American Bitcoin Corp.

Information Security Program

The mission of our information security organization is to design, implement, and maintain an information security program that protects our systems, services, and data against unauthorized access, disclosure, modification, damage, and loss. The information security organization is comprised of internal and external security and technology professionals. We continue to make investments in information security resources to mature, expand, and adapt our capabilities to address emerging cybersecurity risks and threats.

Cybersecurity Risk Management and Strategy

Cybersecurity risk management is one component of our information security program that guides continuous improvement to, and evaluates the confidentiality, integrity, and availability of our critical systems, data, and operations.

Our approach to controls and risk management is based on guidance from the National Institute of Standards and Technology (“NIST”) and the Crypto Currency Security Standard (“CCSS”). This does not mean that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST and CCSS as a guide to help us identify, assess, and manage cybersecurity controls and risks relevant to our business.

Our cybersecurity risk management program includes:

While we face a number of ongoing cybersecurity risks in connection with our business, such risks havenot materially affected us to date, including our business strategy, results of operations, or financial condition.

Cybersecurity Governance

Our Board considers cybersecurity risk as part of its risk oversight function and has delegated the oversight of cybersecurity and other information technology risks to the Board’s Audit Committee as well as hiring athird party vendor that specializes in cybersecurity to oversee and provide an assessment on the Company’s IT controls. The Audit Committee meets at least quarterly to discuss matters involving cybersecurity risks.

The Audit Committee ultimately provides information to our board members regarding its activities, including those related to cybersecurity risks. The Audit Committee also receives a briefing and continuing education from a member of the third party vendor relating to our cyber risk management program at least annually. Thethird party vendor is responsible for notifying the Audit Committee of material cybersecurity incidents.

Cybersecurity Incidents

In 2023, a threat actor representing to be the Sphere 3D Corp. (“Sphere 3D”) CFO inserted themselves into an email exchange between the Sphere 3D CFO and the Company’s former CEO, which also included Sphere 3D’s CEO, regarding the transfer of Sphere 3D’s BTC from the Company’s wallet to Sphere 3D’s wallet. The threat actor requested that the BTC be transferred to an alternate wallet. As a result, 26 BTC, with a value of approximately $560,000 at the time, was transferred to a wallet controlled by the threat actor. Via counsel, Gryphon engaged with US Federal law enforcement to recover the BTC. Despite these attempts by law enforcement to recover the BTC, recovery was not possible. Gryphon subsequently wired the commensurate amount in USD to Sphere 3D to make them whole for the stolen BTC. Gryphon also engaged a nationally recognized third-party firm to perform a forensic analysis. The analysis revealed that the threat actor did not enter the email exchange via Gryphon’s IT systems. The Company has also subsequently modified its control systems to protect against any future attempted incursions. During the quarter ended June 30, 2023, the Company made a payment to Sphere 3D for $560,000, which was classified as a general and administrative expense on Gryphon’s consolidated statement of operations.