Crypto Treasury Management for Businesses: Wallet Setup, Approval Policies and Tools (2026)

On 24 September 2026, Bitget lost $387.5 million from its hot and warm wallets, and no one stole a key. As Decrypt reported, the attackers broke into a back-end system and faked the payment data. The exchange’s own sign-off process then sent payouts that looked routine. In February 2025, Bybit lost $1.5 billion in a similar way: signers approved a transfer they could not truly see.

That is the real lesson of crypto treasury management. The wallet type matters, but the rules around it matter more. Who starts a payment, who signs it, what each signer checks and how much sits online decide how much you can lose. About $306 billion of stablecoins are in use in mid-October 2026, per DefiLlama, and more startups now hold USDC with no written rules.

This guide is for founders and finance leads at teams of 5 to 50 people that hold USDC, USDT or BTC. It covers wallet setup, sign-off rules, payouts, yield and the books, with a worked plan you can adapt.

In this guide:

• Use three tiers: keep about two weeks of payouts hot, three months of spend warm, and the rest in a cold vault.
• Pick signer counts by tier: 2 of 3 for daily work and 3 of 5 for reserves, with keys spread across people, devices and places.
• Slow down new payees: a new address needs two signers, a call-back check and a 24-hour wait before the first payment.
• Guard the runway: never put the next 12 months of spend into yield. DeFi rates on USDC in October 2026 were close to the 4.20% that 13-week US Treasury bills paid.
• Book USDC with care: under US GAAP it is not yet a cash equivalent. FASB’s August 2026 proposal is open for comment until 19 November 2026.

What Is Crypto Treasury Management?

Crypto treasury management is the set of wallets, rules and daily routines a business uses to hold, move, earn on and record its digital assets. It is the crypto version of cash management, with one big difference: no bank can reverse a wrong payment.

It has five jobs: custody (where keys live), sign-off (who approves what), payouts (cash ready for payroll and vendors), yield (whether idle funds earn) and the books (how each transfer lands in your ledger).

A “crypto treasury management system” is any tool, or mix of tools, that does these jobs. For most small firms that means a shared vault such as Safe or Squads, hardware wallets for signers, a crypto sub-ledger and a written plan.

Multisig vs MPC for a Company Treasury

Which one is safer? A reply in a September 2026 Reddit thread put it well: they “just fail differently.” Both stop one person from moving funds alone. They differ in where the rule lives.

• Multisig: each signer holds a full key, and the chain itself checks that, say, 2 of 3 have signed. Anyone can see the signers and the threshold on-chain. Safe does this on EVM chains, and Bitcoin has it built in.
• MPC: the key is split into shares that never come together. The parties make one normal signature, so the chain sees a single signer. The rules live off-chain, so you trust the code and often a vendor, but it works on most chains and makes signer changes easy.

For a small team, multisig is the better start on Ethereum, its layer 2s and Solana: the tools are free or cheap and the rules are public. MPC pays off when you run many chains, send payouts at scale, or build wallets into a product. For the full side-by-side, see our guide to MPC wallet development.

Setup	Best for	Who holds keys	Published cost
Safe	Ethereum, Base, Arbitrum and other EVM chains	Your signers	Free tier; paid Safe Pro plans for teams
Squads	Solana	Your signers	$0 Basic (0.1 SOL to set up), $49 a month Pro
Bitcoin multisig	BTC reserves	Your signers, on hardware wallets	Free software; devices from about $59
MPC platform	Many chains, payouts at scale, products	Shares split between you and the provider	Quote-based
Qualified custodian	Large balances and regulated firms	The custodian	Coinbase lists 50 bps a year, $500,000 minimum

Safe reports more than $60 billion in assets on its Safe Pro page, and Squads says it secures over $10 billion. To hand keys to a licensed third party, see our guide to crypto custody solutions.

How Many Signers Does a Company Need?

Use 2 of 3 for the operating wallet. Two people can pay a vendor while the third is on leave, and one lost key locks nothing. Use 3 of 5 for reserves, so you can lose two keys and still recover.

Then spread the keys out: give them to other people, on other hardware brands, in other places. Never keep enough keys to sign in one office, one safe or one cloud account. Give at least one key to someone outside daily work, such as a board member.

The Bitcoin trap: a BTC multisig needs a backup of the wallet descriptor, which lists each cosigner’s public key (xpub) and the threshold. Three seed phrases alone cannot rebuild a 3 of 5 wallet, because it also needs the other two public keys. Store a copy of the descriptor with each key.

How to Split Hot, Warm and Cold Wallets

The hot wallet’s balance is the most you can lose in one bad day, so size it to need, not comfort. Most treasuries use three tiers:

• Hot (payout) wallet: online and fast, holding one to two weeks of crypto payouts. Small payments to saved addresses go out under a spending limit.
• Warm (operating) vault: a 2 of 3 multisig holding about three months of spend. It refills the hot wallet and pays large invoices and payroll.
• Cold (reserve) vault: a 3 of 5 multisig with each signer on a hardware wallet. It holds the rest and only sends to the warm vault, on a set schedule.

Two rules make the tiers work: money flows down only (cold to warm to hot to payees), and each tier has a cap that refills never exceed.

Safe’s spending limits let a named address, even a bot that is not a signer, spend a capped amount of one token, and the contract enforces the cap on-chain. Squads has spending limits that reset each period, plus time locks that delay a payment after sign-off.

How to Write Approval Policies That Hold Up

Bybit and Bitget both had several approvers, who signed what a screen told them. Good rules control what signers check, not only how many sign:

1. Split the roles: one person starts a payment, others approve it, and no one does both.
2. Use an address book: pay only saved, named addresses. Adding or changing one needs its own sign-off and a call-back on a channel you already trust, never the email that asked for it.
3. Add a wait: a new payee waits 24 hours before the first payment. Most invoice fraud relies on rush.
4. Check on the device: each signer reads the address, amount and contract call on their hardware wallet screen, not only in the web app. Safe’s plans add transaction checks; treat them as a second opinion.
5. Delay big moves: reserve transfers wait 24 to 48 hours after sign-off, so a forged request can be caught.
6. Lock down changes: adding a signer, cutting a threshold or adding a module needs a higher quorum and a board note.
7. Drill recovery: twice a year, rebuild one wallet from backups on clean hardware. An untested backup is a guess.
8. Log it all: each request, sign-off and refusal goes into a log that finance and auditors can read.

For signer devices, phishing and seed storage, see our guide to crypto wallet security.

A Worked Crypto Treasury Policy Example

Here is a plan for a sample firm: a 20-person software team that holds $3,000,000 in USDC after a raise. It spends $180,000 a month, and $80,000 of that goes to contractors and vendors in USDC. That gives it about 16.7 months of runway.

Tier sizes:

• Hot: capped at $40,000, about two weeks of USDC payouts.
• Warm: about $540,000, three months of total spend.
• Cold: the rest, $2,420,000.
• Yield sleeve: 12 months of spend, $2,160,000, must stay in plain USDC or bank cash. Only the $840,000 above that may earn yield, and the plan caps it at $600,000 across two venues. The sleeve comes out of the cold reserve, which leaves $1,820,000 there in plain USDC.

Sign-off matrix:

Action	Who starts it	Who signs	Extra rule
Payout of $5,000 or less to a saved address	Ops lead	No one (spending limit)	$20,000 a day cap, hot wallet only
Payout above $5,000, or a payroll batch	Finance lead	2 of 3 warm signers	Must match an approved invoice or payroll file
Add or change a payee address	Finance lead	2 of 3 warm signers	Call-back check, 24-hour wait
Refill the hot wallet	Finance lead	2 of 3 warm signers	Only up to the $40,000 cap
Move cold to warm	Head of finance	3 of 5 cold signers	48-hour delay, once a quarter unless the board agrees
Move funds in or out of yield	Head of finance	3 of 5 cold signers	Approved venues only, within the $600,000 cap
Change signers, thresholds or modules	CEO	All warm or 4 of 5 cold signers	Board note, then a recovery test

The cold signers are the CEO, the head of finance, a co-founder, a board member and an outside adviser. No two share a building or a hardware brand. The warm signers are the CEO, the head of finance and the ops lead.

The team reviews the plan each quarter, and at once after any incident, new chain, or change in monthly spend above 25%. The Ethereum Foundation runs its own funds on a similar plan: it keeps 2.5 years of spend in fiat, holds riskier bets in their own sleeves and reports each one to its board each quarter.

How to Pay Contractors and Vendors From a Crypto Treasury

One founder on Reddit raised a pre-seed round partly in USDC and paid eight contractors across the EU. The first month went fine: sell on an exchange, then send bank transfers. By the second month, some contractors got calls from their banks about the money.

There are two clean ways to avoid that:

• Pay in USDC directly: if a contractor agrees in writing, pay from the hot wallet to an address they have confirmed. The contract states the token, the chain and who pays network fees. They handle their own conversion.
• Cash out to your own bank first: sell USDC through a licensed firm into the company bank account, then pay staff by normal transfer. The money then reaches staff from your own firm’s account, not an exchange, and your bank knows where it came from.

Either way, store the invoice, transaction hash and exchange rate for each payout, and batch payroll into one sign-off. In the EU, use a crypto firm licensed under MiCA. The transition period ended on 1 July 2026, and ESMA’s register shows who holds a licence.

If you also take payments in crypto, a stablecoin payment gateway can settle straight into your warm vault, so new funds follow the same tiers and rules.

Should You Earn Yield on Idle Stablecoins?

Yield is the easiest place to take risk you are not paid for. On 16 October 2026, DefiLlama showed major DeFi lending pools paying about 3.75% to 5.8% on USDC. The 13-week US Treasury bill yielded 4.20% on 15 October 2026.

The main options, from lower to higher risk:

• Bank cash or money market funds: the simplest choice and the easiest to book.
• Tokenized Treasury funds: on-chain shares in funds that hold T-bills, most often with investor checks and minimums.
• Platform rewards: some exchanges pay holders to keep USDC on their platform. The GENIUS Act bans issuers from paying yield, but platform rewards go on after the CLARITY Act failed in the Senate on 15 September 2026. Proposed US rules could catch some of them when GENIUS takes effect in January 2027.
• DeFi lending: pools such as Aave or Compound, with daily floating rates.

Each one adds risk:

• Depeg: USDC fell as low as $0.88 in March 2023 after Circle said $3.3 billion of its reserves sat at Silicon Valley Bank. On our $600,000 sleeve, a 12% drop is a $72,000 paper loss in a weekend.
• Platform failure: Celsius froze user payouts in 2022 and went bankrupt. Rewards are only as safe as the platform paying them.
• Code and rules: a bug can drain a pool, and reward schemes may change in 2027.

At 3.8%, the $600,000 sleeve earns about $22,800 a year. That is less than one month of the firm’s spend, so it never justifies risking the runway.

How to Account for Crypto Treasury Holdings

The rules are moving in 2026, so agree your method with your auditor first:

• BTC, ETH and similar tokens (US GAAP): ASU 2023-08, in force for fiscal years starting after 15 December 2024, holds them at fair value. Gains and losses run through net income each period.
• Stablecoins (US GAAP): tokens such as USDC most often fall outside ASU 2023-08, because holders can redeem them for cash, per Deloitte’s FAQ on the standard. Many firms book them as financial assets, not cash.
• The FASB proposal: on 18 August 2026, FASB proposed that a stablecoin can be a cash equivalent if it passes three tests, as Crowe’s summary explains. Holders need an on-demand right to redeem for cash, a direct claim on the issuer, and 1:1 reserves in short-term liquid assets held apart. Trading on an exchange alone does not count. Comments close on 19 November 2026.
• IFRS: since a June 2019 IFRS decision, most crypto is an intangible asset under IAS 38. Firms that trade crypto as their business may use inventory rules under IAS 2.
• US tax: the IRS treats digital assets as property, so swaps and sales can create gains or losses. Brokers report sales on Form 1099-DA for trades from 1 January 2025.

Then build the routine. Label each wallet by tier, tag each transfer with its invoice and USD value, and match on-chain balances to the ledger each month end. Sub-ledger tools such as Cryptio, Bitwave and TRES pull wallet data into your books.

Build, Buy or Combine: Treasury Tools and Costs

A small firm can run all of this on existing tools. The real cost is the team’s time and discipline.

Building your own makes sense when the treasury is part of your product, as at exchanges, payment firms and payroll apps holding funds for thousands of users. They need automatic hot, warm and cold sweeps, a rules engine wired into their back office, per-user ledgers and audit trails. For apps that give each user a wallet, wallet-as-a-service is often the faster first step.

Published 2026 agency cost guides put a white label wallet at about $15,000 to $90,000 and a custom wallet at $50,000 to $200,000. A custom MPC wallet MVP runs about $80,000 to $150,000. The main cost drivers are the signing layer, the number of chains, the rules engine, compliance tools and audits.

Coinsclone has built blockchain products since 2018, with 350+ platforms delivered for 200+ clients across 20 industries. Our team builds multisig and MPC treasury wallets with sign-off flows, tiered sweeps and reports. A white label wallet takes 3 to 5 weeks, and a custom build takes 8 to 12 weeks.

What to Prepare Before You Set Up Your Treasury

Whether you build in-house or with a partner, bring these answers to your first planning call:

1. Balances: what you hold, on which chains, and how much moves each month.
2. Payment flows: who you pay, how often, in which token, and how you cash out.
3. People: who starts payments, who signs, and who holds the reserve keys.
4. Limits and reports: your hot wallet and yield caps, your auditor and your month-end deadline.
5. Where you operate: where your firm and payees are based, and which licences apply.
6. Recovery: who rebuilds wallets if a signer leaves or loses a device.

When picking a build partner, ask to see their sign-off flow on testnet, how signers confirm transfers on hardware, and how each action is logged. A partner who cannot show those is selling a wallet, not a treasury.

Frequently Asked Questions

What is crypto treasury management?

Crypto treasury management is how a business holds, moves, earns on and records its digital assets. It covers custody, sign-off rules, cash for payouts, yield choices and the books. The goal is to keep funds safe while making sure money is ready when the business needs it.

What is a crypto treasury management system?

It is the set of tools a firm uses to run its crypto treasury. For a small team that is often a multisig vault such as Safe or Squads, hardware wallets for signers, a sub-ledger tool and a written plan. Larger firms add MPC wallets, a rules engine, automatic sweeps and links to their ERP.

What is the difference between multisig and MPC?

Multisig uses several full keys, and the blockchain checks that enough of them signed, so the rules are public. MPC splits one key into shares that sign together off-chain, so the chain sees a normal signature. Neither is always safer. Multisig gives on-chain proof, while MPC gives wider chain support and easier signer changes.

How many signers should a company multisig have?

Most firms use 2 of 3 for the operating wallet and 3 of 5 for reserves. That lets work go on when one signer is away, and it survives the loss of one or two keys. Spread the keys across people, devices and places, and back up the full wallet setup, not only the seed phrases.

Is USDC a cash equivalent?

Not yet under US GAAP. Fiat-backed stablecoins most often fall outside the crypto fair value standard, and many firms book them as financial assets. FASB proposed in August 2026 that stablecoins passing three redemption and reserve tests could count as cash equivalents, but comments close on 19 November 2026 and the rule is not final.

How do I pay contractors in stablecoins?

Either pay USDC to an address each worker has confirmed in writing, or cash out to your firm’s bank account and pay by normal transfer. Paying from an exchange account straight to personal bank accounts can trigger bank checks. Keep the invoice, transaction hash and exchange rate for each payment.

Can a business earn yield on stablecoins?

Yes, through tokenized Treasury funds, platform rewards or DeFi lending, but each adds depeg, platform or code risk. In October 2026, many DeFi rates on USDC were close to the 4.20% that 13-week US Treasury bills paid. A safe rule is to keep the next 12 months of spend out of any yield product.

Free Trial