Cyber: Governance of the Security Supply Chain

Cybersecurity risks in crypto-asset services increasingly arise not only from vulnerabilities in blockchain protocols or the compromise of signing keys, but from dependencies across the wider operational and technology supply chain: wallet-system vendors and their staff, cloud and CI/CD environments, transaction-generation processes, administrative privileges, smart contracts, oracles and bridges — and, as October 2026 has shown, the physical distribution channel for the hardware wallets that hold the keys.

The session starts from the work already done. After the May 2024 DMM Bitcoin loss, which was traced to a compromise at a wallet-system vendor outside the regulatory perimeter, JPCrypto-ISAC documented a third-party (vendor) management guideline for crypto-asset businesses, built on the FISC framework, with an MOU template and a control checklist; it was presented to BGIN at Block 14. Takaya Sugino (Japan Financial Services Agency) will then present the JFSA's April 2026 policy on strengthening cybersecurity at crypto-asset exchange service providers — self-help, mutual aid and public support, including raising the supervisory guideline's expectations for external audit and outsourcing management — and the June 2026 research paper Cybersecurity Issues and Countermeasures in Crypto-Asset-Related Businesses commissioned under it.

The room will then take up the hardware-wallet supply-chain incident reported in October 2026, in which devices sold through third-party resellers carried covert implants that captured recovery phrases at setup — an attack that left the secure element, firmware and genuine-device check intact — and ask what it adds to the picture: distribution-channel assurance, device provenance and tamper evidence, and the limits of attestation.

Finally, participants will discuss which additional perspectives the BGIN security-supply-chain document needs beyond vendor management (open-source and software components, SBOM, hardware and distribution channels, DeFi and cross-chain dependencies, assurance and certification) and confirm the roadmap, owners and timeline toward publication.