The control nobody talks about
Most security conversations are about keys and signatures: who can sign. Velocity is about something quieter and just as important: how much can leave, how fast. A wallet with perfect signing but no velocity limit can still be drained in a single bad afternoon.
A velocity limit caps the total value that can move in a rolling window, say $50k in 24 hours and $200k in 7 days. Cross the line and the next transfer needs a higher quorum.
Why a rolling window beats a hard cap
A hard daily cap resets at midnight and ignores what happened yesterday. A rolling window does not: it always looks at the last 24 hours, so an attacker cannot wait for a reset to drain you in two halves. It also bends gracefully: a busy payroll day borrows against quorum instead of failing.
How to set yours
Pin the 24-hour limit to about 1× your normal daily outflow, and the 7-day limit to roughly 4×. That covers an ordinary week without a second thought, and turns an extraordinary one into a deliberate, approved decision rather than a silent loss.
