Skip to main content

Security and Best Practices

Commitment to Unparalleled Security​

At Keyban, we recognize the critical importance of wallet security in protecting users' valuable assets. Given the numerous security breaches that have historically affected wallets, we have implemented cutting-edge technological measures to ensure the highest level of protection for our users. Below, we detail the comprehensive security layers integrated into our architecture to safeguard your assets.

Historical Challenges in Wallet Security​

The development of digital wallets has faced numerous security challenges and breaches that have highlighted inherent vulnerabilities in wallet technology.

  1. MyCrypto and MyEtherWallet DNS Hijacking (2018): In April 2018, the DNS hijacking of MyCrypto and MyEtherWallet (MEW) redirected users to a phishing site by hijacking the DNS servers, leading to the loss of around $150,000 in Ethereum. This incident highlighted the importance of DNS security for wallet providers.

  2. Electrum Wallet Phishing Attack (2018-2021): Starting in late 2018 and continuing over the years, Electrum Wallet has been targeted by a phishing attack where malicious servers trick users into downloading a fake update containing malware. This attack has resulted in millions of dollars in losses and showcases the necessity of verifying software updates and using trusted servers.

  3. Ledger Data Breach and Phishing Campaign (2020-2021): In July 2020, Ledger, a well-known hardware wallet provider, suffered a data breach that exposed the personal information of around 272,000 customers. This breach led to extensive phishing campaigns throughout 2021, where attackers used the leaked data to target Ledger users with fake emails and messages, attempting to steal their seed phrases and access their funds.

  4. MetaMask Phishing Attacks (2021-2022): Throughout 2021 and 2022, MetaMask, one of the most popular Ethereum wallets, has been targeted by numerous phishing attacks where malicious actors create fake websites and prompt users to enter their seed phrases. These incidents emphasize the need for users to be vigilant and the importance of secure communication channels to prevent phishing.

  5. Phantom Wallet Exploit (2022): In August 2022, Phantom, a popular Solana-based wallet, experienced a breach where attackers exploited a vulnerability in the wallet's backend, resulting in the loss of approximately $4.5 million worth of SOL and SPL tokens. This incident highlighted the importance of securing wallet infrastructure and backend systems.

  6. Slope Wallet Exploit (2022): Also in August 2022, Slope, another Solana-based wallet, was exploited due to a vulnerability that caused the leak of users' seed phrases. This breach led to the loss of millions of dollars in various cryptocurrencies, stressing the critical importance of securely managing and storing seed phrases.

  7. Coinbase Wallet Exploit (2022): In November 2022, several Coinbase Wallet users were targeted by a sophisticated phishing attack where malicious actors tricked users into authorizing fraudulent transactions. This incident emphasized the importance of user education and awareness to prevent phishing attacks.

  8. FTX Collapse and Wallet Exploit (2022): In November 2022, following the collapse of the FTX exchange, the platform experienced a mysterious wallet exploit, resulting in the unauthorized transfer of over $400 million in various cryptocurrencies. This incident brought attention to the risks of centralized exchanges and the importance of proper wallet security measures even in times of organizational distress.

  9. Trust Wallet Incident (2022): In December 2022, some Trust Wallet users reported unauthorized transactions due to a vulnerability in the wallet's browser extension. Although the exact amount lost was not publicly disclosed, the incident underscored the need for rigorous security testing of wallet extensions and add-ons.

These incidents underscore the need for robust security measures in the wallet ecosystem. At Keyban, we have drawn lessons from these historical challenges to create a more secure future for our users.

Advancing Toward SPOF-less Wallets​

At Keyban, we believe that eliminating single points of failure (SPOFs) is essential in wallet architecture. Keyban's architecture prioritizes security and resilience by integrating advanced technologies to ensure decentralized control and robust protection.

Using Threshold Signature Scheme (TSS), Shamir Secret Sharing (SSS), Hardware Security Modules (HSMs), proactive security measures, account abstraction, end-to-end encryption, and robust disaster recovery protocols, Keyban offers a comprehensive solution to protect and control users' digital assets.

System Architecture​

Threshold Signature Scheme (TSS): Strengthening Security​

Threshold Signature Scheme (TSS) divides private key fragments among a group of participants, allowing them to collectively produce a signature without ever reconstructing the private key. This decentralized approach reduces the risk of a single point of failure.

Keyban Wallet employs TSS to generate two secret shares for each blockchain account: a client share and a server share. The client share is stored securely on the user's device or in a user-accessible cloud storage, while the server share is distributed across multiple servers in the Keyban Network. This ensures no single entity has full control over the private key, dramatically enhancing security.

Shamir Secret Sharing (SSS): Enhanced Key Management​

Shamir's Secret Sharing (SSS) divides a secret into multiple shards distributed among different participants, ensuring the secret remains secure even if some shards are compromised. Keyban uses SSS to split the server share into multiple shards, stored on encrypted databases across different servers. This distribution ensures the server share remains protected and can be reconstructed in case of server failure, enhancing system resilience.

Reshare: Proactive Security Measures​

Key rotation is crucial for minimizing the impact of a potential key compromise. Keyban Wallet implements proactive security by periodically resharing TSS shares associated with blockchain accounts. This involves generating new TSS shares, effectively refreshing cryptographic secrets and enhancing overall security.

Hardware Security Modules (HSMs): Secure Data Storage​

Keyban Network's infrastructure is fortified with Hardware Security Modules (HSMs) that securely store cryptographic keys and perform cryptographic operations. HSMs are FIPS 140 Level 2 certified, ensuring compliance with rigorous security standards. Keyban uses HSMs to protect SSS shards and other critical cryptographic materials, providing an additional layer of security.

Account Abstraction: On-Chain Payment Policies​

Keyban Wallet allows users to set up payment limits within their wallet's smart contract, enforced on-chain. This ensures that any transaction exceeding the set limits is automatically rejected by the blockchain network. Modifying payment policies requires additional authentication, adding an extra layer of security.

OAuth 2.0 Authentication​

Keyban's server implements the OAuth 2.0 framework, providing secure and standardized authentication for users. OAuth 2.0 enables delegated access to protected resources without sharing credentials, using JSON Web Token (JWT) tokens for authorization.

Passkey: Biometric Authentication​

Passkey technology, supported by the FIDO Alliance, enables passwordless logins using public-key cryptography. Biometric authentication, such as Face ID or Touch ID, enhances security by requiring users to verify their identity with unique biometric traits. Keyban Wallet uses passkey for secure transaction authorization, ensuring only authorized individuals can access accounts and perform transactions.

TLS: End-to-End Encryption​

Transport Layer Security (TLS) ensures secure data transmission over the Internet. Keyban enforces TLS for all communication, both user-facing and internal, preventing man-in-the-middle attacks and ensuring end-to-end data protection.

Zero Trust Architecture​

Keyban adheres to a zero trust architecture, which operates on the principle of not trusting any service or device by default. Every device, user, and software components must undergo continuous verification and authentication, minimizing the risk of security breaches.

Disaster Recovery​

Keyban Wallet incorporates emergency key exportation and social recovery to ensure users can regain access to their funds in case of a disaster. Emergency mode allows users to compute and export private keys to another wallet, while social recovery involves designated guardians assisting in account recovery.

Security Audits & Compliance with Regulations​

Non-Custodial: MiCA and PSAN Friendly​

Keyban Wallet is a non-custodial solution, giving users complete control over their digital assets. This aligns with the principles of MiCA and PSAN, providing a secure and compliant environment for managing digital assets.

Comprehensive Pen Testing​

Keyban conducts regular penetration testing to identify and mitigate potential security vulnerabilities. This proactive approach ensures continuous assessment and strengthening of our security posture.

Audit of our Cryptographic Protocol​

Keyban's cryptographic protocol undergoes thorough third-party audits to ensure the highest level of security and reliability. This includes key generation, key derivation, and signature aspects.

PSD2 Compliant​

Keyban complies with the Second Payment Services Directive (PSD2), implementing multi-factor authentication (MFA) to enhance the security of electronic payments and protect consumer rights.

GDPR Compliant​

Keyban is fully compliant with the General Data Protection Regulation (GDPR), ensuring that no personal data is collected, stored, or accessed, safeguarding user privacy and data security.

SOC 2 Type 2 Compliant​

Keyban is undergoing a SOC 2 Type 2 compliance audit, evaluating the effectiveness of our controls and processes related to security, availability, processing integrity, confidentiality, and privacy.