2026-11-04 –, Jasmine Stage 4
Every major multisig loss of 2024-2026 — Bybit, WazirX, DMM, Radiant — happened with valid signatures and honest signers: the screen lied. This talk gives you a 5-minute mental model for bounding blast radius with onchain policy — execution scoping, universal guards, and policy that protects itself — applicable to any smart account stack.
Since 2024, over $2B has been stolen from multisig-secured organizations — Bybit ($1.4B), WazirX, DMM, Radiant. No keys were stolen; no multisig math was broken. In every case the signer's screen lied: the approved payload wasn't the displayed one. More signers didn't help. Better signing UX didn't help.
The one layer those attackers couldn't touch is onchain enforcement at the account itself. In 5 minutes I'll share a mental model for designing it, from building smart account policy enforcement in production: two composable primitives — execution scoping (who can act, within what bounds) and universal guards (what the account may ever do) — plus the rule that decides whether a policy is real or theater: policy must protect itself. If reconfiguration outpaces your transaction delay (Beanstalk, $182M), you built decoration, not defense.
Building in crypto since 2018: led Ocean Protocol's $7M token launch, shipped crypto trading at Trade Republic to 1M+ users, and was first PM at Unstoppable Finance, launching Ultimate, a self-custodial wallet acquired by Jupiter. Now Product Lead at Safe, building onchain policy and role-based execution for the smart account infrastructure securing $100B+. Seven years in, still convinced self-custody is the point.