What happens when crypto businesses move from decentralized targets to centralized platforms?

Centralized platforms usually give attackers a clearer concentration of value, which makes stolen credentials and keys more profitable. The attack surface shifts from isolated protocol flaws to identity, access, and custody controls. That means defenders need stronger governance over privileged access, key handling, and transaction approval, because a single compromise can affect large balances and many users.

Centralisation Changes the Security Economics

When crypto activity moves onto a centralized platform, the attacker is no longer looking at many small protocol-level opportunities. The prize becomes concentrated: a single account, wallet infrastructure, admin console, or approval path can expose more funds, more users, and more operational leverage at once. That is why platform security becomes inseparable from custody and access governance.

The practical shift is from distributed failure tolerance to concentrated blast radius. A flaw that was tolerable in a decentralised environment can become high impact when balances, permissions, and transaction controls are aggregated behind a single operational layer.

Centralization also changes the kind of evidence defenders need. It is no longer enough to trust that the chain is secure; teams have to validate who can authorize movement, how keys are protected, and whether approvals are bounded by role, policy, and time. That is exactly why NHI controls such as secrets handling, credential rotation, and privilege minimisation become operationally important, not just administrative.

A useful reference point is NHI Mgmt Group’s Ultimate Guide to NHIs, which shows how non-human credentials and excessive privilege become force multipliers when a platform concentrates access. The same concentration problem appears in platform custody models, where stolen access material can be more profitable than a protocol exploit.

What Attackers Gain from Centralized Custody and Access Paths

Centralized platforms make several attack paths more attractive. If an attacker steals privileged credentials, API keys, session tokens, or transaction approval authority, they may not need to break the underlying blockchain or payment rail at all. Instead, they can use legitimate access to move assets, alter settings, or bypass intended controls.

This is why the attack surface shifts toward identity, authorization, and custody operations. The weakest point is often not the distributed ledger itself, but the control plane around it: admin portals, signing workflows, recovery processes, hot wallet handling, and third-party integrations. In practice, the most damaging failures are often credential theft, over-privilege, weak approval segregation, or stale access that still has authority.

The pattern is well illustrated by JumpCloud Breach and Cloudflare Breach, where compromised access material was more important than a traditional software exploit path. For centralised crypto businesses, the lesson is simple: if access can authorize asset movement, it must be treated as a primary security boundary.

That same boundary is why key lifecycle and approval design matter so much. If keys or tokens are long-lived, shared, or broadly reusable, centralization turns a routine access issue into a large-scale loss event.

Risk and Threat Considerations

Centralized platforms increase exposure because one compromise can affect many balances, many users, and multiple operational functions at once. The main risk is not just theft, but correlated failure: a stolen credential, misconfigured approval path, or abused admin role can produce outsized loss before defenders have time to intervene.

Failure mechanism: Attackers target the centralized control plane, then use valid credentials, signing authority, or excessive privilege to bypass distributed safeguards and move funds or alter custody settings.

Impact: A single access failure can trigger high-value theft, user account compromise, transaction fraud, service disruption, and loss of trust at platform scale.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-01 — Secrets and Credential Management	Centralized crypto platforms hinge on protecting high-value secrets and keys.
	NHI-03 — Least Privilege and Access Governance	Centralized custody raises the impact of excessive privilege and shared admin access.
	NHI-06 — Monitoring and Detection	Large-scale asset movement from a single compromise demands tight visibility on access and approvals.
Recommendation — Protect wallet and admin secrets with strong vaulting, rotation, and scoped usage. Restrict privileged access to the minimum roles and approvals needed for custody actions. Monitor high-risk access and transaction approvals for abnormal use and rapid escalation.
CIS Controls v8	CIS-6 — Access Control Management	Centralized platforms need strong control over privileged access and account scope.
	CIS-8 — Audit Log Management	Central custody requires traceable approval and movement records.
Recommendation — Enforce least privilege, review privileged accounts, and remove unneeded access paths. Collect and protect logs for privileged actions, approvals, and asset transfers.
NIST CSF 2.0	PR.AC — Access Control	The subject is dominated by identity, authorization, and custody access decisions.
	DE.CM — Continuous Monitoring	Concentrated custody requires ongoing detection of abnormal access and movement.
	GV.OC — Organizational Context	Centralization changes the risk profile and governance expectations for custody operations.
Recommendation — Define and enforce access boundaries for keys, approvals, and administrative actions. Continuously monitor privileged activity and asset movement for anomalies. Align governance, accountability, and risk ownership to the platform's concentration of value.
MITRE ATT&CK	T1078 — Valid Accounts	Attackers often exploit stolen legitimate access rather than break the platform itself.
	T1003 — OS Credential Dumping	Credential theft is a common path to high-value centralized access.
Recommendation — Hunt for unauthorized use of valid accounts and rotate exposed credentials quickly. Detect credential theft activity and harden systems that store or expose secrets.

Practitioner Guidance

What to prioritise: Treat the highest-risk access paths as custody controls, not ordinary IT access. Any identity that can authorize withdrawals, modify wallet policy, or approve recovery should be isolated, time-bounded, and reviewed as a material asset.

What to verify: Confirm that transaction approval is segregated from routine operations, that privileged access is logged end to end, and that key rotation and revocation are actually operationalized rather than documented only. If a control cannot demonstrate who approved what, when, and under which policy, it is too weak for centralized custody.

Practitioner takeaway: Centralization does not merely add efficiency, it concentrates trust. The security question becomes whether the platform can keep high-value access observable, constrained, and rapidly revocable when the inevitable credential or approval failure occurs.