While the encryption industry has for many years placed significant security inputs on smart contract audits, the latest industry data indicate that the source of real losses is often not in the chain itself. CoinDesk quoted DeFiLlama as saying that about 40 per cent of the industry's cumulative hacking losses of approximately $16.69 billion were related to the theft of private keys rather than to the break-in of the bottom of the block chain or the smart contract code.

More losses from key management

The security agency CertiK indicated that operational security incidents were on the rise and that the use of smart contract loopholes had decreased. As project parties continue to engage in contract-based audits, the attackers have begun to move to more vulnerable areas, including personnel operations, third-party tools, cloud service vouchers and key storage processes.

Institutionally, the private key problem is closer to the “account password leak” rather than the password lapse. The Cysic founder and CEO, Le Fan, states that the elliptical curve itself has not been broken and that the real recurring problem is key management.

Single private key mode exposure risk

Once a private key is used to sign a transaction, it usually needs to be in an online service, server or associated tool chain. This means that it will be exposed to software dependence, key banks, development processes and manual operations, and that the attack surface will be expanded.

Wish Wu, co-founder and Chief Executive Officer of Pharos, stated that many block-chain infrastructure was initially designed in a “single-user, single-key” model, with one private key to control all assets. Once the key is lost or stolen, the asset may be lost instantly.

The article mentions that the Bybit attack in February 2025 is a case in point. The aggressors invaded the software supply chain of the third-party development tool by embedding a malicious code in the wallet web interface to induce the executive to sign the transaction, which eventually led to the transfer of approximately $1.5 billion to the south-east.

Industry started to push for alternatives

Various alternatives are being promoted within the industry in response to the concentration risks posed by a single private key. According to Wish Wu, progress is mainly reflected in MPC wallets, accounts with social rehabilitation in abstracto, passkey-based access, mandatory use of hardware wallets, and more complete key management standard processes.

Among these, the idea of MPC and door-limited signatures is to divide the signature process among multiple participants and to avoid the presence of complete private keys at the same time and place. Even if a single point is breached, it will be difficult for the attackers to gain direct full control.

In the abstract, the account attempts to include more security rules directly into the wallet account itself, such as expenditure limits, white list addresses and alternate custodians. Even if a signatory fails to comply, it may not be possible to empty the account assets alone.

  • Accumulated business hacker losses of approximately $16.69 billion
  • About 40 percent of them are related to private key leaks.
  • Bybit attack lost approximately $1.5 billion ETH

According to many interviewees, the next focus was not just to add one-time audits, but to extend security requirements to the entire development, deployment and day-to-day operation. For encryption projects, staff training, authority management and review of third-party tools are becoming as important as contractual security.