Aevo

Lyra

A single multisignature crypto wallet has permissions from 12 different blockchain networks, implying that if this single wallet is ever compromised — all 12 networks could be drained of their funds with a potential $121 million in losses.
The networks include Zora, Aevo, Hypr, Orderly, Ancient8, Lyra, Mode, Pgn, Parallel and Metal — all created using the Conduit rollup creation software, according to data <a href="https://x.com/donnoh_eth/status/1792298626934333840" target="_blank" rel="noopener noreferrer nofollow">shared</a> to X on May 19 by L2Beat researcher Luca Donno.
However, the wallet can’t transact without three of five signatures from the team, Conduit founder Andrew Huang told Cointelegraph. The private keys to these signatures are stored on hardware wallets, making a compromise only possible by “physically compromising 3/5 individuals,” he said.
<figure><img src="https://s3.cointelegraph.com/uploads/2024-05/ae2554b9-4859-4e40-8b46-47395b56ecb6.png" alt="" title="">
 <figcaption style="text-align: center;">Source: <a href="https://x.com/donnoh_eth/status/1792298626934333840" target="_blank" rel="noopener noreferrer nofollow">Luca Donno</a>
 </figcaption>
</figure>
Huang claimed the system will be upgraded “over the coming weeks” to make it a five out of seven multisig instead of three out of five.
Centralization risk will be reduced further once layer 2s move to “stage 2” of decentralization, he said.
The data shows that multiple Conduit-based networks use the same <a href="https://etherscan.io/address/0x4a4962275DF8C60a80d3a25faEc5AA7De116A746" target="_blank" rel="noopener noreferrer nofollow">wallet</a> to handle tasks such as upgrading the network’s bridge. L2Beat’s Aevo data&nbsp;<a href="https://l2beat.com/scaling/projects/aevo#permissions" target="_blank" rel="noopener noreferrer nofollow">states</a>&nbsp;its account has “unlimited upgrade power” and the ability to “potentially [gain] access to all funds.” Aevo <a href="https://l2beat.com/scaling/tvl" target="_blank" rel="noopener noreferrer nofollow">has</a> over $72 million in total value locked (TVL).&nbsp;&nbsp;
<figure><img src="https://s3.cointelegraph.com/uploads/2024-05/5521c7a8-ac8a-4313-8724-0dad1bd42d03.png">
 <figcaption style="text-align: center;">Aevo conduit multisig permissions. Source: L2Beat.
 </figcaption>
</figure>
Conduit network Lyra has over $20 million TVL and L2Beat&nbsp;<a href="https://l2beat.com/scaling/projects/lyra#permissions" target="_blank" rel="noopener noreferrer nofollow">lists</a> the same wallet as the “ConduitMultisig” similarly with the potential to gain access "to all funds.”
<figure><img src="https://s3.cointelegraph.com/uploads/2024-05/60a8f9ef-d983-461b-aa6a-c4995c26d6db.png">
 <figcaption style="text-align: center;">Lyra permissions. Source: L2Beat.
 </figcaption>
</figure>
Identical statements can be found on the pages for other Conduit networks, including Zora, Hpyr, Orderly, Ancient8, Mode, Pgn, Parallel, and Metal. All blockchains have a joint total TVL of&nbsp;approximately $121 million — all tied to a single multisignature wallet.
Related: <a href="https://cointelegraph.com/news/ethereum-vitalik-buterin-wants-rollups-stage-1-decentralization" rel="noopener noreferrer nofollow">Vitalik Buterin wants rollups to hit stage 1 decentralization by year-end</a>
Layer 2 networks have dramatically <a href="https://cointelegraph.com/news/layer-2-and-multi-chain-defi-platforms-see-record-inflows-as-ethereum-fees-soar" rel="noopener noreferrer nofollow">lowered gas fees</a> for Ethereum users, but some critics claim they <a href="https://cointelegraph.com/news/layer-2-networks-hit-13-billion-tvl-but-challenges-still-remain" rel="noopener noreferrer nofollow">are too centralized</a> and do not provide a good enough user experience to allow for the mass adoption of crypto.
Layer 2&nbsp;developers claim such blockchains will become more decentralized as they&nbsp;progress through Ethereum founder Vitalik Buterin’s decentralization plan <a href="https://ethereum-magicians.org/t/proposed-milestones-for-rollups-taking-off-training-wheels/11571" target="_blank" rel="noopener noreferrer nofollow">published</a> in November 2022.
Magazine: <a href="https://cointelegraph.com/magazine/north-korean-hackers-private-keys-flash-loan-attacks/" rel="noopener noreferrer nofollow">Lazarus Group’s favorite exploit revealed — Crypto hacks analysis</a>

Hack of a single multisig wallet could drain 12 Ethereum L2s of $121M

Cointelegraph

Other articles published on May 22, 2024

Nansen: "While awaiting the SEC's Critical Decision, Whales Turned to Ethereum and ETH-Based Altc...

Gnosis Chain is now Live on deBridge

Crypto Whales Flock to BlockDAG: Will It Hit $10 by 2025 and Outshine Retik Finance’s Uniswap Debut?

Analysts Monitor Bitcoin’s Key Support Levels

Donald Trump Asks for Bitcoin, Ethereum, Dogecoin and XRP Donations As Crypto’s Election Cycle He...

Delist Announcement from Bitcoin Exchange Binance! Four Altcoin Trading Pairs Delisted from Spot ...

Join our free newsletter for daily crypto updates!