All The Weaknesses of Crypto Wallet
In the crypto world, wallet security remains one of the most crucial and rapidly evolving aspects. Despite advancements such as Multisig, Multi-Party Computation (MPC), and Threshold Signature Scheme (TSS), today’s wallet architectures still have fundamental weaknesses. These flaws not only make systems vulnerable to attacks but also contradict the core principle of Web3, which should be truly trustless. This article explores current wallet security models, the problems within them, and real-world evidence showing that crypto wallets are still far from being completely secure.
Wallet Security Models
- Multisig Wallets: This security method requires multiple private keys to authorize a transaction. For example, in a 2-of-3 setup, at least two of three key holders must approve the transaction. This model distributes control, reducing the risk if one key is lost or compromised.
- Multi-Party Computation (MPC): This method splits a private key into multiple shards stored in different locations. Transactions are executed through joint computation without ever reconstructing the full key, removing a single point of failure. MPC is often used by institutional wallets for its flexibility.
- Threshold Signature Scheme (TSS): This cryptographic protocol allows a transaction to be authorized once a certain threshold is met, such as 2 of 3 keys. TSS combines elements of MPC with digital signatures, making it efficient for blockchains like Ethereum (ECDSA).
These models are often combined, such as MPC + TSS, to form stronger security layers. However, even with advanced mechanisms, they remain vulnerable to exploitation.
Get Singgih Brilian Tara’s stories in your inbox
Join Medium for free to get updates from this writer.
Core Issues in Current Wallet Architectures
Modern wallet security models such as MPC + TSS or Shamir’s Secret Sharing (SSS) are designed to protect private keys by keeping them isolated in enclaves, never exposing them completely. While this reduces the risk of key leakage, a major issue remains. Developers or third parties can still request signatures or initiate transactions without ever seeing the user’s private key directly. In some implementations, the private key can even be exported or reconstructed through system flaws.
This is problematic because Web3 is supposed to be trustless, not based on trusted parties. Some argue that using a cold wallet is the only safe option, but that view limits accessibility. True crypto security should not sacrifice usability. Everyone should be able to access Web3 safely without worrying about what type of wallet they use, where their assets are stored, or whether they could lose them unexpectedly.
Real-world incidents highlight this issue. The FTX hack happened because private keys were not properly encrypted, allowing unauthorized access. ByBit suffered social engineering attacks that bypassed its multisig setup. The ByBit breach in 2025 alone caused losses of around $1.5 billion, making it one of the biggest hacks of the year. Overall, crypto hacks in 2025 exceeded $3 billion, with wallet breaches as the main cause. There was also a rise in AI-powered and phishing-based attacks. These events prove that current wallet architectures are still not ready to handle modern threats.
Data from Chainalysis supports this conclusion. Losses from crypto hacks reached $2.17 billion by mid-2025, with wallets being the main targets. By the third quarter of 2025, total hack losses fell by 37%, yet attacks on wallets increased. This indicates that hackers have shifted focus toward individual wallet vulnerabilities. Other examples include the UPCX hack in April 2025, which stole $70 million worth of tokens, and the BigONE Exchange breach in July 2025, which lost $27 million from hot wallets. Even in September 2025, total losses reached $127 million, showing that systemic vulnerabilities still persist despite some decline in overall numbers.
Specific Vulnerabilities
Beyond these major hacks, several technical studies have revealed critical weaknesses in wallet implementations:
- TSSHOCK Vulnerability: A series of key extraction attacks targeting ECDSA-based TSS implementations, discovered by Verichains researchers at Black Hat USA 2023. It affected open-source libraries like tss-lib (used by Binance, Thorchain, and others), allowing attackers to reconstruct full private keys from leaked secret shares during the Multiplicative-to-Additive (MtA) process. Source: Fortune, 2025.
- BitGo TSS Vulnerability: Fireblocks’ cryptography research team found flaws in BitGo’s Ethereum (ECDSA) wallet. Exploiting this could allow an attacker to steal secret shares from a counterparty (BitGo or its client) within the TSS protocol, bypassing all security layers and enabling full fund theft. Source: Fireblocks Blog.
Additional research shows other MPC-related risks such as compromised key generation ceremonies and side-channel attacks during signing. In SSS (often combined with MPC), private keys can still be fully reconstructed if enough shares are collected. TSS is slightly more secure but still has potential weaknesses. Moreover, if an MPC algorithm is compromised, the private key can be reconstructed in full. Reports from Ledger also point out the lack of secure execution environments for key lifecycles outside MPC schemes, which makes wallet management more difficult.
In conclusion, even though models like MPC + TSS represent major progress, evidence from the large-scale hacks in 2025 and the technical vulnerabilities found in various implementations show that crypto wallet architecture is still far from perfect. Achieving a truly trustless and secure Web3 ecosystem will require deeper innovation in how wallet security is fundamentally built.
