Where are Your Keys
summary
Industry still stores private keys in plain text and gets burned: npm malware and a Solana package scan for plaintext keys lead to a $500k loss; cloud automation with exposed keys causes a $3M Griffin AI theft; phishing plus software wallets produces a $13M drain; a single EOA minting bug creates a $300 trillion stablecoin spike; UI-manipulated calldata enables a $1.4B bridge heist. Use not your keys, put secrets in AWS/GCP secrets managers, prefer hardware wallet plus multisig, and always decode call data before signing.
AI-written summary · about
chapters (10)
- 0:00Private key security intro
- 1:04Private key safety matters
- 3:36Never store keys plaintext
- 6:24Private keys in automation/cloud
- 9:13Phishing and wallet risks
- 12:26Hardware vs software wallets
- 13:30DevSecOps and multi-sig
- 15:414B hack and verification
- 18:50Decoding call data safety
- 21:19Exchanges and final advice
related talks
40mBlockchain Security Guarantees and Exploits
27mThe State of DeFi Security - 2024
36mDeciphering Web3 Security: Implications and Innovations
39mSecrets Management: How to (not) help the person who hacks your servers get your data
31mThe internet is broken: breaking down the software supply chain
46mThe State of Blockchain Security - 2023 Edition
29mBe nice, help the person who hacks your servers to get your data
30mNFT Scams & Best Security Practices