For dao treasuries
Treasuries with eight or nine zeros run on Safes, Snapshot, and a few keys on hardware wallets. We make sure the architecture is one a court, and a community, would defend.
Threat model
A 5-of-9 multi-sig with signers who don't know each other personally is a real attack surface. Spoofed Discord DMs, fake calendar invites, malicious transaction simulation, the social layer of the multi-sig is where attackers focus.
DAOs routinely approve transactions calling unaudited contracts. The community sees the proposal title; the multi-sig signs the calldata. Without a review process, governance becomes the vulnerability.
Funds on Ethereum, L2s, lending markets, LSTs, RWAs, the treasury surface grows with every yield strategy. Tracking exposure, custody, and counterparty risk is a continuous job, not a quarterly one.
DAOs need a written escalation path and a pre-authorised response team. Without it, every incident becomes a forum thread instead of a coordinated response.
DAOs combine the sums of a hedge fund with the operational rigor of a Discord server. Closing that gap, without losing the decentralization that defines them, is the work.
Recommended services
Review the Wallet Setup of the treasury and signer set, surveil the Safe and key satellite addresses, and put an Incident Response retainer in place for the days the forum can't move fast enough.
Treasury wallet architecture for multi-sig and MPC setups. Signer selection, operational runbooks, training.
Learn more →
Continuous on-chain monitoring of treasury, admin, and operational wallets. Real-time alerts and an analyst on call.
Learn more →
Web3 incident response and DeFi exploit recovery. On-call when contracts get exploited or wallets get drained.
Learn more →
Read more
DAO treasuries combine hedge-fund balance sheets with Discord-server operations. Here is the playbook that closes the gap without sacrificing decentralization.
Read article →
Multi-sig and MPC are not interchangeable. Here is how each fails in practice, what each is good for, and how to pick for a real treasury.
Read article →
Wallet drainers have evolved from simple seed-phrase phishing to sophisticated drainer-as-a-service ecosystems. The 2026 patterns (gasless approval phishing, EIP-712 abuse, ERC-7702 delegation traps) and how to defend.
Read article →
Glossary
Multi-Sig (Multi-Signature)
A wallet that requires multiple signatures from separate keys to approve a transaction.
Safe (Gnosis Safe)
The leading multi-sig smart-contract wallet on EVM chains, used by most DAOs and protocol treasuries.
Phishing
Social engineering attack that tricks a user into approving a malicious transaction or revealing credentials.
Approval Phishing
Phishing that tricks a user into granting a token approval that lets the attacker drain assets later.
