Crypto Custody in the AI Attack Era: Who Bears the Loss?

The most authoritative cyber warning of 2026 came on June 22, when the National Security Agency (“NSA”), joined by the cyber security agencies of the United Kingdom, Canada, Australia, and New Zealand, stated: “Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months” ([1]). [emphasis added]. The agencies warn that AI is “shrinking the window between vulnerability discovery and exploitation” and state flatly that “Breaches will occur” ([1]). For wealth managers and family offices holding digital assets, this warning highlights a complex network of risks rather than a single threat. If you use an exchange, the user agreement typically assigns the risk of loss to you. If you choose self-custody, you are solely responsible for security. If you use a trust or regulated custodian, their duty to protect your assets depends entirely on the terms of the governing document. Each arrangement should be reviewed carefully.

Exchanges: the loss is contractually yours

The FBI attributed the theft of approximately $1.5 billion from the exchange Bybit in February 2025 to North Korea ([2]). In 2025 alone, the FBI received 181,565 complaints involving cryptocurrency with $11.366 billion in reported losses, up 22 percent from 2024 ([3]). When customers report account takeovers, the Consumer Financial Protection Bureau found that companies “often” respond that transfers are irreversible and that “consumers are responsible for the security of their accounts” ([4]). One platform cited terms stating the customer would not hold it liable for “equipment or software failures or malfunctions … security breaches and unauthorized access” ([4]). In our experience, platform agreements routinely include clauses that shift losses to the customer if their device is compromised. Review these agreements proactively, before any incident occurs.

Self-custody: you are the security team

Hardware and browser wallets do not eliminate risk; instead, they transfer it to the holder. A joint FBI, CISA, and Treasury advisory describes North Korean actors targeting “individual holders of large amounts of cryptocurrency” with trojanized applications whose fake “update” function installs malware that steals private keys ([5]). The Federal Trade Commission is direct: if a wallet “is stolen or compromised,” you are “likely to find that no one can step in to help you recover your funds” ([6]). AI-generated voice clones and deepfake video calls are already used to walk holders through the steps that drain a wallet ([7]), and the NSA expects those tools to improve within months, not years ([1]).

Trusts and custodians: the duty is what the document says

Many families have placed digital assets in U.S. or offshore asset protection trusts with a professional trustee or a regulated custodian. This approach is often good, but it does not provide automatic protection. New York Banking Law § 100 grants trust companies fiduciary powers, including the power to “receive, take, manage, hold and dispose of according to the terms of such trust” the property entrusted to them ([8]). The statute confers powers; however, it does not contain no express duty to safeguard digital assets against foreseeable account takeovers or cyber attacks. If that duty is not written into the trust agreement or custody agreement, expect the trustee to argue it does not exist. The same considerations apply outside New York. If the asset protection trust trust is established in South Dakota, Wyoming, or an offshore jurisdiction, do not assume that default rules impose the duties omitted by New York’s statute. The trust agreement should clearly define the trustee’s responsibilities for safeguarding assets, including cryptocurrency and bank accounts, and specify the consequences of any breach in the age of agentic AI cyberattacks. Regulators expect more of licensed custodians. DFS guidance issued September 30, 2025, to BitLicensees and limited purpose trust companies requires custodians to hold customer crypto only for custody and safekeeping, segregate it on-chain and on their ledger. They also required trust companies to treat customers’ crypto as belonging solely to customers, and disclose the customer’s property interest and any material sub-custodian risks ([9]). And these expectations are excelleent, but they do not replace the need for enforceable contract terms and insurance.

What to check this month

1. Exchange and platform agreements: locate the loss-allocation, device-compromise, and arbitration clauses ([4]). 2. Trust and custody agreements, in every jurisdiction: confirm an express duty to safeguard digital assets, a defined security standard, and remedies for breach (given NSA’s June 22, 2026 warning concerning agentic AI cybercrime). 3. Trustee and custodian insurance: confirm coverage, limits, and exclusions for cyber theft, and if your assets are within the covered class. 4. Key control: document who holds keys, who can authorize transfers, and what verification is required ([9]). 5. Incident plan: know that the first report goes to the FBI’s IC3 with wallet addresses, transaction hashes, amounts, and timestamps ([10]).

Contact US

At Dilendorf Law Firm, we advise wealth managers, family offices, and individual holders on the custody of digital assets held on exchanges and in self-custody wallets. We also help clients with completing due diligence on onshore/offshore trustees and regulated custodians in New York and other U.S. jurisdictions. If your crypto has already been compromised, we assign retired law enforcement agents to trace and investigate the theft and arbitrate claims against exchanges, trust companies, and custodians. Contact us at +1 212 457 9797 or email us at info@dilendorf.com. This article is for general informational purposes only and does not constitute legal advice. Reading it does not create an attorney-client relationship with Dilendorf Law Firm. Attorney Advertising.