Institutions lose digital assets in six recurring ways: key loss or destruction, custodian failure or insolvency, signer unavailability when a multisig or MPC quorum cannot be met, infrastructure outage, insider threat, and external exploit. Most losses are not exotic. They are governance and operational failures that were foreseeable and, in many cases, addressable with a recovery path set up in advance.

This page is a working taxonomy for security and infrastructure leaders. For each failure mode you will find a direct definition, how it happens in practice, at least one verified public example, and an honest account of what a recovery path set up in advance would and would not do in that scenario. The goal is not to sell an outcome. It is to help you map your own exposure against how losses actually occur.

Circuit Security is not a custodian and cannot access, use, or reconstruct your keys. Where we reference our own capability below, we are describing a recovery plan set up before an incident, not post-hoc fund tracing and not a way to reverse a theft an attacker has already completed.

What is a digital asset failure mode?

A failure mode is a distinct way in which an institution loses the ability to control or move its digital assets. It is defined by mechanism, not by outcome. Two incidents with the same dollar loss can sit in completely different failure modes: one exchange might lose assets because a private key was destroyed, another because an attacker signed a fraudulent transaction. The distinction matters because the controls that prevent, contain, or recover from each mode are different. Prevention-only custody addresses some modes well and others barely at all.

The six modes below are not mutually exclusive. Real incidents often chain them: an external exploit exposes weak signer governance, or an insolvency reveals that keys were already lost. When you classify your own risk, classify by root cause, not by the headline.

Mode 1: How does key loss or destruction happen?

Direct answer: Key loss or destruction is the permanent loss of the private key material, seed phrase, or key shard needed to authorize transactions, with no compromise by an attacker. The assets remain on-chain and visible, but no one can move them.

How it happens. A sole key holder becomes unavailable and left no recoverable backup. Physical backup devices are lost, damaged, or destroyed. A seed phrase is stored in one place and that place fails. Poorly documented legacy wallets are orphaned during staff turnover or a migration to new infrastructure. The common thread is that key material has a single point of failure and no tested recovery path.

Verified example. Prime Trust, a Nevada-chartered crypto custodian, told a Delaware bankruptcy court in 2023 that it had lost access to a legacy Ethereum wallet after losing the physical hardware devices holding the wallet's recovery information. Blockchain analysis firm Arkham estimated the inaccessible wallet held more than $45 million in assets. Prime Trust later used customer funds to meet withdrawals it could not otherwise fund, contributing to a customer fiat shortfall reported at over $82 million. (Source: Delaware bankruptcy filings, August 2023; Decrypt; Unchained; Blockworks.)

What a recovery path set up in advance would do. This is the mode that approach is built for. Circuit's Recovery product is powered by Automatic Asset Extraction, and in search terms this is known as keyless recovery: recovery that does not depend on your private keys. If sweep transactions to pre-approved vaults are pre-signed and continuously updated before any incident, loss of the day-to-day signing key does not strand the assets, because moving them does not depend on that key being available at the moment of need. For the case where the key material itself is gone and you truly need it back, Circuit's third product, Key Backup, is the trustless encrypted backstop that holds that material (encrypted so only you can decrypt it), set up before the loss. The honest limit: the recovery path itself must be established and maintained before the key is lost. It is a plan set up in advance, not a way to reconstruct destroyed key material after the fact.

Mode 2: What happens if a crypto custodian fails or becomes insolvent?

Direct answer: Custodian failure or insolvency is the loss of practical access to assets held by a third party when that party goes bankrupt, is placed into receivership, freezes withdrawals, or commingles and misappropriates client funds. The assets may still exist, but the institution's claim on them is now a legal question, not an operational one.

How it happens. A custodian or exchange commingles client assets with its own, lends them out, or uses them to cover operating losses. When redemptions spike, the shortfall is exposed and withdrawals halt. Bankruptcy converts a direct claim on specific assets into an unsecured creditor claim that can take years to resolve and often recovers cents on the dollar.

Verified example. FTX filed for bankruptcy on November 11, 2022 after commingling customer funds with affiliated trading firm Alameda Research. Reporting placed customer funds affected in excess of $10 billion, with a reported balance sheet showing roughly $9 billion in liabilities against far less in liquid assets. (Source: FTX bankruptcy filings; CFTC, 2022 to 2024. Later reporting indicates the estate repaid creditors at 100 percent or more of their petition-date November 2022 dollar value, which does not restore the original loss of access, and creditors did not benefit from later price appreciation.) A second example: Celsius reached a $4.7 billion settlement with the US Federal Trade Commission in 2023, and its founder Alex Mashinsky later pleaded guilty to fraud in 2024 and was sentenced to 12 years in prison in 2025. (Source: US FTC, 2023; US DOJ SDNY; CNBC, 2024 to 2025.)

What a recovery path set up in advance would do. This mode is primarily a governance and counterparty-risk problem, and no recovery product changes the terms of a bankruptcy. What a recovery path set up in advance changes is the institution's own posture: if you self-custody or co-custody and hold your own keys, you retain the ability to move assets to pre-approved vaults on your own signal rather than waiting on a failing counterparty. The honest limit: if a third party holds your keys and misappropriates the assets, recovery cannot claw them back. The lesson this mode teaches is about who holds the keys and whether you have a path to act independently. See recovery vs backup for why holding a copy of data is not the same as retaining the ability to act.

Mode 3: What happens when a multisig or MPC quorum cannot be met?

Direct answer: Signer unavailability is the inability to reach the threshold of signers required to authorize a transaction. In a 3-of-5 multisig or MPC scheme, if enough key holders or shards become unavailable that the threshold can no longer be met, the assets are frozen even though no attacker is involved and every remaining key is intact.

How it happens. Signers leave the organization without proper offboarding. A key holder dies or becomes incapacitated. Shards are stored on devices that are lost or fail simultaneously. A geographic or organizational concentration means one event takes out multiple signers at once. Quorum schemes are designed to tolerate the loss of some signers, but only up to a documented threshold, and only if a path back to quorum was planned in advance. See MPC wallets.

Verified example. The clearest public illustration of access lost to signer unavailability is QuadrigaCX. When founder Gerald Cotten died in December 2018, the company said it could not access roughly US$190 million (C$250 million) in cryptocurrency owed to about 115,000 customers, because Cotten alone held the passwords to the cold wallets. (Source: NPR; Ontario Securities Commission staff review, June 2020.) Note the honest complication: the OSC staff review found that most of the shortfall, roughly C$115 million of client losses, traced to Cotten's fraudulent conduct rather than pure lost access, so this incident spans both this mode and insider threat. It remains the canonical example of what a single unavailable key holder does to access.

What a recovery path set up in advance would do. A well-designed recovery path treats quorum deadlock as a first-class failure mode. Because sweep transactions to pre-approved vaults are pre-signed while quorum still exists and continuously updated, the institution retains a documented path to move assets even if the routine signing quorum later becomes unreachable. The honest limit: this only works if the recovery path was established while quorum could still be met. It does not conjure a new threshold out of keys that no longer exist. The design principle is to never let the ability to act depend on assembling a quorum you may not be able to assemble in a crisis.

Mode 4: What happens during an infrastructure outage?

Direct answer: An infrastructure outage is the temporary loss of the ability to transact because supporting systems, cloud providers, signing services, or network connectivity are unavailable. The assets and keys are safe, but the operational path to move them is down.

How it happens. Despite the industry's decentralization narrative, most large exchanges, custodians, and signing platforms depend on a small number of centralized cloud regions. A single data-center fault, a cloud region failure, or an outage at a hosted signing or custody provider can freeze deposits, withdrawals, and internal transfers across many institutions at once. Outages are usually recoverable, but the window matters: an institution that cannot move assets during a market dislocation or an active incident is exposed even if the outage is temporary.

Verified example. On May 7, 2026, Coinbase experienced a multi-hour outage after multiple chiller units failed in a single data hall in AWS's us-east-1 region, triggering a thermal-safety shutdown. Coinbase's own postmortem described trading, deposits, and withdrawals as unavailable or degraded for roughly eight hours, with full system recovery taking longer. (Source: Coinbase postmortem blog; CoinDesk; InfoQ, 2026.) An earlier April 15, 2025 AWS disruption briefly affected Binance and KuCoin withdrawals. (Source: CoinDesk, April 2025.)

What a recovery path set up in advance would do. Outage resilience depends on not routing your emergency recovery path through the same infrastructure that is failing. A recovery path that does not depend on a live signing quorum or a single hosted service at the moment of need reduces the chance that an outage and a recovery need coincide catastrophically. The honest limit: this is architectural, not magical. If your recovery path shares a hard dependency with the systems that went down, it goes down too. The design goal is independence of the recovery path from routine operating infrastructure. See incident response for how outage windows fit into a broader response plan.

Mode 5: How does insider threat cause asset loss?

Direct answer: Insider threat is the loss of assets through the actions of a person with legitimate access: fraud, embezzlement, misappropriation, or deliberate sabotage by an employee, executive, or privileged operator. Unlike an external hack, the actor is authorized, which is what makes the mode so hard to prevent with perimeter controls.

How it happens. An executive with signing authority moves client assets for personal benefit or to cover losses. A privileged operator abuses access to route funds to an address they control. Concentration of control in one person, weak separation of duties, and the absence of independent oversight of large movements are the recurring preconditions. Insider threat frequently hides inside an insolvency: the shortfall only surfaces when the entity fails.

Verified example. Celsius founder and CEO Alex Mashinsky used customer assets for undisclosed risky bets and manipulated the price of the CEL token, profiting personally. He pleaded guilty to fraud in 2024 and was sentenced to 12 years in prison in 2025. Celsius itself reached a $4.7 billion settlement with the US Federal Trade Commission in 2023. (Source: US DOJ SDNY press release; US FTC, 2023; CNBC, 2024 to 2025.) The QuadrigaCX case (Mode 3) is also substantially an insider-fraud case per the Ontario Securities Commission staff review.

What a recovery path set up in advance would do. This is the mode where honesty matters most. If an authorized insider signs a valid transaction and moves assets to an address they control, that is a completed transfer by someone with legitimate authority, and a recovery path cannot reverse it any more than it can reverse an external theft. What a well-governed recovery design contributes is structural: pre-approved destination vaults constrain where assets can be swept, and separating the recovery path from any single individual reduces the blast radius of one privileged actor. The honest limit: recovery is not an anti-fraud control and does not substitute for separation of duties, independent oversight of large movements, and real governance. See Response for containment and Recovery for the recovery path set up in advance.

Mode 6: What happens during an external exploit or hack?

Direct answer: An external exploit is the theft of assets by an unauthorized attacker who compromises keys, signing processes, smart contracts, or the humans who operate them, then signs transactions that move assets to attacker-controlled addresses.

How it happens. Attackers compromise a developer machine or a signing interface so that operators approve a transaction that does not match what they believe they are signing. They exploit a vulnerable bridge or contract. They socially engineer a privileged employee. State-affiliated groups such as Lazarus have industrialized these techniques against crypto institutions. The defining characteristic is that the attacker gets a valid signature on a malicious transaction, often by making the malicious transaction look benign to the signer.

Verified examples. On February 21, 2025, Bybit lost roughly $1.4 billion to $1.5 billion (about 401,347 ETH) from a cold wallet after attackers compromised a Safe{Wallet} developer machine and altered what signers saw when approving a transaction, the largest crypto theft on record. (Source: NCC Group; BleepingComputer; FBI attribution to Lazarus, 2025.) On July 18, 2024, WazirX lost roughly $230 million to $235 million from a multisig wallet under a Liminal custody arrangement, again via a discrepancy between the displayed and actual transaction. (Source: CoinDesk; Wikipedia; Halborn, 2024.) In March 2022, the Ronin bridge lost about $625 million after attackers gained control of a majority of validator keys. (Source: CoinDesk; Halborn, 2022.)

What a recovery path set up in advance would do. This is the sharpest honest limit on this page. A recovery path set up in advance does not undo a completed theft. Once an attacker controls the assets at a new address, they are gone; recovery is not fund tracing and not clawback. What that recovery path can do is act before the attacker completes their objective in scenarios where you retain the ability to move assets first: if compromise is detected and your pre-signed sweep to a pre-approved vault can move assets out of the exposed wallet faster than the attacker can drain it, you contain the loss. That is why speed matters. Circuit's Response product is designed to contain attacks in under 2 seconds. The honest framing: recovery and response reduce the window in which an attacker can succeed and preserve assets you still control. They do not reverse the transactions of an attacker who has already won. See digital asset recovery for the full definition.

Summary: the six failure modes at a glance

• 1. Key loss or destruction (key material permanently lost, no attacker). Example: Prime Trust legacy wallet, ~$45M inaccessible. Recovery helps: yes, this is the core case, if the recovery path was set up before the loss.
• 2. Custodian failure or insolvency (third party fails, freezes, or misappropriates). Example: FTX, over $10B affected; Celsius, $4.7B FTC settlement. Recovery helps: partial, only if you hold your own keys and can act independently.
• 3. Signer unavailability, or quorum deadlock (threshold of signers cannot be reached). Example: QuadrigaCX, ~$190M access lost. Recovery helps: yes, if the recovery path was set while quorum still existed.
• 4. Infrastructure outage (supporting systems or cloud down). Example: Coinbase AWS outage, ~8 hours, May 2026. Recovery helps: partial, only if the recovery path is independent of the failed infrastructure.
• 5. Insider threat (authorized person defrauds or misappropriates). Example: Celsius, Mashinsky convicted 2025. Recovery helps: no for completed transfers, with structural limits on blast radius only.
• 6. External exploit or hack (attacker signs malicious transactions). Example: Bybit, ~$1.5B, February 2025; Ronin, ~$625M. Recovery helps: partial, only if you can move assets before the attacker completes the theft.

Honest limits of recovery

A recovery path set up in advance is not a universal undo button. Stated plainly:

• It must be established and continuously maintained before an incident. It cannot be applied retroactively to a key already destroyed or a quorum already lost. Key Backup only helps if the material was backed up before the loss; it cannot restore key material that was never stored.
• It does not reverse completed transactions. An attacker who controls the assets, or an insider who has signed a valid transfer, has moved the assets; recovery is not clawback and not fund tracing.
• It does not change the terms of a third party's bankruptcy. It changes your own ability to act if you hold your own keys.
• It is not a substitute for governance. Separation of duties, independent oversight of large movements, and tested procedures remain essential.
• Its resilience depends on independence. A recovery path that shares a hard dependency with the systems that fail will fail with them.

What it does provide is a path, set up in advance, to move assets to pre-approved vaults without depending on a private key being available, a quorum being assemblable, or a counterparty cooperating at the moment of need. That closes the gap that prevention-only custody leaves open: what happens after something goes wrong.

Frequently asked questions

What happens if a crypto custodian fails?
If a custodian fails or becomes insolvent, your direct claim on specific assets typically converts into an unsecured creditor claim resolved through bankruptcy or receivership, which can take years and often recovers a fraction of the original value. The assets may still exist, but your operational access is replaced by a legal process. Institutions that hold their own keys and maintain an independent path to move assets are not dependent on a failing counterparty to act.

Can recovery undo a hack?
No. A recovery path set up in advance does not reverse a completed theft. Once an attacker controls the assets at their own address, recovery cannot claw them back and is not fund tracing. Recovery and response reduce the window in which an attacker can succeed by letting you move assets you still control to pre-approved vaults before the attack completes.

Is losing a private key the same as being hacked?
No. Key loss or destruction (Mode 1) involves no attacker: the assets are safe on-chain but unmovable because the authorizing key material is gone. An external exploit (Mode 6) involves an unauthorized attacker signing malicious transactions. The controls differ, which is why classifying by root cause matters.

Does recovery mean Circuit holds my keys?
No. Circuit is not a custodian and cannot access, use, or reconstruct your keys. Automatic Asset Extraction (AAE) powers Circuit's Recovery product for institutional digital assets. It uses pre-signed, continuously updated transactions to sweep assets to pre-approved vaults when wallets are compromised or inaccessible, without requiring access to private keys.

Which failure mode is most common?
There is no single answer, and it varies by year and entity type. External exploits produce the largest single-incident headlines, while insolvency and insider fraud account for very large aggregate losses. Key loss and signer unavailability are underreported because affected institutions often resolve them quietly or reframe them as insolvency. A structured dataset that classifies incidents by root cause is the only reliable way to answer this, which is why classifying by mechanism, not headline, is the discipline this page recommends.