Drift Protocol · April 2026
A 2-of-5 multisig with zero timelock and arbitrary oracle assignment. Governance architecture, not contract logic.
Money movement attack paths
Prove who can move the money.
MoveProof models every route from organisational access to funds leaving — identity and cloud, through code and policy, to signature and contract. Then it proves which routes actually work, and hands you the fix.
Illustrative. Every path shown crosses at least three systems that no single vendor models together.
$953Mlost to access-control failure in 2026
15×more than every contract bug combined
76%of losses come from the operational layer
0products model the full path
The blind spot
The industry audits the small number.
Every incentive in crypto security points at contract logic — reentrancy, arithmetic, flash loans. That is where auditors look and where bounties pay. It is also where almost none of the money goes.
StablR · May 2026
A 1-of-3 multisig was the single point of failure in the minting infrastructure — of a MiCA-regulated issuer.
Both parameters sat in public state for months. Neither needed an exotic exploit. No product was watching the authority that produced them, because no product models it.
The category
We are not building a better scanner. We are defining a unit of security nobody owns end to end.
Money Movement Attack Paths
Every viable route from organisational access to funds leaving — identity and cloud, through code and policy, to signature and contract.
not this
Multisig security
A component in the path, not the path.
not this
Policy scanner
One vendor's rules, in isolation.
not this
Cloud attack paths
Stops at the cloud boundary.
not this
Transaction monitoring
Starts once the money is already moving.
What is the minimum path by which one compromised person, machine or account can cause $200M to leave — and how many of the steps require genuine human approval?
That is the only question we answer, and the only one we optimise for.
The product
Findings ranked by the money that can leave, and the humans who cannot stop it.
Not a severity list. The two numbers a Head of Custody actually acts on.
Findings
sorted by value at risk · 4 systems joined · 11 chains
$341.6M
value at risk
2
zero-human paths
5
authority drift
128
modules passed
| Sev | Path | Starts at | Humans | Value at risk | Proof |
|---|---|---|---|---|---|
| CRIT | ci-deploy → svc-trading → policy #3 → MPC → out | aws / iam role | 0 | $341,604,882 | executed ✓ |
| CRIT | gh-maintainer → callback code → co-signer → out | github / repo | 0 | unbounded | executed ✓ |
| HIGH | idp-admin → MFA reset → console → whitelist | okta / admin | 1 | $12,400,000 | path proven |
| HIGH | Two approvers share one IdP administrator | okta / group | 1 | $88,200,000 | computed |
| HIGH | Infinite approval to upgradeable spender | safe / DeFi ops | 0 | $18,900,000 | executed ✓ |
| MED | Whitelist entry added by departed employee | custody / wl[7] | — | — | confirmed |
| PASS | Cold vault egress · all combinations | custody / Cold | 2 | — | 128 cases |
Findings. The Path column shows the chain itself, not an isolated observation. Humans is the only number that must be above zero.
Why now
Regulation just turned authority into an evidentiary obligation.
DORA
Independent, not self-assessed
ICT third-party risk requires independent validation. A custodian can prove its engine followed its settings. Only an outside party can prove the settings, identities, dependencies and code together do not create a bypass.
Drift
Invisible to an engagement
Correct at audit. Then a signer leaves, a role widens, a delay is shortened for a migration and never restored. An annual review structurally cannot catch this.
$3.4B
Stolen in 2025 alone
Roughly half of all realised losses since 2022 trace to key compromise, phishing and social engineering rather than contract logic. Spend and losses point in different directions.
Request an assessment
Find out how many humans stand between one compromised account and your treasury.
Read-only, model-only, inside your own environment. One artifact at the end: the shortest path, the amount exposed, and the effective human count.
Platform
One graph. One decision function. One proof.
Every competitor holds a slice of the authority that moves money. Nobody holds it joined — and the vulnerability is almost always in the join.
Digital Asset Authority Graph
Four layers, modelled together.
identity & access
- Employees and identities
- Groups and permissions
- Okta / Entra
- MFA and recovery paths
build & cloud
- GitHub and CI/CD
- AWS · Kubernetes
- KMS and Secrets
- Deploy paths
signing
- API co-signers
- Code that creates and approves transactions
- MPC / multisig signers
policy & chain
- Custody policy
- Whitelisted addresses
- Allowances and contracts
- Proxy admins · upgrade keys · timelocks
two real path shapes
GitHub maintainer→changes callback code→CI/CD deploys→co-signer approves→policy matches→MPC signs→contract transfers $80M
Okta admin→resets MFA for an employee→gains custody console access→adds whitelisted address→broad rule auto-approves→funds leave
The proof
A forked transaction is not a differentiator. The full chain from identity to money is.
Transaction simulation already ships with every custodian. Our proof begins three or four steps earlier.
01
assume
Start from a defined blast radius: this identity, this role, this pipeline, this device.
02
reach
Compute the access that identity actually has — through IAM, through the application, through build paths.
03
alter
Exploit or change a policy, a code path or an approval state — whatever the reach permits.
04
sign
Cause a co-signer or a human approver to sign — or find the route that needs neither.
05
execute
Run the resulting transaction against forked state on an isolated twin. Nothing touches production.
06
prove
Emit a replayable trace: the amount, the hash, and the effective number of humans in the loop.
Steps 1 to 4 are the differentiator. Everyone can do step 5.
The engine
A checkable proposition, not a model's opinion.
We compile permissions and policy into a model that can be computed over — and contradicted. The engine answers eight questions.
Who may initiate · who may approve · who may change the policy · which rule wins · which rule is shadowed · which amounts and destinations pass · how many factors are genuinely independent
And the one that catches real organisations: whether two approvers are in fact controlled by one account, pipeline or administrator. Two approvers who authenticate through the same identity-provider admin are one approver.
theorem · checkable proposition
Under assumptions {ci-deploy compromised, whitelist unchanged}, identity svc-trading can cause the transfer of $341,604,882 with 0 additional human approvals.
On language: version one performs exhaustive verification over a bucketed decision space, not automated theorem proving. We say so because a claim you cannot defend is worse than a smaller claim you can.
Inside the product
The path, opened.
The attack chain on one side, the executed proof beneath it, and the fix split by the team that owns each change.
CRIT Zero-human egress path from a build identity
aws → custody → chain · 41d old · effective human approvals 0 · value at risk $341,604,882
Attack chain
1
aws iam — role ci-deploy can read the secret holding API key svc-trading
2
github — the same role is assumable from any workflow on main
3
policy rule #3 — Allow | src=Trading | dst=any-whitelisted | amount=ANY
4
policy rule #11 — amount > 250k requires 2 approvers — never evaluated, rule #3 matched first
5
callback handler — approves any whitelisted destination, no amount ceiling
6
whitelist[7] — 0x8b1c…44af added 14 months ago by a departed employee
→
MPC SIGNS · 0 HUMANS
$ moveproof prove MP-2026-0417 --twin blast radius: ci-deploy compromised reach → alter → sign → execute on forked state EXECUTED 0x9c4e…7f21 moved $341,604,882 humans 0 trace → proof-9c4e7f21.json (replayable)
Remediation — 4 systems
+ policy: move rule #11 above rule #3
+ handler PR: ceiling
MAX_AUTO = 250_000− terraform PR: drop
ci-deploy from the secret policy+ whitelist: 180-day expiry + quorum on change
after fix: the same proof FAILSre-run on the twin · zero-human paths 2 → 0
Ownership
2 changes → platform (code, terraform)
2 changes → treasury ops (policy, quorum)
A path, opened. The struck-through line is the control everyone believes exists. It is never evaluated, because a broader rule matched first.
The policy replica
Rules look correct read one at a time. They break in combination — and combinations cannot be read, only computed.
Transaction policy — as evaluated
rules are matched top-down · the first matching rule is the only one that runs
| # | Action | Source | Destination | Asset | Amount | Initiator | Reached |
|---|---|---|---|---|---|---|---|
| 1 | Block | any | non-whitelisted | any | any | any | yes |
| 2 | 2 approvers | Cold | any | any | any | any | yes |
| 3 | Allow | Trading | any-whitelisted | any | ANY | svc-trading | shadows |
| … | … | … | … | … | … | … | — |
| 11 | 2 approvers | Trading | any | any | > 250,000 | any | never |
| 12 | 1 approver | Trading | any | any | > 50,000 | any | never |
| 13 | Allow | Gas | internal | native | < 500 | any | yes |
Egress search — 14,880 combinations evaluated
BLOCKED 11,204 75.3% NEEDS_HUMAN 3,674 24.7% ZERO-HUMAN 2 0.013% ← both unbounded path 1 Trading → wl[7] · any asset · no ceiling path 2 Trading → wl[3] · any asset · no ceiling shadowing rule ...... #3 controls bypassed ... #11, #12 exposure ............ $341,604,882
What-if · independence check
if
ci-deploy compromised → $341.6M · 0 humansif approver A compromised → $12.4M · 1 human
if IdP admin compromised → $88.2M · A and B collapse to 1
if cold signer device lost → blocked
Authority drift · 5
rule #3 amount ceiling removed 41d ago
ci-deploy granted secret read 63d ago
approver group −1 member 9d ago
proposed fix re-simulatedzero-human 2 → 0 · needs-human 3,674 → 3,676 · nothing else changed
The replica. The Reached column is the whole finding: it shows which rules are ever evaluated, and which are decoration.
Remediation compiler
Most of a fix is not code — so we compile a fix per system.
A path is closed by simultaneous changes in several places, each owned by a different team. "Fix as a pull request" is a good message and an incomplete product.
cloud & code
- Terraform pull request
- Callback handler pull request
- Corrected IAM policy
custody & chain
- Policy patch and rule reordering
- Safe transaction proposal
- Signer rotation plan
- Revoke-allowance transaction
- Timelock configuration change
always
- Rollback for every change
- A named owner per change
- Tests that prove the path closed
After the fix, the same proof fails.
That is remediation evidence, not a recommendation — and it is what an auditor, a regulator and an insurer can each act on.
Deployment
Read-only in. A pull request out.
Running adversarial tooling inside a regulated financial institution is a hard sell, and it should be. The system is built so a CISO can approve it.
Model by default
The graph and the replica run against a model, never production. Day one produces the headline number without touching a live system.
Live execution is opt-in
Approved per path, with signed authorisation and a maintenance window. Nothing runs on its own.
No key that can sign
Read-scoped credentials that never leave your environment. We hold nothing that can move funds — by construction.
Customer-hosted
One container in your own cloud. No secret values leave it. Every outbound call is written to an append-only audit log.
Request an assessment
Find out how many humans stand between one compromised account and your treasury.
Read-only, model-only, inside your own environment. One artifact at the end: the shortest path, the amount exposed, and the effective human count.
Approach
They analyse events. We verify the authority that creates them.
This map was built by searching for reasons not to start the company. We do not claim these vendors are careless — we claim each architecture and business model stops before the join.
| Who | What they genuinely do well | Where they stop |
|---|---|---|
| Hypernativeruntime threat prevention | Monitors ownership changes, multisig risk, governance and private-key threats across on-chain and off-chain sources, with automated response. | They evaluate events and transactions. They do not model the identity, cloud and code authority that can produce a legitimate-looking transaction in the first place. |
| Fireblockspolicy engine + inspector | Rules by source, destination, asset, amount, user and operation type, plus a policy inspector showing how a transaction is evaluated. | One tenant, and it treats configuration as intent. A vendor grading its own configuration is not independent assurance — which is a regulatory requirement, not a preference. |
| Halborn & auditorsdeep manual review | Expert point-in-time review of contracts and, increasingly, operational setup. | Revenue is per engagement, so continuity is not the product. No engagement catches the permission that widens four months later. |
| Cymulate & BAScontrol validation at scale | Mature adversarial simulation of enterprise security controls. | No model of custody policy, signers, allowances or upgrade authority. Their attack graph ends exactly where the money begins. |
| Blockaidpre-sign transaction risk | Assesses a specific transaction before it is signed. | Judges the transaction in front of it, not whether the organisation's authority allows that transaction to be produced without a human. |
| MoveProof | Proves every viable path from access to unauthorised movement, across every vendor in the stack. | Nowhere — the path is the product. Independent of any custodian, and the only party holding the full join. |
Discipline
What we will not build.
The fastest way to lose this category is to become a long feature list. Each of these is a deliberate refusal.
✕Real-time chain detectionHypernative has breadth, automated response and dozens of risk types. We do not compete there — we feed it.
✕A competing policy engineFireblocks, Fordefi and BitGo own that surface. We verify it from outside; we do not rebuild it.
✕A general pentest platformThe moment we test anything that is not a route to funds, we lose the category.
✕A general cloud scannerWe only care about cloud permissions that terminate at a signer or a key.
✕Breadth before depthThree deep paths on one stack beat fifty shallow checks on ten.
The difference in one sentence: they ask whether something suspicious is happening now. We ask whether the chain exists at all — before the event.
Focus
Three deep paths on one real stack.
01
Policy bypass
A combination of rules that lets an API co-signer approve an operation that was never supposed to pass.
02
Cloud to signer
An AWS, GitHub or CI permission that allows the code or configuration of a signing component to be changed.
03
Control plane to assets
An account or role that can change a signer, upgrade authority, whitelist or contract admin — and move money.
AWS + GitHub + Fireblocks + EVM
Extremely deep on one stack before any expansion. Then BitGo, Copper, Fordefi, Safe, in-house MPC, Azure, GCP, GitLab, Okta, Entra and Kubernetes — in that order, driven by design partners.
Request an assessment
Find out how many humans stand between one compromised account and your treasury.
Read-only, model-only, inside your own environment. One artifact at the end: the shortest path, the amount exposed, and the effective human count.
Research
We publish what we can prove.
Every path class we describe is one we have executed on a fork against real, public state. Findings against a named organisation are only ever published after coordinated disclosure and a fix.
in preparation
Shadowed controls in custody policy
How top-down, first-match rule evaluation causes amount ceilings and approver requirements to never execute — measured across public and consenting private tenants. Includes the exhaustive method and the reproduction harness.
in preparation
Effective approvers, not nominal approvers
A method for collapsing approvers that share a controlling identity, pipeline or device — and what it does to the assurance numbers organisations report today.
in preparation
From build permission to signature
The class of paths where a CI or repository permission reaches the code or configuration of a signing component. Read-only detection, and what the fix costs.
method
Our disclosure policy
Vendors and operators get 90 days and a reproduction before anything is published. We name a class before we name a company, and we publish the fix alongside the finding. See Security.
Status: MoveProof is pre-launch. Nothing on this page has been published yet, and we would rather say that plainly than imply a body of work that does not exist. If you want to be notified when the first report lands, tell us.
Request an assessment
Find out how many humans stand between one compromised account and your treasury.
Read-only, model-only, inside your own environment. One artifact at the end: the shortest path, the amount exposed, and the effective human count.
Company
Built by the people who had to answer for the vault.
MoveProof exists because one of us spent six years as a crypto CISO being asked who could move the money — and had no tool that could answer it continuously.
Kobi Haimovich
Founder & CEO
- CISO / CIO, Scrypt — Swiss institutional digital assets
- Previously CISO, Bitvavo — a MiCA-regulated European exchange
- Top 100 CISO, 2026
- Six years as a crypto CISO
- Active offensive researcher with paid vulnerability findings
Yosef Hai Ephraim
Founder, Head of Infrastructure
- Owns the collector and cloud layer: AWS, Kubernetes, IAM, KMS
- The half of the graph no crypto vendor models
- Read-only by design — the deployment posture that gets a CISO to yes
Or Adar
Founder, Head of Engineering
- Owns the engine: authority graph, solver, prover, remediation compiler
- Senior engineering background — turns the formal model into a product
- The proof pipeline is the differentiator, and it is his to build
Where we are
Pre-launch, and honest about it.
now
Building the graph
Read-only collectors for AWS, GitHub, Fireblocks and EVM, normalised into one authority graph. The join is the foundation everything else stands on.
next
Solver and three paths
The policy decision function, shadowed-rule detection, effective-approver counting, and the three deep paths end to end.
then
Design partners
A small number of regulated operators who want their own number before anyone else has it. We are selecting them now.
- Founded
- 2026
- Base
- Zurich, Switzerland
- Stage
- Pre-seed · selecting design partners
- Buyers
- Regulated CASPs, issuers, custodians, exchanges, OTC and market-making desks, large treasuries
Request an assessment
Find out how many humans stand between one compromised account and your treasury.
Read-only, model-only, inside your own environment. One artifact at the end: the shortest path, the amount exposed, and the effective human count.
Security
A security company should be auditable first.
We ask operators for read access to the systems that move their money. That obligates us to be specific about what we hold, what we cannot hold, and how to report a problem in our own product.
by construction
What MoveProof cannot do
There is no code path in the product that can move funds. We never request a signing credential, a private key, an MPC share, or an API role with transaction permissions. If a MoveProof credential leaked in full, the worst case is disclosure of configuration metadata — never movement of assets.
where it runs
Customer-hosted by default
One container inside your own cloud account. Secret values are never read — only which principals are able to read them. Nothing leaves your environment unless you explicitly export a report.
audit
Every call is logged
Each outbound API request is written to an append-only log with the calling component, the target and the purpose. Proof artifacts are hash-chained so the evidence record is tamper-evident, including against us.
consent
Live execution is explicit
Adversarial execution is opt-in per path, gated on signed authorisation naming the systems, the window and the blast radius. Default operation is model-only and touches nothing live.
Disclosure
Reporting a vulnerability in MoveProof.
Send it to security@moveproof.io. We acknowledge within two business days and aim to confirm or refute within ten.
What we commit to
No legal action for good-faith research within this policy. Credit in the fix note unless you prefer otherwise. A fix timeline given in writing, and told to you if it slips.
What we ask
Test only against your own tenant or our published test environment. No third-party data, no denial of service, no social engineering of our team or our customers.
Our own disclosure
When we find an issue in a vendor or an operator, they get 90 days and a reproduction. We publish the class before the company, and the fix alongside the finding.
security.txt: once moveproof.io is live, the canonical policy will be served at /.well-known/security.txt. Until then this page is the policy of record.
Request an assessment
Find out how many humans stand between one compromised account and your treasury.
Read-only, model-only, inside your own environment. One artifact at the end: the shortest path, the amount exposed, and the effective human count.
Contact
Ask us for your own number.
The engagement starts read-only and model-only. Within the first pass you get one artifact: the shortest path from a compromised identity to funds leaving your organisation, and how many humans stand in the way.
step 01
Scope, in one call
Which custodian, which cloud, which repositories. We tell you what read-only access is needed and what we will not ask for.
step 02
Read and model
Collectors run against read-scoped credentials inside your environment. Nothing live is touched. We build the graph and the policy replica.
step 03
The number, and the fix
Your shortest path, the amount exposed, the effective human count, and a remediation set with an owner per change.
Who this is for
Regulated crypto-asset service providers, stablecoin issuers, custodians, exchanges, OTC and market-making desks, and treasuries or funds holding institutional size on chain.
Who it is not for
If you are looking for a contract audit, a bug bounty programme or real-time transaction monitoring, we are the wrong vendor and will tell you so on the first call.
- General
- hello@moveproof.io
- Security
- security@moveproof.io
- Base
- Zurich, Switzerland
Legal
Privacy and terms.
Short, because we collect almost nothing.
Privacy
This website sets no cookies, runs no third-party analytics and embeds no external resources. If you email us, we hold that correspondence to answer it and for as long as our commercial relationship requires.
For customers, the product is deployed inside your own environment. MoveProof does not receive, store or process your secret values, keys or transaction data. Configuration metadata stays in your deployment unless you deliberately export a report and send it to us.
Terms
The content of this site is provided for information only and is not a warranty, an offer, or security advice for any specific environment. Figures attributed to third parties are as reported by the sources named on the relevant page. Product screens shown on this site are design prototypes, not recordings of a running system, and the data in them is composite and does not describe any real organisation's configuration.
Contractual terms, service levels and liability are set out in the agreement signed with each customer, not here.
Note: these are honest placeholders written by the founders, not reviewed counsel text. They will be replaced with a lawyer-reviewed version before the first customer contract.