The institutional cryptocurrency broker Floating Point Group (FPG) has fallen victim to a devastating cyber attack that resulted in the theft of between $15 million and $20 million in digital assets. The breach, which occurred on June 11, 2023, was disclosed to customers on June 14, sending shockwaves through the institutional crypto trading community and raising serious questions about the security posture of even SOC 2-certified platforms.
The Exploit Mechanics
While the full technical details of the attack remain under investigation, the breach was significant enough to force FPG to immediately suspend all platform activity. The company described the incident as a “cyber security event” and confirmed that the stolen amount ranged between $15 million and $20 million in cryptocurrencies. What makes this attack particularly concerning is that FPG had previously earned SOC 2 certification for its cybersecurity controls — a rigorous auditing standard developed by the American Institute of Certified Public Accountants (AICPA) that evaluates an organization’s security, availability, processing integrity, confidentiality, and privacy.
The fact that an institution with SOC 2 compliance was successfully breached underscores a growing reality in the crypto security landscape: certifications alone do not guarantee immunity from sophisticated attack vectors. Threat actors continue to evolve their methods, often exploiting gaps that traditional audit frameworks may not fully address. Bitcoin was trading at approximately $26,327 at the time of the breach, with Ethereum hovering around $1,717, meaning the stolen funds represented a substantial sum in the context of a mid-size institutional broker.
Affected Systems
FPG operated as a prime brokerage serving institutional clients in the cryptocurrency markets. The platform provided critical infrastructure for professional traders and institutional investors who needed reliable execution, custody integration, and risk management tools. The attack forced a complete halt to all services, meaning clients could not access their positions, execute trades, or manage their portfolios during a critical market period.
The timing of the breach was particularly damaging, as it coincided with heightened regulatory scrutiny across the crypto industry. The U.S. Securities and Exchange Commission had recently filed lawsuits against both Binance and Coinbase, and market sentiment was already fragile. The FPG incident added another layer of uncertainty for institutional participants who were already questioning the operational resilience of crypto service providers.
The Mitigation Strategy
In response to the attack, FPG took several immediate steps. The company engaged law enforcement at the highest levels, confirming it was working directly with the Federal Bureau of Investigation (FBI), the Department of Homeland Security (DHS), and blockchain analytics firm Chainalysis to trace and potentially recover the stolen funds. The involvement of multiple federal agencies suggests the attack may have had cross-jurisdictional implications or involved sophisticated money laundering techniques.
FPG also committed to keeping its clients informed through regular updates, though the full scope of the attack and the specific attack vector have not been publicly disclosed. The company emphasized its cooperation with regulators throughout the investigation process.
Lessons Learned
The FPG breach offers several critical lessons for the cryptocurrency industry. First, SOC 2 certification, while valuable, should be viewed as a baseline rather than a ceiling for security standards. Organizations must continuously invest in threat detection, incident response capabilities, and real-time monitoring beyond what any static audit can capture. Second, the incident highlights the systemic risk inherent in centralized crypto infrastructure — when a single platform fails, all of its clients are simultaneously affected.
Third, the speed at which FPG detected and disclosed the breach appears to have been relatively swift, with the attack occurring on June 11 and disclosure following on June 14. This three-day window, while not ideal, represents a faster response than many crypto breaches where months have passed before detection. The prompt engagement of federal authorities and blockchain analytics firms may improve the chances of fund recovery.
User Action Required
For institutional investors and traders who used FPG’s platform, the immediate priority is to monitor official communications from the company regarding the fund recovery process. Clients should document all positions, balances, and transactions that were active at the time of the breach. Additionally, any API keys, credentials, or integration points connected to FPG should be rotated immediately as a precaution against potential credential compromise.
More broadly, institutions operating in the crypto space should use this incident as a catalyst to re-evaluate their counterparty risk management frameworks. Diversifying across multiple prime brokers, maintaining independent custody solutions, and implementing real-time security monitoring are no longer optional — they are essential components of responsible institutional participation in digital asset markets.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Readers should conduct their own research before making any investment decisions.
FPG had SOC 2 certification and still got drained for 20M. compliance audits check boxes, they dont stop determined attackers
3 day gap between the June 11 breach and June 14 disclosure is the real scandal. institutional clients had zero chance to react
Aiko T. the 3 day silence was 100% legal counsel advising them to freeze everything before going public. standard crisis playbook but brutal for clients
SOC 2 certified and still got popped for $20M. those audits are theater half the time, just checkbox compliance
SOC 2 Type II is pass/fail and the auditor barely tests your actual key management. seen it firsthand
they suspended the entire platform for a week before telling anyone. thats the part that bothers me most
a week of silence with customer funds locked. thats not a security incident, thats a coverup until proven otherwise
soc 2 certified and still gets popped. those audits are just checkbox compliance
institutions keep learning the same lesson. your custodian gets breached, you lose everything. self custody exists for a reason
^ self custody is the answer until your ledger breaks and you realize you need exchanges for on-ramps. its not binary
institutions keep learning the same lesson. custodians get breached, self custody is the answer
the AICPA needs to overhaul what SOC 2 actually tests. knowing a breach happened under a certified system tells you the gaps are systemic
a week of silence with customer funds locked is just coverup
yeah soc 2 certified but the june 11 attack still took fifteen to twenty million from floating point group. these so called security standards fail to prevent real breaches and are basically meaningless for customer protection.
This incident with FPG highlights the risks of institutional custody. Self custody allows users to control their own keys and avoid losing fifteen to twenty million like in this breach on June 11.
the breach details show the hack on june eleventh resulted in fifteen to twenty million stolen from the soc 2 certified platform and customers only learned about it on june fourteenth after three days of silence.
SOC 2 Type II audits test your documentation not your actual key management. FPG passed theirs and still got drained for 20M. the audit industry model is broken
soc2_graveyard_ the Type II audit tests documentation over 6 months. if your key management process is documented and you follow it exactly while the process itself is flawed, you still pass
soc2_graveyard_ exactly. SOC 2 means you have policies written down. it does not mean those policies actually work under a real attack. checkbox compliance at its finest
soc2_graveyard_ the auditor signs off on your written process. if your process is garbage but well documented you still pass. entire industry is built on this
3 day gap between the June 11 breach and June 14 disclosure. institutional clients had zero chance to move funds. that silence window was legal counsel protecting the company not the clients
3 day silence window is the standard playbook. legal counsel advises against disclosure until the scope is contained. problem is clients are bleeding the entire time. FPG knew by June 12 and said nothing for 48 hours minimum
Mateus A. 72 hours of silence while institutional clients had funds locked is criminal. every minute of that delay was lawyers protecting the firm not the customers
SOC 2 Type II and still lost 20M. at some point institutions have to accept that custodial risk is unavoidable unless you self-custody
self-custody is the obvious answer but institutional clients need settlement infrastructure. you cant park a pension fund in a Ledger. the real fix is MPC custody with geographic key distribution, not retail self-custody advice