Crypto Wallet Security for Protocols: How Wallet & Key Compromises Became the #1 Loss Vector

The Hack That Didn't Touch a Single Line of Your Code

In April 2026, two protocols lost a combined $576 million in the same month. Kelp DAO was drained of $291 million after its RPC infrastructure was compromised, while Drift Protocol lost $285 million. Together, these two incidents, both linked to North Korean state-sponsored actors, accounted for nearly 44% of everything stolen across Web3 in the first half of 2026.

Here's the part every founder should think about: neither attack started with a smart contract bug. Instead, the attackers targeted infrastructure, private keys, and the people responsible for managing them.

The same playbook had already led to the largest crypto theft in history a year earlier, the $1.45 billion Bybit heist. Attackers didn't exploit Bybit's smart contracts. They compromised a developer's workstation and manipulated what multisig signers saw on their screens. The transactions looked legitimate, so the signers approved them. In reality, they had unknowingly signed a malicious payload.

If your protocol's security strategy is simply, "we audited the contracts," you're protecting the wrong attack surface. The data from 2026 makes that clear, and it also shows what a protocol-grade wallet security program actually needs.

The Numbers: Attackers Followed the Money to Your Keys

In H1 2026, the average wallet-compromise incident resulted in around $13 million in losses, while the average code exploit yielded well under $1 million. The gap was even larger a year earlier, when wallet compromises drained $1.7 billion across just 34 incidents during H1 2025.

Code bugs are still common, but they no longer deliver the biggest payouts. Private keys are much harder to compromise, but when attackers succeed, the rewards are far greater. That's why sophisticated groups, including the DPRK-linked actors responsible for stealing $2.02 billion in 2025 alone, have increasingly focused on wallets, key management, and operational security.

“At QuillAudits, we now consider private keys and multisig management to be the single most critical security surface in Web3.”

Unfortunately, the industry's defensive practices haven't kept up. Research on hacked protocols found that only 19% used multisig wallets, while just 2.4% relied on cold storage.

Why Protocol Wallets Fail: The Four Weak Points

When we assess protocol wallet and key security, we usually find that most compromises can be traced back to the same handful of weaknesses.

Blind signing. Signers approve what they see on their interface instead of verifying what the transaction actually does. In the Bybit attack, signers believed they were authorizing a routine transfer, but the payload silently changed their wallet's logic. If your signers can't independently verify calldata on a hardware device, your multisig is only one compromised interface away from being controlled by an attacker.

Concentrated key risk. Keys generated on internet-connected machines, stored by a single founder, shared through chat, or held by signers located in the same office or jurisdiction create a single point of failure. One incident can put everything at risk. That's why we recommend distributing signers across different geographic locations.

Infrastructure trust. The Kelp DAO breach didn't begin with faulty smart contracts, it started with a compromised RPC, the infrastructure connecting your team to the blockchain. DNS hijacks, poisoned npm dependencies, and compromised front ends all allow attackers to position themselves between legitimate signers and the chain.

The human layer. Modern phishing campaigns are no longer about sending thousands of random emails. Attackers now spend weeks researching and targeting the specific people who control treasuries, deployer keys, and admin privileges. Phishing incidents dropped 52% year over year, but the total losses barely changed because the attacks became far more precise. Fake recruiters, fake investors, and fake IT support have replaced mass phishing. Today, stealing keys is often more about deception than technical exploitation.

What Protocol-Grade Wallet Security Looks Like in 2026

The encouraging part is that this type of attack is highly preventable. Protocols that consistently stay out of hack reports tend to follow the same security architecture.

1. Harden the Multisig ,  Then Audit It

A secure multisig requires more than multiple signatures. It means using meaningful thresholds instead of a 2-of-2 setup where both keys sit on laptops, securing signers with hardware devices, distributing them across different organizations and locations, implementing timelocks for privileged operations, and ensuring every signer verifies transaction hashes independently rather than trusting the front end.

A multisig and OPSEC audit validates all of these controls. It reviews signer configurations, role separation, upgrade procedures, and even evaluates how the protocol would respond if one signing key were compromised.

2. Audit the Infrastructure Around the Keys

Your attack surface extends well beyond private keys. RPC endpoints, DNS records, CI/CD pipelines, dependency supply chains, and the front end trusted by both users and signers all need protection.

These were the exact layers exploited in the Kelp DAO and Bybit incidents, which is why infrastructure and supply-chain audits focus on securing every component surrounding the keys, not just the keys themselves.

3. Simulate the Human Attack

Technology alone can't eliminate human risk, but you can measure and reduce it.

Targeted phishing exercises, impersonation attempts, and social engineering red-team engagements help identify which team members are most vulnerable before a real attacker does. These simulations expose weaknesses that technical audits simply cannot detect.

4. Monitor Signer Activity Live

Key compromises almost always leave detectable activity on-chain. Unusual admin calls, unexpected signer behavior, timelock modifications, and abnormal approval patterns are often the earliest warning signs.

Real-time monitoring turns those warning minutes into an opportunity to pause and respond instead of conducting a post-mortem after funds are gone. With recovery rates now below 1% once assets are moved, those few minutes can make all the difference.

The Boardroom Takeaway: Your Treasury Is the Target

For CXOs, the shift is straightforward: attackers are no longer asking, "Where's the bug?" They're asking, "Who controls the keys, and how do we reach them?"

A smart contract audit, while essential, only answers the first question. Protecting against the second requires a much broader operational security strategy.

That's exactly why QuillAudits expanded its focus beyond code. In addition to adversarial smart contract audits, we provide OPSEC maturity assessments, multisig architecture and signer security reviews, wallet security audits, infrastructure and supply-chain audits, human-layer attack simulations, and QuillMonitor for real-time operational alerts. Together, they offer comprehensive protection against the attack vector that now causes the largest financial losses in Web3. It's part of how we've helped secure 1,500+ protocols and $3B+ in TVL.

Would your multisig survive a Bybit-style attack? Get an OPSEC Maturity Assessment (quillaudits.com/opsec-and-multisig-audit) and find out before someone else does, or book a free consultation with a QuillAudits security expert. We respond within 24 hours.

The biggest hacks in web3 are turning out to be about processes that are not working right. Code is part of it but not the only thing. Audits on contracts still matter a lot, but they only cover so much of what needs protection these days.

Attackers are moving toward wallets and other parts of the setup, along with the people who run things. Protocols must change how they handle security to keep up. It seems like the focus has to be on more than just the contracts being safe. Everything else around them matters too, but that part can be harder to figure out. There is a lot to think about with all of this.