The Keys Were Never Stolen: What the 2025 Wallet Failures Actually Proved

On February 21, 2025, a Safe{Wallet} multisig holding roughly 401,000 ETH executed a transfer its signers believed was routine. The front-end had been poisoned. Malicious JavaScript rewrote the payload between the moment the transaction was displayed and the moment it was signed. The signers saw a legitimate address and an expected data blob. The chain executed something else.

No secure element was cracked. No seed phrase was photographed. No 24-word backup was brute-forced. The recovery phrase did exactly what it was specified to do — it stayed secret, and it authorized something the humans approving it never saw.

I have been reconstructing ledgers for nine years. Mapping the Alameda flows in 2022 took three weeks and more than five hundred internal transfers. This one took minutes to understand and months to explain, because the industry keeps examining the wrong layer. Every time a custody failure makes headlines, the discourse runs immediately to whether seed phrases are too hard for beginners. That is not the question the data supports.

Context

The self-custody debate resurfaced in late 2025 around a single rhetorical question: was self-custody ever designed for beginners?

The technical answer is unambiguous. It was not. BIP-39 shipped in 2013. BIP-32 and BIP-44 followed. Their design objective was determinism and recoverability — one entropy source producing a reproducible key tree across wallets and chains. Usability was never a constraint in the specification. The implicit user model was an engineer who could store twelve words offline, understand that the derivation is irreversible, and verify a receiving address character by character against a hostile display.

That is an interface designed for the person who wrote it. It has never been validated against human-factors research. The entire mnemonic standard predates the smartphone as the default computing surface.

Meanwhile the market spent five years selling "self-custody" as a product category while quietly redefining the term. Three distinct architectures now travel under one word.

Hardware wallets: a certified secure element holds key material; the host supplies the transaction. Multisig: an on-chain permission structure, n-of-m, publicly enumerable and independently verifiable. Seedless — MPC-TSS sharding, account abstraction, passkeys: key material distributed across operators, recoverable through a vendor.

Calling these equivalent is a category error. It is the error that produced 2025's losses.

Core

Here is the structural insight the discourse misses. Every self-custody design relocates risk. None removes it.

Hardware wallets move risk from key exfiltration to supply-chain integrity plus signature verification. Multisig moves risk from single-point loss to signer collusion plus interface hijacking. Seedless moves risk from user custody to provider solvency and provider honesty.

That is the entire map. Three doors. Three different rooms. None of them safe.

The empirical record is unusually clean on where the failures actually land. Ledger Connect Kit, December 2023: a poisoned npm dependency, roughly $600,000 drained from users who signed against a compromised front-end. Radiant Capital, October 2024: malware on a signer's machine rewrote transaction payloads before they reached the hardware device, which faithfully rendered what it was handed — roughly $50 million gone. Bybit, February 2025: the Safe{Wallet} front-end again, 401,000 ETH.

Three incidents. Three years. Zero successful extractions of a private key from a certified secure element in any of them.

I do not guess; I verify. The verification says the attack surface migrated from the key store to the signing ceremony. The industry spent a decade hardening the vault and left the door — the mechanism that tells a human what they are approving — completely unguarded.

The failure mode has a name. Blind signing. A device that cannot parse a complex transaction renders a hash. A signer who approves a hash has verified nothing. They have attested to a belief.

Blind signing is not a user error. It is an interface defect that the industry has externalized onto the user and then billed as self-reliance.

In 2017 I spent six weeks reverse-engineering a token contract whose minting function carried an integer overflow. I submitted the report. The team ignored it and raised $12 million. Two weeks after launch the treasury was drained. The lesson has held for nine years: the failure is never where the marketing points. In 2017 it was unchecked arithmetic. In 2025 it was unchecked rendering.

Now the second-order problem, and the one that should concern anyone holding through this cycle.

Multisig and seedless custody are not the same risk class. Multisig is an on-chain permission structure: the policy is public, the signers are enumerable, the history is auditable. A 3-of-5 with hardware signers in separate jurisdictions is a verifiable claim. You can inspect it without trusting a single party.

Seedless is not verifiable at all. The shards live with an operator. The recovery flow lives with an operator. That operator's key ceremony, employee access controls, internal segmentation, and subpoena response are not on-chain and never will be. You are trusting a black box you cannot read.

One of these is auditable security. The other is trusted security wearing self-custody vocabulary. Collapsing them into one bucket is how a user ends up with the weaker guarantee while believing they purchased the stronger one.

And there is a structural contradiction nobody prices. The trustless endpoint sits on a deeply centralized supply chain — a handful of secure-element vendors, a handful of CDN providers, a handful of RPC endpoints, one firmware update channel per device. The 2025 failures were not cryptographic breaks. They were supply-chain and rendering failures on top of a stack that advertises trustlessness downstream while concentrating trust upstream.

There is also no moat. BIP-39 is universal. Migration cost between compatible wallets is effectively zero. I can move a portfolio across vendors in eleven minutes and so can anyone else. The wallet layer has no network effects to defend — only brand trust, the most fragile asset in this industry, because a single incident destroys it irreversibly.

Every transaction leaves a scar on the ledger. Trust does not. Trust evaporates clean.

Contrarian

The "not your keys, not your coins" crowd is right, and I will state that plainly because everything above is not an argument for custody.

Custody risk is not smaller. It is differently shaped. Mt. Gox, 2014. FTX, 2022. In the FTX reconstruction I mapped more than five hundred transfers between Alameda-controlled wallets and counterparties including Gemini and Celsius, and the commingling was legible from public chain data weeks before any filing. Silence is the loudest admission of guilt — and the chain was not silent. It was simply not read. Volume is vanity; on-chain flow is sanity.

So examine what the "self-custody is too hard for beginners" framing actually accomplishes. If every architecture carries risk, and the beginner cannot evaluate which risk, the correct conclusion is not "use a custodian." It is "reduce the beginner's exposure until they can evaluate." That is not the conclusion the framing delivers.

That is the symmetry trap. "All options carry risk" is technically true and rhetorically efficient — for whoever benefits from users absorbing the risk they understand least.

There is a policy slide buried in it. Beginner protection is the most reliable available justification for restricting self-custody, and it has already been used. A settled consensus that self-custody is unsuitable for the median user materially lowers the political cost of restricting it for everyone, including the users who can read a hash.

And the exit that looks most beginner-friendly is the one most likely to be reclassified. A recovery provider capable of reconstructing your keys is a party exercising control over user assets. Under most AML frameworks, control over user assets is the definition of the licensed activity. The safest-sounding architecture walks backward into VASP status while its marketing claims the opposite.

What the bulls got right deserves credit. Account abstraction is real progress. Session keys, spending caps, allowlists, social recovery — programmable permissions genuinely reduce blast radius. In 2026 I audited a protocol letting autonomous agents manage DeFi positions and found a reward-function flaw that could be driven into micro-arbitrage loops; a short Python script drained 15 ETH from a test environment. Deterministic systems fail deterministically. Programmable permissions help precisely because they constrain the deterministic surface.

But every recovery mechanism reintroduces an intermediary. Convenience and verifiability sit at opposite ends of the same lever, and no roadmap has moved them.

Takeaway

There is no token that expresses this thesis. Hardware vendors do not issue coins. Safe's governance token does not gate the multisig — the contracts work whether or not you hold it. The most-discussed security narrative in this market has no tradeable instrument attached, which is exactly why so much of the surrounding commentary is noise. There is nothing to be long.

So here is the accounting I am waiting for. Within twelve months, at least one major vendor will ship hardware that renders full calldata, in readable form, on a trusted display, and it will be marketed as the fix. Who audits the renderer? Who verifies that the pixels match the payload byte for byte, across every chain and every contract standard, after every firmware update?

The code does not lie; only the auditors do. Right now, for the screen, there are no auditors at all.