Key takeaways
- Crypto treasury management means deciding what a company or DAO holds, where it holds it, who can move it and how it pays its bills. Start with runway, not returns.
- Split holdings into operating cash, a stablecoin reserve and long-term tokens. A runway target tells you how much of the token position to sell, and when.
- A multisig spreads control but doesn't prove what signers are approving: the FBI attributes the February 2025 theft of about $1.5 billion from Bybit to North Korea, and Safe says the attack used a disguised transaction.
- A DAO without a legal entity can't open most accounts. Align needs a registered company, and it holds USDC, USDT and EURC, not BTC, ETH or your own token.
The short answer
Crypto treasury management is how a company or DAO decides what to hold, where to hold it, who can move it and how it pays its bills. Most of the risk comes from three questions: how many months of spending are safe from a fall in token prices, who can sign, and whether the books match the chain.
Start with runway. Work out your monthly spending in the currencies you actually pay, hold that many months in fiat and stablecoins, and treat everything else as a long-term position with its own selling plan. Then write it down, so that a sale or a transfer follows a rule and not a mood.
Split holdings into three buckets
Each bucket has a different job, so each gets different rules.
| Bucket | Job | Usually held as | Key rule |
|---|---|---|---|
| Operating | The next 1 to 3 months of bills | USD, EUR, GBP or other currencies you pay in, plus some USDC or USDT | Enough to cover payroll and suppliers without selling anything |
| Reserve | Runway beyond that | Stablecoins and, if your policy allows, cash or short-term government funds | Limits per issuer, network and provider |
| Long-term | Tokens you hold for strategy | BTC, ETH, your own token, staked or locked positions | A written selling plan; never counted as runway |
Some treasuries add a yield position to the reserve. If you do, know where the return comes from and how fast you can leave: see where a business can earn yield on USDC and USDT.
A worked example: how much to sell
These numbers are invented to show the method. A company spends $400,000 a month and holds:
| Holding | Value |
|---|---|
| Own token and ETH | $9,000,000 |
| USDC and USDT | $2,600,000 |
| Bank balances | $400,000 |
| Total | $12,000,000 |
The treasury looks like 30 months of spending. But only $3,000,000 is stable, which is 7.5 months. The board's policy asks for 18 months, or $7,200,000, so the gap is $4,200,000.
Now test the plan. If tokens fall 50%, the long-term position is worth $4,500,000, and closing the gap would use nearly all of it, in a falling market. That's why you sell on a schedule while prices are normal.
Spending doesn't stop while you sell. To reach the target in six months, you need to raise the $4,200,000 gap plus $2,400,000 of spending, or $1,100,000 a month. Check that your conversion route can handle that amount and, for your own token, that the market can too.
Run the same test on the other side. If your revenue is paid in your own token, a price fall cuts your income and your reserves together, so use a longer target.
Stablecoins aren't all one risk
A stablecoin is a claim on an issuer's reserves, and it has risks a bank balance doesn't.
- Reserve and banking risk. In March 2023, Circle's transfers of more than $3 billion of deposits out of Silicon Valley Bank failed to settle before the bank went into receivership. All the funds were later made available, but USDC temporarily traded away from its price, according to Circle's own prospectus.
- Freezes. Tether and Circle can freeze tokens at an address. See why USDT and USDC get frozen.
- Regional rules. EU companies face limits on which tokens service providers can offer. See is USDT MiCA compliant? and USDT vs USDC.
- Network risk. The same token on another network is a different contract, and a wrong-network transfer can be hard to undo. See which network to use.
Set limits so no single failure stops payroll: for example, a maximum share of the reserve per issuer, per network and per provider. Choose the percentages with your board. There's no standard.
Custody and signing
A Safe is a multisig smart contract account: you set a group of owners and a threshold, and a transaction runs only when enough owners approve. It removes the risk of one lost or stolen key.
It doesn't prove what signers are looking at. The FBI says North Korea was responsible for the theft of about $1.5 billion in virtual assets from the exchange Bybit around 21 February 2025. The Safe Ecosystem Foundation said the attack came through a compromised Safe Wallet developer machine that proposed a disguised malicious transaction, and that the review found no vulnerabilities in the Safe smart contracts. It told users to take extreme care when signing.
For a finance lead, the controls to ask for are:
- A threshold that survives absence and theft. Two of three is thin. Pick a number that still works if one signer is on holiday and one key is lost.
- Independent signers. Use different people, devices and locations, ideally not all from the same team.
- Check on a second device. Each signer should confirm the destination, amount and contract call somewhere other than the interface that proposed it.
- Separate proposing from approving. Whoever prepares a payment doesn't approve it alone.
- Test first. Send a small amount to any new address, and keep an address book of confirmed wallets.
- Plan for lost signers. Write down how signers are replaced, and rehearse it.
A custodian or a regulated provider moves some of this risk to a third party, and adds that party's own risk. Ask who can sign, what's covered and what happens if it fails.
DAO treasury management
A DAO's first treasury problem is usually legal. Banks, payment providers and most suppliers need a counterparty, and a token vote can't sign a contract or complete KYB.
Going without an entity carries risk too. In June 2023, a US court held in a default judgment in a CFTC case that Ooki DAO was a "person" that could be held liable under the Commodity Exchange Act, and it ordered a $643,542 penalty and a shutdown of its website.
Common routes are a separate operating company, a foundation, or a purpose-built structure. Wyoming's Decentralized Unincorporated Nonprofit Association (DUNA) law took effect on 1 July 2024. Uniswap's governance voted to form one, called DUNI, in a proposal executed on 12 September 2025. The proposal says members aren't personally liable by default for the association's debts, that criminal liability isn't covered, and that foreign recognition depends on foreign law. It also expected DUNI to incur US tax, so a wrapper isn't a way out of tax. Take legal advice before choosing one.
For the money itself, DAOs add a few steps to the controls above:
- Decide what governance approves. Budgets and mandates go to a vote. Single payments usually shouldn't.
- Fund an operating wallet or company by budget. Move a quarter's budget from the main treasury to the people who run it, and report back against it.
- Publish the numbers. Report holdings, spending and runway on a fixed schedule.
- Keep the entity's books. If an operating company pays the bills, it needs its own accounts, contracts and tax filings, whatever the DAO does on chain.
Accounting, tax and records
Treatment depends on the token, your rights and your accounting framework.
- IFRS. The IFRS Interpretations Committee concluded in June 2019 that holdings of cryptocurrencies fall under IAS 2 if held for sale in the ordinary course of business, and otherwise IAS 38. Its decision covered tokens with no issuer and no contract with the holder, so it doesn't settle stablecoins.
- US GAAP. Crypto assets in the scope of ASC 350-60 are held at fair value, but stablecoins that carry enforceable rights can fall outside it. See how to account for stablecoins.
- Reporting. New rules are arriving for crypto held through providers. See DAC8 and CARF.
Whatever the framework, keep a register of every wallet with its owner and purpose, and reconcile each one to the ledger every month. Store the transaction hash, the value on the day and the reason for each movement. Your auditor will want to see that you control the wallets you report.
What a treasury policy should cover
Keep it to a few pages, and have the board or DAO approve it.
| Topic | Decide |
|---|---|
| Runway | Months of spending in fiat and stablecoins, and how you measure it |
| Allowed assets | What you may hold, and limits per issuer, network and provider |
| Selling | When and how much you sell, and who can change the plan |
| Signing | Thresholds by amount, who signs, how signers change |
| Payments | Who proposes and approves, and what's tested first |
| Yield | Whether it's allowed, in what, with what maximum share |
| Reporting | Who reconciles, how often, and who sees the result |
| Incidents | Who acts if a key, provider or stablecoin fails |
How this works with Align
Align covers the operating bucket and part of the reserve, for a registered company. You can move USDC, USDT or EURC from your treasury wallet into your Align account, convert to USD, EUR, GBP or AED, which is switched on per account on request, with the rate and fee shown before you confirm, and pay suppliers and staff from named accounts in your company's name. Trades of $100,000 or more can go through the OTC desk. Roles and approvals let an admin approve payments above an amount you choose, and you can download statements for reconciliation.
Know the limits. Align isn't a bank and there's no deposit insurance. Its docs list USDC, USDT and EURC only, so BTC, ETH and your own token stay with your exchange or custodian. Align can hold a recovery key on your wallet, explained on the trust page. It opens accounts for registered companies only, and its eligibility check doesn't accept charities, foundations or non-profits, so a DAO would need a registered company. A business that needs a licence where it operates must hold one. Pricing is by quote: contact us, or see Align for web3 companies.
This guide is general information, not legal, tax or investment advice.
Sources
- FBI, North Korea responsible for $1.5 billion Bybit hack (February 2025)
- Safe Ecosystem Foundation, Statement (February 2025)
- Safe docs, Smart account overview (November 2026)
- Circle Internet Group, Prospectus, Form 424B4 (June 2025)
- CFTC, Federal court orders Ooki DAO to pay penalty (June 2023)
- Uniswap governance, Establish Uniswap Governance as DUNI, a Wyoming DUNA, Onchain vote and DUNI overview (2025)
- IFRS Foundation, IFRIC Update, June 2019: Holdings of cryptocurrencies
- Align docs, Blockchains and stablecoins and Prohibited activities
Common questions
- What is crypto treasury management?
- It's the work of deciding what digital assets a company or DAO holds, how they're split between spending money and long-term holdings, who can move them, and how they're recorded. A good treasury policy sets a runway target, limits per issuer and network, signing rules and a schedule for reconciling every wallet.
- How much of a crypto treasury should be in stablecoins?
- There's no standard figure. A practical approach is to work back from runway: hold your chosen number of months of spending in fiat and stablecoins, then decide what's left for longer-term tokens. If your income depends on your own token's price, a longer runway target makes sense, because your income and your reserves can fall together.
- Can a DAO open a business account?
- Usually only through a legal entity. As of November 2026, Mercury says it serves DAOs, and Align opens accounts for registered companies only. Align's eligibility check doesn't accept charities, foundations or non-profits, so a DAO would need a registered operating company. Ask before you apply if your structure is a foundation or a Wyoming DUNA.
- Is a multisig enough to protect a treasury?
- No. A multisig means several people must approve a transaction, which removes the single point of failure, but all of them can approve the wrong thing if what they see on screen is false. Add a check of each transaction on a separate device, signers who are independent of each other, and a small test before any new address.
This guide is general information, not legal, tax or financial advice. Rules and providers' terms change; check the sources linked above and take advice on your own situation.
