Hot-wallet signer flag
A governance & admin factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor identifies whether one or more signers on a protocol's governance multisig are using addresses consistent with a hot wallet — characterized by patterns such as browser-wallet transaction signing, gas payment from exchange withdrawals, or activity from multiple simultaneous IP-routed transactions. Hot wallet signers indicate that the private key is stored in software accessible from an internet-connected device, rather than in a hardware security module or offline hardware wallet.
Why it matters
The operational security of a multisig's threshold guarantee depends on the security of each individual signer's key storage. A 5-of-8 multisig where five signers use browser extension wallets has a materially lower effective security than the same configuration with hardware wallets — because phishing, malware, or targeted key extraction is possible against software wallets. The Harmony Bridge and Radiant Capital II exploits both involved signers whose key exposure was facilitated by software-side compromise. Three in-sample hacks in the database have the hot-wallet signer pattern as a contributing factor.
Green / Yellow / Red
Green is assigned when all multisig signers demonstrably use hardware wallets or HSMs, verifiable via on-chain signing patterns or published custody disclosure. Yellow covers configurations where hardware wallet use is claimed but not verifiable, or where some but not all signers use hardware keys. Red is assigned when one or more signers show on-chain patterns consistent with software wallet usage and no hardware wallet evidence exists.
Common gray cases
This factor is grayed when the signer list is not public, making wallet type inference impossible, or when the protocol uses a smart-contract wallet with native MFA that renders the hardware/software distinction moot.
Notable historical examples
- Harmony Horizon Bridge ($100M, 2022): 2-of-5 multisig with hot wallet signers; combined with minimum threshold, key compromise caused full bridge drain.
- Radiant Capital ($53M, 2024): Signers' hardware devices were themselves compromised via supply-chain attack, demonstrating that hot-vs-hardware distinction is a necessary but not sufficient safeguard.
- Poly Network (2nd incident) ($4.4M, 2023): 3-of-4 threshold with compromised signer keys enabled forged cross-chain proof minting.
Measurement what to look for#
Determine whether ≥1 multisig signer address exhibits on-chain behavior consistent with a hot wallet (web-wallet signing pattern, no hardware signing indicators).