Because the attacker uses the system's own approval process. A proposal can move through a low-participation window, or voting power can accumulate before anyone notices, so the security failure is often timing and visibility rather than broken code. Reviews help, but they do not replace continuous surveillance of execution triggers.
Why treasury governance fails even when the controls are current
Current reviews usually validate policy, permissions and approval paths at a point in time. Governance attacks succeed when the attacker turns those same approval paths into the attack surface, then times the move to exploit low participation, weak turnout, or delayed visibility. The weakness is often not a missing control, but a control that is too static for an active decision process.
That means the real security question is whether the treasury system can detect and challenge an unusual proposal while it is still pending, not only after the review cycle finishes. A well-reviewed process can still be manipulated if no one is watching for abnormal timing, delegated voting concentration, or sudden changes in who can influence execution.
In practice, treasury governance depends on a live trust model, not just documented approvals. If the system allows a proposal to accumulate influence before a response window closes, the review can remain formally current while the operational defence has already failed.
How the attack uses legitimate process mechanics
Governance attacks on treasury systems work because they abuse the rules of the system rather than breaking them. A malicious proposal may look routine, pass through expected review steps, and then execute once quorum, voting weight, or timing conditions are satisfied. The attacker is not bypassing governance, but weaponising it.
This is why execution triggers matter so much. If approval thresholds, proposal lifecycles, or sign-off windows are predictable, an adversary can wait for the weakest point in participation and act there. Web3 and Crypto Security Guide is useful here because treasury attacks often hinge on multisig process design, proposal timing and incident response rather than on code defects alone.
Concentration of voting power is another common failure mode. Even when individual reviewers stay current, an attacker who has accumulated influence over time can turn a governance system into an execution channel. The control objective is therefore not just correct review, but resilient decision distribution.
What defenders need to watch beyond the review checklist
Teams often overvalue periodic review because it is measurable, while underweighting visibility into live governance activity. The important signals are abnormal proposal cadence, sudden concentration of approvals, repeated near-quorum events, and changes in execution timing that do not match normal operating patterns. Those are often earlier indicators than any post-review audit finding.
Continuous monitoring is also essential because a treasury system can be compromised without any obvious policy exception. If an attacker can repeatedly submit, revise or delay proposals, the organisation may see a clean review record and still lose control of the eventual execution path.
There is also a practical resilience issue: when governance is the control plane, delay is part of the defence. If no one is empowered to pause execution or escalate a suspicious proposal quickly, current reviews become a weak form of assurance rather than a real barrier.
Risk and Threat Considerations
Treasury governance attacks are high impact because they exploit legitimate authority and can convert routine approval mechanics into an attack path. The risk is amplified when participation is low, voting weight is concentrated, or execution happens soon after approvals, because the attacker only needs a brief window of advantage.
Failure mechanism: The attacker waits for a narrow participation window, accumulates influence before detection, or uses an approved workflow to move a malicious proposal through to execution before defenders can react.
Impact: Funds, treasury authority, or control of critical on-chain actions can be transferred or redirected while the governance record still appears valid, making detection and recovery slower than a traditional code exploit.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Treasury governance abuse often exploits excessive signing or voting power. |
| NHI-09 — NHI Reuse | Reusable approval or signing paths can let one compromise affect many actions. | |
| NHI-10 — Human Use of NHI | Human operators can misuse delegated treasury authority through approved workflows. | |
| Recommendation — Restrict treasury signing and proposal authority to the minimum required. Separate and rotate treasury-related credentials and authorities to limit reuse. Prevent human-operated treasury actions from bypassing normal accountability and review. | ||
| MITRE ATT&CK | T1078 — Valid Accounts | Governance attacks often use legitimate accounts and permissions rather than exploits. |
| T1098 — Account Manipulation | Attackers may alter governance power or delegated authority before acting. | |
| Recommendation — Monitor legitimate treasury accounts for abnormal approval and execution behavior. Detect and review sudden changes to treasury authority, roles, or delegation paths. | ||
| NIST CSF 2.0 | DE.AE-01 — Anomalies and Events are Detected | The subject depends on spotting unusual proposal timing and approval patterns. |
| Recommendation — Detect abnormal treasury governance events while proposals are still pending. | ||
Practitioner Guidance
What to prioritise: Treat live governance monitoring as part of the control, not as an after-action task. Focus first on proposal timing, approval concentration and any workflow that allows a small set of actors to determine execution.
What to verify: Confirm that suspicious proposals can be paused, challenged or escalated before execution. If the process only supports retrospective review, it is not sufficient for treasury protection.
Decision rule: If a proposal can reach impact within the same window that people usually review it, assume the review is too slow and add an execution-delay or real-time alerting layer.
Practitioner takeaway: The strongest treasury controls are those that see the attack while it is still moving through the approval path, because current reviews alone do not stop adversaries who exploit timing and participation gaps.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org