Gate founder shares security approach: not allowing any party to use funds independently

Author: [Han Lin](https://x.com/Han_Gate/status/2116049911875788950?s=19)

Statement: This article is a reprint. Readers can obtain more information through the original link. If the author has any objections to the form of reprinting, please contact us, and we will make modifications according to the author's request. Reprinting is for information sharing only and does not constitute any investment advice, nor does it represent the views and positions of Wu Shuo.

The full text is as follows:

About a security concept and a problem that the industry has avoided for many years: Is there a truly safe place for your money?

─────

In the past month, the industry has once again been flooded with hacker news. Since 2026, there have been over 600 security incidents, resulting in losses exceeding $8 billion. In September alone, losses amounted to $768 million, making it the worst month of the year; and October is not yet over, with losses already exceeding $6 billion.

But what is more concerning is the source of the losses: more than 60% of the losses in the first half of the year came from compromised private keys and phishing, while code vulnerabilities accounted for just over 10%.

In the crypto world, there has never been a truly safe place to keep your money.

Keeping it on exchanges: You completely entrust security to the platform. The platform aggregates the assets of hundreds of millions of people, making it a prime target for the world's top attackers. Once the platform is breached, everyone pays the price.

Keeping it yourself: Losing private keys, mnemonic phrases being photographed, phishing signatures, devices being implanted with malware... There is no customer service, no revocation, no second chance. The security capabilities of the vast majority of ordinary users are simply no match for professional attackers.

Even hardware wallets are no longer a safe haven. An attack in October targeting the distribution channels of hardware wallets caused users to lose nearly $100 million. Attackers have learned to implant spy chips in wallets before they are handed over to you.

The root cause is simple: single point of failure.

For over a decade, the industry's answer has been "choose one." But both paths share the same root cause: single point of failure.

If the single point is on the platform, everything is over once the platform is breached. If the single point is on the individual, everything is over once the individual makes a mistake.

We have been thinking: Is it possible not to make this choice?

Our idea: Do not allow any party to unilaterally access your funds.

Gate proposes a vault concept. The core principle is simple: do not allow any party to have the ability to unilaterally access the funds.

The private key is split into three shards through MPC, held by your device, Gate, and a disaster recovery party. The complete private key will never appear anywhere.


Is the platform breached? Even if someone breaches the platform side, they only obtain one shard and cannot access a single cent of your funds.

What if something happens to you? If you lose your phone or forget your backup password, Gate and a third party can help you recover it—but only after you complete identity verification.

Add another layer of security: Vault transfers have a 48-hour delay, during which you can freeze the transfer at any time. Even if someone simultaneously obtains your device and account, the money cannot reach them.

In extreme cases, even if Gate's services become unavailable, you can use your device's shard along with the third party's shard to recover your assets through open-source tools, without needing Gate's involvement.


In summary: If the platform has an issue, you are safe; if you have an issue, the platform covers you.

Only when both sides have issues could there be a problem—and the probability of that is far lower than any single point.

MPC is not a new concept; what’s new is making it accessible to ordinary people in just a few steps.

MPC and multi-signature are not new; institutions have been using them for a long time, and it's not just about using MPC to prevent breaches. What we are doing is transforming institutional-level key management into a product that ordinary users can activate in just a few steps, and integrating the risk control capabilities of exchanges, something that has never been done before.

It is not a "safer exchange," nor is it a "better wallet." Rather, it fills the missing layer between exchanges and self-custody.

Finally, this concept should not belong solely to Gate.

Whether the platform is hacked or the user is hacked, the trust of the entire industry is harmed. We are willing to open up this architectural concept and the pitfalls we have encountered in real user scenarios for discussion with our peers.

If more platforms use similar methods to manage user assets, the overall security level of the industry will rise to a new level.