Treasury opens cyber threat sharing for crypto firms

The US Department of the Treasury has launched a cybersecurity information-sharing initiative for the digital asset industry, giving eligible US firms access to threat information already shared with traditional financial institutions.

Announced by the Treasury's Office of Cybersecurity and Critical Infrastructure Protection, or OCCIP, the programme is designed to help eligible US digital asset firms and industry organisations identify, prevent and respond to threats affecting customers and networks.

It extends to parts of the crypto and digital asset sector the same stream of cybersecurity information Treasury already provides to established financial institutions. Eligible firms and organisations that meet Treasury's criteria will receive it at no cost.

The launch follows a series of cyber incidents across the sector, highlighting the operational risks facing digital asset businesses. Recent attacks have struck trading, custody and decentralised finance platforms, with losses reaching hundreds of millions of dollars.

Among the latest cases, DeFi platform Drift suspended deposits and withdrawals after a hack that security researchers estimated caused losses of up to USD 240 million. They said the breach stemmed from governance security weaknesses that allowed an attacker to infiltrate a multisig upgrade.

Other incidents this year include an exploit of the Truebit protocol that resulted in about USD $26 million in losses due to a smart contract vulnerability. Step Finance, a decentralised finance tracking platform, was also reported to have been hacked, with Step itself accounting for roughly USD $30 million in losses within a broader wave of incidents estimated at about USD $370 million.

Bitcoin Depot disclosed a separate breach in which attackers accessed credentials and transferred about 50 bitcoin from company wallets, valued at roughly USD $3.7 million at the time. Together, the incidents illustrate the range of attack methods targeting digital asset firms, from compromised governance processes to credential theft to code flaws.

Sector role

Treasury officials tied the initiative to the growing role of digital asset firms within the US financial system. The effort advances a recommendation from the President's Working Group on Digital Asset Markets report, Strengthening American Leadership in Digital Financial Technology.

Luke Pettit, Assistant Secretary for Financial Institutions, said the resilience of digital asset firms now matters beyond the sector itself. "Digital asset firms are an increasingly important part of the U.S. financial sector, and their resilience is critical to the health of the broader system," he said.

He added: "By extending access to the same high-quality cybersecurity information used by traditional financial institutions, Treasury is helping promote a more secure and responsible digital asset ecosystem."

Treasury also presented the programme as part of a broader approach to digital finance that places security alongside market development. Officials described cyber resilience as central to the responsible expansion of digital financial services as digital assets become more intertwined with mainstream markets.

Tyler Williams, Counselor to the Secretary for Digital Assets, linked the initiative to the administration's wider policy direction. "This initiative reflects the principles of the GENIUS Act by promoting responsible innovation grounded in strong cybersecurity and operational resilience," he said.

He added: "As digital assets become more integrated into the financial system, access to timely and actionable cyber threat information is essential to protecting consumers and safeguarding the stability of U.S. financial markets."

Threat picture

Treasury cybersecurity officials said the initiative responds to a rapidly changing threat environment. The digital asset sector remains a frequent target because of the value stored on platforms, the speed of transactions and the complexity of the technical systems used across exchanges, custodians and decentralised applications.

Cory Wilson, Deputy Assistant Secretary for Cybersecurity, said attacks were increasing in both frequency and sophistication.

"Cyber threats targeting digital asset platforms are growing in frequency and sophistication," Wilson said. "This initiative expands access to actionable threat information that helps firms strengthen defenses, reduce risk, and respond more effectively to incidents."

The new arrangement could bring a wider range of crypto businesses into Treasury's cybersecurity information channels at a time when policymakers increasingly view parts of the sector not as a peripheral market, but as a component of the financial system. Eligibility will depend on Treasury's criteria, with access limited to qualifying US firms and industry groups.

For digital asset companies that have often relied on private security researchers, internal teams and informal networks for warning signs, the programme marks a more direct federal role in distributing operational cyber threat information. Eligible firms will be able to receive the same actionable cybersecurity information that is regularly shared with traditional US financial institutions at no cost.