Gate founder has shared a security approach centered on a basic question in crypto custody: whether there is any place where user funds can actually be kept safely.
The post said the industry has again been flooded with hacking news over the past month. So far in 2026, more than 600 security incidents have occurred, with losses topping $8 billion. September alone saw $768 million in losses and was at one point the worst month of the year. October has not yet ended, but monthly losses have already exceeded $6 billion.
It also pointed to where the losses came from. More than 60% of losses in the first half of the year were tied to private key compromises and phishing, while code vulnerabilities accounted for only a little over 10%.
Both exchange custody and self-custody carry single-point risk
The article argued that crypto users still do not have a truly safe place to store funds.
When assets are left on an exchange, users hand security over to the platform. Because exchanges aggregate assets from large numbers of users, they naturally become prime targets for top-tier attackers. If the platform is breached, all users bear the consequences together.
When users hold assets entirely on their own, the weak point shifts to the individual. A lost private key, an exposed seed phrase, a phishing signature, or malware on a device can all lead directly to losses. The post said there is no customer service, no reversal, and no second chance in those cases, and that most ordinary users do not have the security skills needed to defend against professional attackers.
It added that hardware wallets are no longer an absolute safe haven either. One hardware supply-chain implant attack in October caused nearly $100 million in user losses. According to the post, attackers have learned how to insert spy chips before a wallet even reaches the user.
The root issue: single point of failure
The founder described the problem as a single point of failure.
If the single point sits with the platform, a platform breach can be fatal. If the single point sits with the individual, one mistake by the individual can also be fatal. The post said the industry has spent years offering what is effectively a forced choice between those two paths.
Gate’s proposed Vault model
To address that, Gate proposed a model called Vault. Its core principle is simple: no single party should be able to move user funds on its own.
Under the design described in the post, a private key is split into three shards through MPC. One shard is held on the user’s device, one by Gate, and one by a disaster recovery provider. The full private key never exists in one place at any point.
If the platform is compromised, an attacker would only obtain the shard held on the platform side and would not be able to move funds.
If the user runs into trouble, such as losing a phone or forgetting a backup password, Gate and the third party can help with recovery, but only after the user completes identity verification.
Vault also adds another control: a 48-hour delay on transfers out, during which the user can freeze the transaction. The post said that even if someone gains access to both the user’s device and account, the funds still cannot immediately reach that person.
It also described an extreme scenario in which Gate’s service becomes unavailable. In that case, users could recover assets with the device shard and the third-party shard through open-source tools, without Gate’s involvement.
The post summed up the idea this way: if the platform has a problem, the user does not necessarily lose funds; if the user has a problem, the platform can provide a backstop. Only if both sides fail at the same time does the risk become material, and the founder argued that this probability is lower than in any single-point model.
Turning institutional key management into a consumer product
The article also said MPC is not new, and multisignature setups are not new either. Institutions have used them for years, and the post did not present MPC alone as a complete defense against every threat.
The claimed novelty lies in making institutional-grade key management available to ordinary users in just a few steps, then connecting that setup to exchange risk controls. According to the founder, that combination has not been done before.
In the post’s framing, this is neither a safer exchange nor a more convenient wallet. It is meant to fill a missing layer between exchange custody and self-custody.
Call for broader industry discussion
The article closed by saying the approach should not belong only to Gate. Whether a platform is hacked or a user is hacked, the damage ultimately falls on trust across the whole industry.
For that reason, Gate said it is willing to open up the architectural thinking behind the model, along with lessons learned from real user scenarios, for discussion with peers. The post said that if more platforms adopt similar ways to safeguard user assets, the industry’s overall security level would move higher.
