How a single biased nonce drained Upbit’s Solana hot wallet… and why the fix has been staring us in the face for years.
Somewhere in a Seoul server room, an alarm quietly chirped. A Solana hot wallet belonging to Upbit, South Korea’s largest exchange, had just signed its 10,000th transaction of the night. That signature, along with the 9,999 before it, exposed a weakness in the signing process.
The nonce, that supposedly random number used exactly once in ECDSA signatures, wasn’t random enough. A lattice attack, the cryptographic equivalent of hearing a safe’s tumblers click into place, reconstructed the private key in minutes. Thirty minutes later, $38 million in SOL, JUP, BONK, and a dozen meme coins were gone, scattered across 185 fresh wallets like digital confetti.
The theft used a mathematical attack against biased randomness in the signatures.
The defense against this exact attack has existed since 2017… but it’s been impractical to use, until now. Let’s dive in.
Act I: The Single Point of Eternal Failure
Hot wallets are the quiet risk that every exchange has to manage. Their need for fast, simple online access often leads wallet managers to use one private key: a single 256-bit integer that gives an attacker full control if it is guessed, leaked, or mathematically derived.
The attacker solved for Upbit’s key by exploiting the signature bias. Every signature on Solana is public. Collect enough of them, spot the bias, run the lattice reduction, and voilà! You’re the new owner.
Act II: The Hero We Keep Ignoring
Meanwhile, across the blockchain universe, thousands of DAOs and treasuries sleep peacefully every night behind something called an on-chain multisig smart account.
Think of it as a vault that never has a single master key. Instead, the key is split into pieces (shards) and held by different people, hardware wallets, or even different continents. To move money you need, say, 4 out of 7 signers to agree.
If one signer’s machine explodes, gets pwned, or starts leaking biased nonces? No problem. The other six just rotate that signer out and keep going. The attacker is left holding one useless shard, staring at a vault that laughs in m-of-n.
Gnosis Safe (now just Safe) has been doing this on Ethereum since 2017. Squads Protocol does it natively on Solana. Aave, Uniswap, Lido, … none of them have ever lost a cent to a single-key derivation attack. Ever.
Act III: “Yeah, but it’s complicated…”
And here’s where the plot twist usually arrives.
Exchange ops teams look at Safe’s frontend circa 2022 and shudder:
- “I have to collect signatures from five different people?”
- “Transaction batching is a nightmare.”
- “Users will hate the extra click.”
- “What do you mean the gas optimization modules are still experimental?”
So they shrug, keep the single-key hot wallet, and promise themselves they’ll “move to multisig next quarter.” Next quarter never comes.
Until one morning the lattice attack does.
Epilogue: The Future That’s Already Here
Smart accounts already manage assets at billion-dollar scale and support multiple signers and transaction limits. What’s been missing is the experience layer: the invisible, delightful, no-compromise interface that makes smart accounts feel as simple as a hot wallet, but as secure as Fort Knox.
At OKcontract Labs, we are building Chainwall to add contract-enforced approval and execution rules to protected onchain accounts.
Teams register the people, contracts, token records, policies, workflows, and accounts they approve. An approval is tied to one exact operation. At execution, Chainwall checks the submitted request and current policy again before a protected Safe or purpose-built Chainwall smart account calls the protocol. Teams can also require separate approval and a waiting period before selected permissions change.
That turns a multisig from a signer threshold into one part of a clearer operating process: approvers can review the exact action, reusable workflows resolve approved contracts from the registry, and the account rejects unsupported execution paths.
The ghost that visited Upbit on November 27 doesn’t need to haunt anyone else. Smart accounts are already available, and clearer interfaces can make them easier to use.
Explore Chainwall → https://chainwall.org
Review your signing setup with public nonces in mind.