DevHacker Noonabout 8 hours ago
Web3 key management creates massive blast radius
18 min read
Encrypting user private keys with a single backend key creates a honeypot where one stolen secret unlocks every user. This failure drained Ronin ($625M) and Harmony ($100M). MPC-based threshold signing splits the key across independent nodes so no single machine can unilaterally sign. The cggmp21 crate has CVE-2025-66017 with no patched version.
Level
Hype check
Tap to vote and see what everyone thinks.
