
What are some of the biggest single-private-key wallets that sign programmatically? MEV bots, Exchange hot wallets maybe, not oracles (multisig), not bridges (multisig), not defi, …. Anything with a decent chunk of value to protect matures to using multiple setups with fault tolerance and diversity for security. On the consensus layer, I think we’re lagging behind through complacency. I would say less than 1% of stake if not 0% are running on proper no single point of failure setups, depending on how militant you want to be about how you define it. I think we hand wave at the fact that a hacker can just destroy your money not steal it, so it’s not as compelling for them to go after, which may be true, but I’m not sure it’s enough; when the costs of AI-enabled spear phishing campaigns are decreasing and their quality increasing. Defence needs to be successful every single time, offence just has to succeed once. That’s not symmetrical. We had a near-miss with 10% of the validator set just last year we’ve mostly forgotten about. It’s also rational to accumulate stolen keys rather than coming forward once they’ve stolen some. A hacker’s leverage grows non-linearly with the more ETH they can slash. We don’t know how many keys are already silently stolen, but I don’t think it’s 0. Let’s try and fix this before not after a disaster. Let’s run more distributed validators, and reduce the amount of single points of failure in our staking setups, and make Ethereum more anti-fragile.
