blog.alankrit.net

Tag: wallet security

  • Day 25 — How Can a Crypto Treasury Avoid One Dangerous Key?

    Watercolor illustration of several trusted signers jointly unlocking a multisignature crypto treasury

    A normal crypto wallet may be controlled by one private key. That is wonderfully simple until the key is lost, stolen, or held by one person who should not have unlimited power. A multisignature wallet replaces that single point of failure with a shared approval rule.

    A multisig can be configured as two-of-three, three-of-five, or another threshold. In a two-of-three wallet, any two authorised signers must approve a transaction before it executes. One lost key does not freeze the funds, and one compromised signer cannot move them alone.

    This structure is useful for company treasuries, DAOs, investment groups, and even families. Different people or hardware wallets can hold the signer keys. A payment can be proposed, reviewed by others, and executed only after enough independent approvals are recorded.

    Multisig does not remove trust; it distributes it. If enough signers collude, they can still take the funds. If too many keys are lost, the required threshold cannot be reached. Signers may also approve a malicious transaction without understanding it, so clear operating procedures matter as much as the contract.

    Good setups separate keys across devices and locations, document how signers verify destinations, test recovery with small amounts, and plan how signers can be replaced. The threshold should balance security with the practical ability to act during an emergency. Five approvals may sound safer until two people are unreachable.

    Over these first twenty-five days, we moved from the basic problem of digital trust to blocks, mining, consensus, Ethereum, smart contracts, wallets, tokens, DeFi, and community governance. Multisig ties many of those ideas together: cryptographic signatures, programmable rules, transparent execution, and human coordination.

    The larger lesson is that blockchain does not make trust disappear. It lets us define who must agree, what rules they must follow, and which evidence everyone can verify. That is a strong foundation for the next stage of learning, where we can examine upgrades, scaling, bridges, privacy, and the harder trade-offs behind real systems.

  • Day 18 — What Is DeFi If There Is No Bank Behind It?

    Watercolor illustration of open financial services connected through decentralized smart contracts

    Traditional finance organises payments, exchanges, loans, and savings through institutions. Decentralised finance, or DeFi, rebuilds some of those functions with smart contracts on public blockchains. The contracts hold assets and apply rules that users can inspect and invoke with a wallet.

    A DeFi application might let you swap one token for another, lend assets to a shared pool, borrow against collateral, or earn fees by supplying liquidity. There may still be teams, websites, governance groups, and service providers, but the settlement logic and balances are recorded on-chain.

    Its defining feature is open access to the contracts. A compatible wallet can interact without opening a conventional account, and another developer can connect one protocol to another. This composability is often compared to building with money legos: a lending position can become collateral elsewhere, while a trading pool supplies a price or yield source.

    Composability creates efficiency, but also dependency. If one protocol has a bug, a bad price feed, or a failing asset, the effects can travel through every application built on top of it. Transparent code lets anyone inspect the rules, yet it also lets attackers study those rules and search for weaknesses.

    DeFi does not remove intermediaries so much as replace some human discretion with software, incentives, and governance. Users take responsibility for private keys, transaction approvals, network fees, and contract risk. Returns are not protected merely because a dashboard uses the word earn.

    Before depositing, it helps to ask where the return comes from, who can change the contracts, what assets back the position, how withdrawals work, and what happens during a market shock. Audits, long operating history, and diversified risk are useful signals, not guarantees.

    The simplest DeFi action is often a token swap. But without a traditional exchange matching buyers and sellers, who provides the other side of that trade? Tomorrow we will unpack the automated market maker.

  • Day 11 — How Can a Wallet Prove It Is You Without a Password?

    A private wallet key creating a verifiable digital signature

    A crypto wallet looks a little like a banking application, but the similarity can be misleading. The wallet does not contain coins, and a blockchain does not keep a private password database for its users. What the wallet protects is a cryptographic secret that allows its owner to authorise changes on the public ledger.

    This secret is called a private key. From it, software can derive a public key and an address that other people may safely know. When you send ether or interact with a smart contract, the wallet uses the private key to create a digital signature. The private key itself does not leave the wallet. The signature travels with the transaction.

    A digital signature acts like a seal tied both to the signer and to the exact message being signed. Ethereum nodes can use public information to verify that the signature could only have been produced by the corresponding private key. If even one detail of the transaction changes, the old signature will no longer match.

    This gives the network proof without requiring identity. Ethereum does not need to know your name, email address or face. It needs to know that the holder of a particular key approved a particular instruction. Control of the key therefore becomes control of the account, which is why ‘not your keys, not your coins’ is more than a slogan.

    Wallets often represent the key through a recovery phrase made from a list of words. That phrase can recreate the wallet’s keys, so anyone who obtains it may gain the same control as the owner. There is usually no central help desk capable of reversing the theft. A wallet interface can be replaced; a compromised recovery phrase cannot be made secret again.

    Signatures remove the need to share passwords with every application, but they create a new responsibility: understanding what is being signed. A malicious website may ask for approval that looks harmless while granting broad control over tokens. Good wallet security includes reading transaction details, limiting approvals and keeping recovery information offline.

    Now we can prove who authorised a transaction. But what exactly does an Ethereum account own? Bitcoin speaks about individual unspent outputs, while Ethereum often shows a simple balance. The two systems organise ownership in very different ways.