Hardware security module

to justify the dedicated silicon or security modules, especially in regulated or edge environments.

We have already seen this platform in TPMs, HSMs, secure elements, and smart NIC or DPU-style architectures.

I would expect the AI systems to extend that idea, where trust is not just a software feature, but a hardware-anchored service layer.

The demand would likely grow first in places where proving compliance and data protection matters as much as role model performance.

Yeah, I think that this, in some way, we can do like some kind of Harley listen with Bybit in the way that in the Bybit hack, there were also no private keys leaked, right? But signers signed something that they thought uh was okay but it was malicious and in this case again i assume that binance to manage these keys uses hsms that is hardware security modules that is a very secure way to divide private keys in many hardware devices But the thing is that if you have the keys in a super safe hardware, right? But then that hardware trusts whatever is told by this server, right? then you just need to hack this server.

You don't need the keys and you need to tell the HSM to do whatever you want to do.

So I think that was the case here.

So yeah, obviously, infra.

It sits in qualified custodians.

And it sits in HSMs, or hardware security modules, that are offline, not connected to the internet.

and globally distributed, which require a multi-signature approval system.

So I'm not suggesting no one is unhackable, but I think a lot of people are asking the questions again, where do I store my assets?

A request comes in, passes a policy check, and gets signed.

The key itself sits in a hardware security module, HSM, or a multi-party computation, MPC, setup and never leaves.

That keeps the key safe from theft, whether each incoming request deserves a signature as a separate problem and a harder one.

Step 1.

greater than greater than taylor monahan speaking to the block about wallets drained through eip 7702 greater than june 2025 the feature only does what a valid signature tells it to the weak point icehoover controls the signing why no key leaked is cold comfort trm's reading of the chain data points the same way It saw ordinary signed transfers leave Binance wallets on several chains, across different key types, within minutes, and concluded that the attacker could make Binance's hot wallet signing infrastructure authorize transfers of its choosing.

That's why Binance's reassurance doesn't reassure me much.

If an attacker can submit requests from inside the trusted zone, or quietly edit the checks those requests pass through, the HSM can stay sealed and still sign away the balance.

Binance's statement is very likely true.

Now here's what makes this incident particularly concerning.

eMudra says that the keys were created using Certificate Hardware Security Modules, or HSMs.

But a scripting error during the key generation process resulted in weak keys being published.

So what that meant was that the cryptographic hardware wasn't necessarily the problem.

Now if you were to add any additional security features to Toshi, what would that be? And what advice you'd like to give to users who might actually end up using Google Cloud?

Enhancement possibilities, George, exist in integrating dedicated hardware security modules, or HSMs, to manage and safeguard distinct MPC key shares, significantly heightening the barrier against physical or sophisticated digital extraction.

Another critical feature, George, is mandatory anomaly detection for transaction patterns, automatically pausing any activity deviating significantly from established institutional norms.

For institutions adopting this, foundational advice starts with rigorous key ceremony protocols for share generation.

It is very important that there is not a malicious third party, an insider threat.

So there is a ceremony of multiple people that are pressing buttons that are storing these keys in what are called an HSM, right? A hardware security module.

Candles are

lit.

You got some funky jazz going on in the background.

Boom.

tarot cards are pulled right yeah i was going more the central route but i like yours better ceremony yeah um eventually an hsm is a hardware security module does two things one it creates cryptographically secure random numbers right a private key ideally is a secret random number that in the naming that in naming ceremony in the key generation ceremony none of us know it's in the hsm and it was generated securely The problem is, how could it possibly be the number four? My guess is that, you know, ultimately the HSM is literally a PCIe card that's in a rack mount thing, and you have to write a script that interfaces with the HSM to issue the cert.

I would imagine it was like a bug in their bash script that like just...

their construction.

Generally, keys generated by HSMs, hardware security modules, strong keys.

Keys that you're not going to guess because these keys are used to sign certificates that are then used for TLS.

And it turns out that a bunch of their keys effectively used, can we call it a secret if it's just a single digit number? But instead of like a great big long cryptographically strong randomized key, it was like literally the number four.