Every key-isolation product on the market protects the key. None protect the agent. This is the running ledger of what that gap costs — and what KEYCAGE shuts down.
An agent should never see a human's key. Source-linked. Updated daily.
For a decade, multisig was the "secure default" for institutional crypto. Four months into 2026, four incidents prove the assumption is broken — at $793M+ and counting. The pattern is identical every time: the signature is valid but the action under the signature is the wrong one. Either the signers approved a transaction whose recipient was swapped (Superfortune), or one of N signers added themselves as admin (StablR), or a governance multisig was drained by a single-compromise vector (Drift), or a bridge multisig handed unbacked tokens to an attacker (KelpDAO). MPC, TSS, HSM and threshold-sig all assume the wrong threat model — they protect the KEY, not the INTENT under the signature.
116,500 rsETH siphoned via LayerZero bridge attack on Ethereum. Bridge-key authority was abused at execution time — the same recipient-vs-intent gap.
Solana's largest perp DEX drained via Security Council multisig. A signed governance action carried out an unintended payout. Wrong intent, valid signatures.
Legitimate multisig transaction had its recipient altered during execution. 14.98M GUA → attacker wallet. GUA price −76%. Signers signed the right action; chain executed the wrong one.
1-of-3 minting multisig. One compromised key added attacker as admin, removed legitimate operators, minted unbacked USDR + EURR. MPC wouldn't have helped — the attacker's signature was "valid".
KEYCAGE-MS makes a multisig signature invalid if the action changes between approval and broadcast, and gives signers a window to reverse. It works on the human multisig surface — Safe / Squads / Gnosis.
KEYCAGE-MS catches the actual attacks we've seen in 2026 — recipient-swap (Superfortune $15.18M), admin-swap (StablR $13.5M), governance drain (Drift $285M), bridge abuse (KelpDAO $293M). All four. 100% of the $793M+ multisig-and-bridge attack pool of April–May 2026.
v1 covers two surfaces simultaneously: the multisig approval layer (Superfortune / StablR / Drift class) and the cross-chain bridge layer (KelpDAO class). A change between approval and execution is caught on either surface and rejected.
Audited on-chain guards are available for customers who require them — talk to us.
Every disaster on this board falls into one of these four classes. KEYCAGE closes all four — by construction.
Eight incidents, all source-linked. Hover-tagged with the KEYCAGE primitive that would have stopped it.
Every disaster above happens because the market protects keys, not agents. KEYCAGE flips that. The outcomes are public; the mechanics stay ours. Talk to us if you want to see them work on your own agents.
Updated daily. New incident? adama@cryptoshieldai.ai — we'll cite you.