The Key Management Risk Hierarchy
Software key storage (highest risk):
Private keys stored in application memory or encrypted in a database. An attacker who compromises the application server has access to keys. Appropriate only for keys controlling assets below $100,000 with strict withdrawal velocity limits.
HSM-based key management (professional standard):
Private keys stored inside a Hardware Security Module — a tamper-resistant hardware device where keys never leave the hardware boundary. Signing operations are performed inside the HSM. Appropriate for exchange hot wallets and institutional custody above $1M.
MPC signing (institutional standard):
Key material is mathematically split across multiple parties using Multi-Party Computation. No single party holds the complete key. Signing requires computation across multiple key shares without any party ever assembling the full key. This is the model used by Fireblocks, Anchorage, and other institutional custodians.
Multi-signature (on-chain control):
Transaction authorization requires M-of-N signatures (e.g., 3-of-5). Appropriate for treasury management where the signers are identified and their signing devices are separated. Not key management per se — it is a governance layer that can sit on top of any key management system.
Hot vs Cold Wallet Architecture
Hot wallet: Connected to the internet. Used for operational liquidity — funding withdrawals in real time. Holds typically 1–5% of total exchange assets. Must use HSM or MPC key management. Cold wallet (cold storage): Air-gapped. Holds 95–99% of exchange assets. Key material generated and stored on offline hardware. Warm wallet: A middle tier used by some exchanges. Connected to the internet but with significant withdrawal velocity limits and multi-signature authorization. Holds 5–15% of assets.
The Rebalancing Problem
A hot wallet holds limited assets. As withdrawals deplete it, the exchange must transfer additional funds from cold storage. Professional rebalancing protocol: threshold trigger, rebalancing request, multi-party approval, cold storage access documented, transaction signing offline, broadcast and monitoring.
