Custodial digital assets platform Fireblocks and its client Stakehound are battling it out in court after $76 million in ETH has apparently been lost due to private key mismanagement. In this battle between the staking and custodial service, who’s in the right, and is it still safe for investors to stake their crypto assets?
Summary
We recently covered in a blog post how a few individual crypto users committed the biggest cryptocurrency sin by losing or exposing their wallets’ private keys, losing hundreds of millions of dollars in cryptocurrency in the process. Well, an unfortunate security incident shows that even custodial companies can make mistakes costing their clients in the end.
Fireblocks, a leading crypto custody platform and one of its clients Stakehound are currently embroiled in a bitter lawsuit brought in by the latter due to apparent negligence that resulted in the loss of private keys that guard 38,178 ETH (nearly $80 million at present).
Fireblocks has maintained its innocence in a detailed blog post, saying that it was never supposed to store any private keys, and instead pointing the finger of blame back to Stakehound, a crypto staking and liquidity providing platform. The latter began court proceedings in Israel on 22 June, after being informed on 2 May 2021 and subsequent attempts to restore access to the Ether in question failed.
Predictably, both parties maintain their innocence and blame the other. While we will not venture a verdict on who is at fault, we will review the merit of both parties’ arguments and list what’s next for the affected investors.
StakeHound: Fireblocks Didn’t Back Up 38,000 ETH Wallet’s Private Keys
Stakehound alleges in a short blog post that Fireblocks committed a series of errors that resulted in the former being unable to access over 38,000 staked Ether.
Stakehound says that Fireblocks:
- didn’t generate their private keys in a secure production environment.
- did not back up the private keys needed to decrypt their 2-key shares
- somehow managed to lose both keys.
In short, no backup keys were made. Stakehound doesn’t elaborate on how exactly a company the size of Fireblocks (who claim to have 400 active clients globally) managed to neglect backing up keys, a security 101 measure, but instead points to human error and a negligent employee.
“This is a human error committed by an employee of the defendants. Who worked in an unsuitable work environment. Did not protect or backup the defendant’s private keys needed to open the relevant digital wallet. And for no apparent reason, the keys were deleted. Preventing the plaintiff’s digital assets from being accessed.”
Stakehound response
Next steps for Stakehound
Stakehound says they will issue a public statement in the next few weeks on their response. The company will immediately upgrade their smart contract to enable the removal and prevent the sending of stETH from liquidity pools. As per their ToC, Stakehound will continue to buy stTokens and distribute rewards at their discretion when available.
Fireblocks: We were not obligated to back up MPC keys
Fireblocks, who announced in March 2021 that they had raised $133 million in funds, came out firing in response, with their CEO Michael Shaulov strongly denying the claims and pointing at their unblemished record of never losing keys prior.
According to Shaulov, Fireblocks:
- backs up all client keys automatically
- continuously backs up keys every 10 minutes to 3 different locations
- were contractually not responsible to safekeep any part of the keys
- can’t be blamed as the Stakehound BLS keys were created,stored and shared outside of its platform
Fireblocks: Stakehound never backed up their BLS keys
Fireblocks said in a blog statement that they became aware of the issue when they discovered that they couldn’t decrypt a set of BLS key shards during a routine emergency drill on 29 April 2021.
The custody firm claims that while they weren’t obligated to keep key backups, they received a part of the BLS shards during a once-off ETH 2.0 staking project, which was so unique that Fireblocks couldn’t create it with their multi-party computation (MPC) system.
They told Stakehound ( as a “one-time advisory service”) how to shard and back up the BLS key and recommended they make the backup through a third-party disaster recovery service, which didn’t happen. As a result, Fireblocks soon figured out that Stakehound never backed up the BLS key shards with a third party disaster recovery service, and thus suspended all transactions to that Ethereum address in case the keys were lost for good.
Fireblocks maintain that none of their production keys have ever been affected and that all their customers’ funds are safe, with customers’ MPC keys (both ECDSA and EDDSA) backed up and recoverable.
The firm is “actively investigating the situation and assisting all parties involved to resolve the issue.” Fireblocks is in particular looking at these 3 solutions to unlock the funds:
- Continuous attempts to recover the keys using forensics;
- Cryptanalysis of the key generation library; and
- Proposing a long-term ETH 2.0 solution to “remediate such incidents on a holistic basis.”
According to Fireblocks’ disaster recovery policy:
“As a non-custodial and direct-custody technology provider, Fireblocks’ policy is to require all customers to engage the disaster recovery services of a third-party service provider or to independently backup their keys. This requirement is communicated to our customers during the procurement process as an explicit written obligation in our standard form licensing agreement, and this expectation is reinforced visually and verbally, during onboarding.”
How are Stakehound customers affected?
Without access to the staked ETH wallet, Stakehound customers are at risk of a permanent loss of their staked Ether, since they’ve handed over custody of their assets to the firm (who has locked in a smart contract) and don’t control any private keys. Therefore, if Stakehound or their service provider Fireblocks can’t restore access, the staked ETH are likely lost for good.
Judging by the bitter current litigation and mudslinging between the two companies, this does seem to be the case. As a result, investors will have to likely be made whole by either Fireblocks or Stakehound, or both, in order to get their funds back.
The Fireblocks incident and other high-profile DeFi losses (such as Mark Cuban’s $11 million Iron Finance fiasco, which apparently wasn’t a rugpull but a token collapse due to oversupply).
Lessons for Crypto Investors and Stakers
The Fireblocks/Stakehound saga comes at a bad time, with Ethereum slumping due to market conditions and systemic issues like congestion and high transaction fees, as well community infighting over new deflationary upgrade EIP 1559.
While either one or both parties can be at fault, it is clear that someone somewhere made a mistake. Private key management is the most critical, non-negotiable aspect of owning and managing cryptocurrencies, and the same rules apply for any investor, whether you’re hoarding 1 ETH in MetaMask or 100,000 ETH on a major digital asset custodial wallet solution.
Any mistake, exposure or misplacement related to the private key or recovery seed has the potential to permanently sink the crypto in question. There’s a reason that tens of billions of dollars in Bitcoin (an estimated nearly 4 million BTC according to Chainalysis) are likely irretrievably lost.
Customers,no matter their size or portfolio worth, need to understand that just by handing over their users’ assets to a custodial service provider, they are ultimately still responsible for these crypto-assets. Failure to maintain proper key management and security measures (such as secure backups) outside of the custodian’s systems opens up a can of security worms that could result in the permanent loss of funds.
Whether Fireblocks or Stakehound are in the wrong here, will ultimately be established in court. Only two things are rather certain, as with most crypto-related losses: This disaster was most likely completely avoidable and will likely harm end-users the most in the end. It’s very simple. Not your keys, not your crypto. And, if you’re going to stake your assets, make sure you do your research on your custodial solution and trust them to have the right security in place. Stay safe!
