's registration requirements before scheduling the audit.

Q12. What changed in FIU-IND's 2026 Guidelines?

The 8 January 2026 Guidelines consolidate registration, require a Principal Officer based in India, tighten due diligence with liveness and geo-tagging, operationalise the travel rule in real time, address unhosted wallets and mixers, and require tamper-proof audit trails and annual independent audits.

Q13. What do CERT-In's Directions require of VDA businesses?

Virtual asset service providers, exchanges and custodian wallet providers must keep KYC information and financial transaction records for five years, report cyber incidents within six hours of noticing them and keep ICT logs for 180 days in India.

Q14. How does the tax regime affect security?

The 30% tax and 1% TDS on VDA transfers depend on accurate transaction, deduction and reporting records. Those records must be complete, tamper-evident and available, so their integrity is a security as well as a tax matter.

Q15. Does the DPDP Act apply to KYC data?

Yes. KYC images, identity documents, contact details and transaction histories are personal data. Organisations need lawful purposes, notices, reasonable safeguards, retention aligned with their legal record duties and breach intimation, with most DPDP Rules obligations applying from May 2027.

Q16. Can Codec Networks carry out the audit FIU-IND calls for?

Codec Networks is CERT-In empanelled for information security auditing services. Each proposal confirms eligibility and independence against FIU-IND's and CERT-In's current requirements, and Codec Networks does not audit systems it has designed or operates for the client.

Audience: CTOs, protocol engineers, developers and DevOps teams

Q17. What does a smart contract audit cover?

Manual line-by-line review of business logic, access control, upgrade and admin functions, external calls and oracle use, supported by static analysis, symbolic execution and fuzzing, with findings rated by severity and fixes verified before deployment.

Q18. Which chains and tools does Codec Networks use?

Codec Networks audits contracts on Ethereum and EVM chains such as Polygon, and on Solana, using manual review supported by tools such as Slither, Mythril, fuzzing frameworks and Tenderly simulation, alongside the team's own test cases.

Q19. Is one audit before launch enough?

No. Every upgrade, new module or integration changes the risk. Audit each release, keep invariant tests and fuzzing in continuous integration, timelock upgrades so users and monitors can react, and monitor deployed contracts for abnormal calls.

Q20. How should admin and upgrade keys be protected?

Hold them in multisig or MPC arrangements with independent signers, use hardware devices, timelock upgrades, separate pause rights from upgrade rights, document who can act and rehearse emergency procedures, because whoever holds them controls the protocol.

Q21. How do we secure bridges and validators?

Raise the number of independent keys needed to move funds, harden and segment validator hosts, monitor bridge contracts and withdrawals in real time, cap withdrawal rates and test the bridge's verification logic as rigorously as any smart contract.

Q22. What should we test in exchange apps and APIs?

Authentication, session handling and account recovery, authorisation on every API, scoping and storage of trading API keys, rate limits, withdrawal address changes, mobile app integrity and resistance to bots, emulators and credential stuffing.

Q23. How do we protect developers and pipelines?

Manage and monitor developer devices, keep secrets out of code and pipelines, verify packages and front-end code integrity, restrict production access, train staff on fake recruiter and malicious coding test lures, and review pipelines as part of every audit.

Q24. How should nodes and RPC providers be handled?

Harden and patch self-run nodes, restrict administrative access, cross-check critical chain data with more than one source, assess third-party RPC providers and monitor for abnormal responses that could indicate spoofed balances or transactions.

Audience: Treasury, custody operations, signers and security architects

Q25. How should hot, warm and cold wallets be balanced?

Keep only what instant withdrawals need in hot wallets, set Board-approved limits, refill from warm or cold storage under policy, and monitor every balance. The right split depends on volumes, but exposure in hot wallets should be deliberately small.

Q26. MPC or multisig: which is safer?

Neither is safe by itself. Both depend on independent signers, protected devices and shares, clear policies and, above all, signers who can verify what they approve. Choose based on operations and supported chains, then test the whole signing process.

Q27. How do we stop signers approving a tampered transaction?

Decode every transaction independently of the interface that proposed it, use hardware signers that show full call data, enforce allow-lists, limits and time-locks in policy, and require a second check for any transaction that changes wallet logic or ownership.

Q28. Should we rely on third-party custody software?

Many platforms do, but it becomes part of your attack surface. Assess the vendor, understand how its interface and code are delivered, monitor for changes, keep independent verification of transactions and define who responds if the vendor is compromised.

Q29. What about operational wallets on partner venues?

Treat them as treasury. Include them in the wallet inventory, apply the same custody policy, protect their credentials in a secrets manager, set limits and monitor them on-chain, because unmonitored operational accounts are an easy route to a drain.

Q30. How should key ceremonies be run?

Plan them in writing, use certified HSMs or approved devices, separate duties among independent participants, record and witness each step, store backups under dual control in separate locations and rehearse recovery and key compromise procedures.

Q31. How do we manage insider risk in custody?

Apply least privilege and privileged access management, require dual control for sensitive actions, vet staff in critical roles, monitor administrator and signer activity, and remove access promptly when people change roles or leave.

Q32. How does Codec Networks review custody?

Codec Networks reviews wallet architecture, MPC, multisig and HSM configurations, signing policies and tooling, key ceremony records and operational wallets, then red teams withdrawal paths and signer processes to see whether a realistic attacker could move funds.

Audience: Fraud, risk, compliance, privacy, security operations and incident response teams

Q33. How do we defend onboarding against mule accounts?

Use liveness checks that resist injected video and emulators, verify devices, locations and bank accounts, look for reused identifiers across accounts, monitor early account behaviour and share intelligence with partners, in line with FIU-IND's due diligence expectations.

Q34. How should the travel rule be implemented securely?

Use technology that transmits originator and beneficiary information in real time, as FIU-IND's 2026 Guidelines expect, authenticate counterparties, encrypt messages, protect the personal data exchanged and test the integration like any other external API.

Q35. What should we do about unhosted wallets and mixers?

Collect and assess information on transfers involving unhosted wallets, apply enhanced measures where risk is higher, screen addresses before withdrawals and do not facilitate transactions involving mixers or anonymity-enhancing tokens, as FIU-IND's Guidelines set out.

Q36. What should the SOC monitor in a digital asset business?

Every treasury, hot and operational wallet address, contract events and admin calls, unusual withdrawals and address changes, account takeover and API abuse signals, privileged and developer activity, cloud and node alerts and relevant CERT-In advisories.

Q37. What should we do in the first hour after a theft?

Contain by pausing affected wallets or contracts, preserve evidence, start on-chain tracing, alert other platforms and partners to freeze funds where possible, report to CERT-In within six hours, inform FIU-IND and law enforcement as required and communicate carefully.

Q38. Can stolen digital assets be recovered?

Sometimes, partly. Fast tracing, cooperation with exchanges that can freeze deposits, law enforcement action and negotiated returns have recovered funds in some cases, but recovery is uncertain, so prevention and rapid detection matter far more.

Q39. Should we run theft and crisis exercises?

Yes. Annual tabletops with leadership, treasury, engineering, compliance, legal and communications, using signer compromise, contract exploit and data exposure scenarios, test decisions on pausing, reporting, user communication and banking partners before a real incident.

Q40. How can we start with Codec Networks?

Begin with a scoping call on your platform, wallets, chains, contracts, partners and audit cycle; Codec Networks will propose a practical audit, testing and monitoring plan mapped to FIU-IND, CERT-In and DPDP expectations.

Contact Codec Networks Pvt. Ltd. New Delhi: 507, 5th Floor, New Delhi House, Barakhamba Road, Connaught Place, New Delhi – 110001 Gurugram: 707, 7th Floor, Silverton Tower, Golf Course Extension Road, Sector 50, Gurugram – 122018, Haryana Landline: 011 430 496 96 | 011 437 522 99   Mobile: +91 99716 76124 | +91 88007 88220 | +91 88003 31124 Email: mktg@codecnetworks.com   Web: www.codecnetworks.com

Note: These FAQs provide general guidance as of October 2026 and do not constitute legal, tax, regulatory or investment advice. Confirm obligations against the official instruments applicable to your organisation, your VDA activities and FIU-IND registration, the countries you serve and your contracts.