Unauthorized Transfer From a Company Treasury Wallet
A departing employee with prior signing authority on a company multisig treasury wallet initiated a transfer of a significant balance shortly before their departure was finalized.
The Situation
A departing employee with prior signing authority on a company multisig treasury wallet initiated a transfer of a significant balance shortly before their departure was finalized.
The Challenge
Because the individual had legitimate historical access, distinguishing an authorized but undisclosed transfer from outright theft required reviewing internal authorization records alongside the blockchain data.
The Investigation
We reconstructed the full signing history of the multisig wallet and compared the disputed transaction against the company's stated approval policy.
Findings
The transaction carried only one of the two signatures required under company policy, and the receiving wallet had no prior connection to any known vendor or company purpose.
Outcome
Findings were delivered to the company's counsel to support an internal investigation and a potential civil claim against the former employee.
Lessons
Multisig wallets reduce risk but do not eliminate it. Reviewing signer lists immediately upon any change in personnel is a necessary operational habit.
Treasury Multisig
Company wallet governing the disputed transfer.
Facing a similar situation?
Every case is scoped on its own facts. Tell us what happened.