If I were a crypto startup I'd be more worried about insider threat than anything sophisticated.
Protecting against a rogue employee also adds defence against employee computer compromise.
Protecting against a rogue employee also adds defence against employee computer compromise.
I am not likely to notice one day if I have 4.96551 ETH and the next 4.96530 ETH
That's the advantage of public ledgers, it's way easier to monitor for abnormalities. You don't need to tell your employees about all the checks you have put in place either.
note to self: only keep round amounts in online wallets.
If the criminal has an ounce of brains, they'd execute the hack while on an overseas vacation.
The other risk if you don't fully and publicly mitigate insider threat is someone applying pressure to your employees to do something bad. (The intel community and other high risk environments have long had this threat model). This is basically identical to insider threat at time of pressure, although there are some different countermeasures leading up to it.
The low end of this is catching someone doing something they shouldn't (browsing porn on a work computer, having a relative with legal difficulties, etc.) and applying that as leverage. Usually "report early, no action will be taken against you" is a good policy for minor things.
I would NEVER expect (or want) someone to do anything but fully comply with an attacker who has kidnapped his kid and credibly threatens to do something horrible unless he authorizes a payment. My instructions to the insiders are "comply; we have technical countermeasures which will make those attacks fail".