# Digital Asset Operators

> Exchanges, custodians, wallets, stablecoin operators, and asset platforms.

Canonical page: https://www.guvenkaya.co/solutions/digital-asset-operators

**Review how customer funds move.** We review signing, approval, and recovery paths for exchanges, custodians, wallets, and stablecoin operators.

## When to review your operations

- **Before the signing lifecycle changes**: A new signer set, custody vendor, or automation path changes who can move funds.
- **Before a new product or listing goes live**: New assets, chains, and flows widen the surface faster than the controls around them.
- **When recovery has never been rehearsed**: Rehearse recovery with the people who would run it during an incident.
- **After a near miss**: Reconstruct what nearly worked, and what would have stopped it one step earlier.

## Where customer funds can be exposed

We trace funds from deposit to payout, including accounting, signing, approval, and recovery.

- **Deposit & crediting**: Reorgs, wrong-chain deposits, double credits, and the accounting that trusts them.
- **Hot wallet & automated signing**: Float sizing, key access, signing services, and what an attacker gets from one host.
- **Withdrawal approval**: Quorum, allowlists, velocity limits, break-glass, and who can change any of them.
- **Recovery & key ceremony**: Share custody, ceremony witnesses, and whether recovery has been executed end to end.

## Engagement team

The team brings operating experience in exchange security, funding, and custody, including at Kraken.

- **Michal Bajor**, Specialist Advisor: Exchange, funding, custody, API, web application, red-team, and L1 security.
- **Piotr Cielas**, Principal Advisor: Financial-services assessments, offensive security, risk leadership, CVEs, and patents.
- **Timur Güvenkaya**, Founder & Partner: Rust-based and non-EVM systems, protocol security, architecture, infrastructure, and custody.

## Relevant services

- [Signing & Custody Security Reviews](https://www.guvenkaya.co/services/signing-custody-security-review.md): Start here. This is the review that follows a key from generation to recovery and challenges every gate on the way.
- [Penetration Testing](https://www.guvenkaya.co/services/penetration-testing.md): Use this when the question is what an attacker reaches from the outside, or from one compromised employee.
- [Technical Training & Security Exercises](https://www.guvenkaya.co/services/training-security-exercises.md): Use this to rehearse recovery and break-glass with the people who would actually run them.

## Discuss your custody and signing workflows.

Describe your signing model, approval flow, and main concern. We will help define the scope.

Discuss your scope: https://www.guvenkaya.co/contact