Three keys are distributed among three people. When something goes wrong, who can lock the door?
Suppose you and two friends jointly manage a studio’s wallet, set up so that “two of the three must sign to move funds,” and it holds 5,000 USDT (hypothetical amount). One day, you discover that the wallet has authorized an unfamiliar contract and the authorization needs to be revoked immediately. But one person is on a plane and another can’t be reached, so you can’t get enough signatures to revoke it.
Binance’s incident report, published on November 3 about the 10/29 event, stated that its hot wallet used multi-party computation (MPC). Since no single private key could immediately revoke the malicious EIP-7702 authorization, the team had to develop and carry out a special procedure, which took extra time. The report said it was reviewing its emergency procedures and signing strategy.
What went wrong?
· You only thought about “no one should be able to move funds alone under normal circumstances,” not “who can stop the damage fastest when something goes wrong.”
· You treated revoking an authorization as a routine operation and had never practiced it in advance.
Make these changes in advance:
· Write an emergency checklist: how many people need to sign to revoke an authorization, who to contact, and how quickly they need to be available.
· Regularly check wallet authorizations and revoke any involving unfamiliar contracts.
· Make sure at least one signer can always be reached, and practice revoking an authorization in advance.
The amount above is a hypothetical example for educational purposes and does not constitute investment advice.
If something happened to your wallet tonight, how many minutes would it take to stop the damage?
#钱包安全 #多签 #MustReadForBeginners
Suppose you and two friends jointly manage a studio’s wallet, set up so that “two of the three must sign to move funds,” and it holds 5,000 USDT (hypothetical amount). One day, you discover that the wallet has authorized an unfamiliar contract and the authorization needs to be revoked immediately. But one person is on a plane and another can’t be reached, so you can’t get enough signatures to revoke it.
Binance’s incident report, published on November 3 about the 10/29 event, stated that its hot wallet used multi-party computation (MPC). Since no single private key could immediately revoke the malicious EIP-7702 authorization, the team had to develop and carry out a special procedure, which took extra time. The report said it was reviewing its emergency procedures and signing strategy.
What went wrong?
· You only thought about “no one should be able to move funds alone under normal circumstances,” not “who can stop the damage fastest when something goes wrong.”
· You treated revoking an authorization as a routine operation and had never practiced it in advance.
Make these changes in advance:
· Write an emergency checklist: how many people need to sign to revoke an authorization, who to contact, and how quickly they need to be available.
· Regularly check wallet authorizations and revoke any involving unfamiliar contracts.
· Make sure at least one signer can always be reached, and practice revoking an authorization in advance.
The amount above is a hypothetical example for educational purposes and does not constitute investment advice.
If something happened to your wallet tonight, how many minutes would it take to stop the damage?
#钱包安全 #多签 #MustReadForBeginners
