Every virtual asset service provider (VASP), whether operating as a custodian, an exchange, or a wallet infrastructure provider, holds cryptographic key material that adversaries actively seek to compromise. The threat actors range from organised criminal groups and state-sponsored operatives to malicious insiders and supply chain intermediaries. Acknowledging that these threats exist is insufficient; what matters