Segregation of duties

Graduate · enrolled learners

This lesson opens with Prime Trust, 2023.

What happened

Prime Trust was a Nevada-chartered custodian that held crypto assets for other businesses and their customers. State regulators moved to take it over in June 2023, finding it insolvent with a shortfall later put in the tens of millions of dollars. The chain of failure was operational, not a hack: the company had lost access to a set of legacy wallets it could no longer control, and rather than disclose that gap, it bought crypto using current customer funds to satisfy withdrawals that should have come from the lost wallets, so a controls failure quietly became a solvency hole. What was missing was segregation of duties, the separation that would have put the person moving customer funds, the person approving the movement, and the person reconciling customer assets against obligations into different hands, so that using one customer's assets to paper over another's could not be initiated, approved, and hidden by the same people. The loss of the wallet was a mistake; the ability to conceal it with customer money was a controls absence.

The decision point

Prime Trust did not fail because someone lost a wallet; wallets are lost, and that is what controls exist to survive. It failed because the same institution that lost the wallet could quietly reach for customer funds to cover the gap, with no independent hand required to approve the movement or reconcile the books against what was owed. Segregation of duties is the control that makes concealment structurally hard: the person who can initiate a movement of assets is not the person who approves it, and neither is the person who reconciles the institution's holdings against its obligations to customers. When those three are separate, a single actor cannot move funds, wave the movement through, and hide the resulting shortfall, because each step passes through a different person whose job is to notice. Prime Trust is what one set of hands doing all three looks like: a recoverable mistake became an unrecoverable fraud because nobody independent stood between the mistake and the customer assets.

Recorded loss

$85,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.