Cyber: Governance of the Security Supply Chain

Cybersecurity risks in crypto-asset services increasingly arise not only from vulnerabilities in blockchain protocols or the compromise of signing keys, but also from dependencies across the broader operational and technology supply chain. Recent incidents have highlighted risks involving external service providers, cloud and CI/CD environments, transaction-generation processes, administrative privileges, smart contracts, oracles, bridges, and other external components.

This session will use the June 2026 research paper Cybersecurity Issues and Countermeasures in Crypto-Asset-Related Businesses as a starting point for discussion. The paper maps the structure and dependencies of the crypto-asset ecosystem, examines recent cybersecurity incidents, and identifies priority areas including third-party risk management, protection against code and transaction tampering, controls over smart contracts and DeFi operations, and the effective use of third-party assessments.

Building on these findings, participants will discuss how security-supply-chain risks should be governed in practice: how critical dependencies should be identified, what operators should verify themselves rather than delegate to vendors or auditors, how responsibilities should be allocated across service providers and subcontractors, and what contractual, technical, monitoring, and assurance mechanisms are appropriate.

The discussion will provide input to BGIN’s ongoing Governance of the Security Supply Chain project, with the aim of developing practical principles and vendor-guideline considerations for crypto and blockchain systems.