Discussion on Web3 Security: Examining Wallet and Custody Security from a Hardware Perspective

At the global Web3 and AI Summit Proof of Talk 2025, a roundtable forum focusing on "Web3 Wallet and Accomplice Security" attracted widespread attention. The forum explored how to build a more secure and scalable Web3 asset protection mechanism from the underlying perspective of hardware and system software.

The guests participating in the discussion include executives and founders from several well-known technology companies. They engaged in in-depth discussions on topics such as the pain points of Web3 user security, advanced accomplice architecture, and the challenges and breakthroughs of the open-source ecosystem.

The forum host pointed out at the beginning: "The security of private key custody and Web3 Wallets heavily depends on the security of devices and hardware, but discussions on the underlying systems and hardware security are not common." He emphasized that current discussions on Web3 security often focus on the on-chain protocol and smart contract level, while the decisive role of underlying hardware and system architecture is often overlooked.

An expert from a tech giant shared the technical architecture of their team's high-security digital asset custody, including EAL5+-based partitioning and cold storage signing processes, and specifically introduced how the offline signing orchestrator system supports bank-level custody services.

Another guest approached from a practical perspective, pointing out that the existing custody models "entrusted custody" and "self-custody" expose systemic risks through case studies. He further introduced a solution based on "distributed custody" and MPC-TSS technology, emphasizing the application value of flexible and scalable signature structures for enterprise and individual users.

A founder of a startup started by discussing the practical challenges of open-source technology, sharing his team's practical experience in multi-terminal computing and local security isolation, and called on the industry to think more systematically about the openness and reliability of the underlying architecture while ensuring user experience.

Guests combined their years of experience in hardware security modules (HSM) and key management to analyze the key bottlenecks and coping strategies in current hardware custody solutions. He stated that the hardware trust boundary is crucial when building global digital asset infrastructure.

In discussions about the future shape of Web3 Wallets, guests generally believe that composable and modular multi-signature architectures will become the mainstream trend, with balancing user experience and security being the core challenge. An expert added: "Financial enterprises have become accustomed to using dedicated hardware (such as HSM) for private key and signature management; relevant security evaluations, such as EAL and FIPS, are also widely accepted by regulatory agencies. However, these evaluations are not specifically designed to verify the security of blockchain signature implementations, so the level of security these systems provide for digital assets still needs to be audited by professional blockchain security companies." He pointed out that "accomplice" is essentially an architectural design issue, rather than a single technology stack. An ideal custody solution should effectively prevent operational errors through system mechanisms while ensuring users have a moderate degree of operational freedom.

In addition, regarding the role of open-source software in Web3 hosting, the guests expressed a cautious yet optimistic attitude. Some experts pointed out the legal gaps and market barriers faced by open-source chip design, calling for the industry to advance further in safety and transparency. Another guest also approached the topic from the perspective of operating system-level security, discussing how to achieve module-level open-source isolation without sacrificing performance.

At the end of the forum, the host concluded: "The underlying technology of private key custody and wallets is still evolving, and we look forward to providing provable and user-trusted security solutions in the future through collaboration among various parties."

This roundtable forum provided a valuable opportunity to examine issues from a hardware perspective in the Web3 security field. The in-depth discussions by the attending experts offered cross-layer collaborative security solution ideas for developers, enterprises, and regulatory bodies, promoting the establishment and development of Web3 security standards.