about $15.57b of the $27.56b in crypto hack losses came from five categories involving weak, leaked or compromised keys. that’s 56.5% of all dollars stolen across the incidents in the chart. three categories alone account for almost half the total (48.72%): • keys leaked through infrastructure (24.34%, ~$6.71b). • weak key generation (13.19%, ~$3.63b). • compromised hot wallet keys (11.19%, ~$3.08b). the 2022 ronin bridge hack shows why the signing threshold matters. withdrawals required 5 of 9 validator signatures. the attacker controlled four sky mavis validators and used a permission that had never been revoked to obtain the fifth signature from the axie dao validator. two withdrawals drained 173,600 eth and 25.5m usdc. ronin required five signatures, but one compromised operator could effectively supply all five. that gap between the number of signatures and the number of independent signers is easy to miss.