The Web3 Key Management Mistake That Creates Massive Blast Radius
Encrypting the private key still leaves one decryptable key behind one server — the honeypot that MPC later removes.
Encrypting the private key still leaves one decryptable key behind one server — the honeypot that MPC later removes.
Your backend can decrypt every user's private key. So can your ENCRYPTION_KEY. So can whoever gets far enough into your servers: a leaked cloud token, a poisoned CI job, one unlucky RCE.
You encrypted the keys. You feel safe. You've quietly built the biggest honeypot in the company.
I know, because that's how we started: Wallet.createRandom(), AES-256-GCM, an encrypted blob in Postgres, one ENCRYPTION_KEY in the env. It ships fast and it passes the demo. It also means one stolen secret unlocks every user at once. That's the exact failure that drained Ronin (~$625M) and Harmony (~$100M). Nobody cracked the cryptography in either case. They found the one place that could.
This...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
