Vitalik says the safest multisig practice is rotating signer keys after every action

Vitalik says the safest multisig practice is rotating signer keys after every action

N
News Editor
2026-10-08 03:18:23
Ethereum co-founder Vitalik Buterin said on X that the ideal security rule for multisig setups is for each signer to rotate their key after every operation. He said that recommendation assumes ECDSA could eventually become insecure, though not in a way that would allow instant breaks, which means teams still need to guard against mempool front-running. Buterin added that, where possible, signatures should still be collected offline so the window between a signature becoming public and the corresponding key being invalidated is kept as short as possible. He also warned against rushing upgrades, saying misconfigured and hurried changes can easily lead to a loss of funds. The comments were cited by Odaily in a brief news update.

Vitalik Buterin said in a post on X that, for multisig setups, the ideal security rule is for each signer to rotate their key after every operation.

He said that rule assumes ECDSA could become insecure at some point, but not be broken instantly, so protection against mempool front-running is still necessary.

Buterin also said signatures should still be collected offline where possible, in order to keep the gap between a signature becoming public and the key becoming invalid as short as possible.

He added that rushed upgrades with configuration mistakes can easily cause a loss of funds, and said teams should not act hastily.

This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan.
200

Disclaimer:

The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.

Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.