Crypto Crisis Readiness: Run Your Tabletop Now

The Tabletop Exercise Nobody Runs

Last Thursday, 4pm Eastern, someone started draining Binance wallets across ten blockchains. Twenty minutes later, roughly $6.3 billion was gone—the largest crypto heist on record. Binance froze withdrawals and promised to make customers whole.

I pulled up my phone and texted three CFOs the same question: "Do you know what you have there?"

None of them did.

We Practice for the Wrong Disaster

I've facilitated tabletop exercises for two decades. The script is always the same: ransomware locks the file server, an admin clicks a phishing link, customer data walks out the door. The sophisticated ones add a third-party scenario—your payment processor gets breached and your data goes with it.

Every single one is about data leaving. Almost none are about money staying.

Here's what actually happened Thursday: your assets are fine, the blockchain confirms it, the balance on your screen looks perfect, and you cannot touch a dollar of it. No data breach. No ransomware demand. No leaked credentials. Just a freeze, and the clock running on obligations you cannot meet.

The operational question isn't "what did we lose?" It's "what can't we access, who's asking for it, and what breaks first?"

FTX Was the Dress Rehearsal

November 2022. FTX collapses. I spent that week on the phone with audit committees trying to answer a question that should have been easy: what do we have on that platform?

The hard part wasn't calculating the loss. It was inventorying the exposure.

Which funds had positions there? Which portfolio companies? Which vendors auto-swept proceeds to FTX for yield? Who in your supply chain used it as an on-ramp, and what invoice are they about to miss because their treasury is frozen?

One client—mid-sized advisory firm—discovered their corporate development team had been parking M&A escrow on FTX because "the yield beat the settlement account." Nobody told finance. The spreadsheet lived in a partner's Google Drive, last updated four months prior.

That's the conversation you're having at 4:30pm on a Thursday when the withdrawal button goes gray.

The Questions Your Tabletop Doesn't Ask

Traditional disaster recovery is built for the confidentiality and integrity legs of the CIA triad. Ransomware threatens availability, but in a specific way—your data's locked, pay to unlock it. We've gotten decent at practicing that scenario.

Frozen assets test availability in a way most firms have never simulated: the system works perfectly, and you still can't execute.

Here's what I ask teams to walk through:

• Inventory. Do you have a single source of truth for every custodial relationship, updated in real time? Not the asset list—the list of where assets sit. If Coinbase froze tomorrow, could you generate that report in under an hour?

• Inheritance. Which counterparties, vendors, and portfolio companies have exposure that becomes your problem? Your fund administrator uses Binance to rebalance. They're frozen. Your NAV calculation is due. Now what?

• Communication. Who calls the auditor? What's the disclosure obligation? If you're a public filer, what's the 8-K timeline? If you're a fund, what does the LPA say about material service provider events?

• Liquidity. If you can't access 15% of treasury for two weeks, what breaks? Payroll clears, but does the vendor payment? Does the quarterly distribution?

The firms that navigated FTX quickly had answers written down. The ones that didn't spent the weekend reverse-engineering their own operations.

Why Money Is Harder Than Data

When your data leaks, the damage is done. You're in incident response mode—containment, notification, remediation. It's terrible, but the playbook is mature.

When your money is inaccessible, you're in operational limbo. The damage hasn't happened yet, but every obligation on the clock is a live grenade.

I watched this play out in 2008, different asset class. Lehman Brothers files for bankruptcy on a Monday. By Tuesday morning, firms are trying to figure out what they had in Lehman-administered accounts, what was in flight, what could be clawed back. The question wasn't "did we lose it?" It was "can we prove we didn't?"

Railroads didn't kill towns by burning them down. They just moved the station five miles south, and the town slowly emptied out. Inaccessible capital works the same way—no explosion, just obligations you can't meet until everyone who depends on you makes other arrangements.

The Spreadsheet Test

Here's the simplest version of the tabletop:

It's 4:30pm Thursday. I tell you Coinbase has frozen all withdrawals, timeline unknown. You have ninety minutes before end of business.

Can you generate a list of every asset, every dollar, every obligation that touches that platform—and who internally owns the decision on each one?

If the answer is "we'd have to ask around," you don't have an exposure problem. You have an inventory problem. And inventory problems become exposure problems the moment the freeze hits.

One firm I work with keeps a "custodial matrix"—a single sheet, updated weekly, that maps every external platform to internal owner, asset class, and downstream dependency. It's not sexy. It's a Google Sheet with conditional formatting.

When Binance froze, they had the report in twelve minutes. They knew exactly what they couldn't touch, which clients it affected, and who needed to be on the bridge. Their issue became tactical execution, not panicked discovery.

The firm next door spent Thursday night trying to figure out if they even had a Binance account. (They did. The growth equity team had opened it eighteen months prior for a token warrant position. Nobody told compliance.)

What This Looks Like Monday Morning

Walk into your next risk committee meeting and ask for the custodial matrix. If it doesn't exist, build it. If it exists but lives in someone's head or a stale SharePoint, fix that.

Here's the format that works:

• Platform/custodian name

• Asset types held there (fiat, stablecoins, tokens, other)

• Approximate value (doesn't need to be real-time, needs to be recent)

• Internal owner (name, not department)

• Downstream dependencies (what breaks if this freezes?)

• Last verified (date someone confirmed the account still exists and the balance is roughly correct)

Update it quarterly. Audit it when a new platform gets added. Make sure the person who owns it doesn't leave the firm without a handoff.

Then run the tabletop. Pick a platform. Freeze it. Give the team ninety minutes and see what they can tell you.

The firms that do this on a calm Tuesday have boring Thursdays. The ones that don't get to practice in production.

I've watched this movie four times now—different asset classes, same plot. The lockup always surprises someone. It shouldn't.

What's in your custodial matrix? And when's the last time you tested whether the person who owns it still works here?