Private key exploits account for $8.5B in crypto losses over the past decade — roughly half of all hacks DefiLlama has tracked. The recent $579M haul from Drift and Kelp DAO came via NK Lazarus social-engineering contributors into installing malware and compromising LayerZero verifier infrastructure. SVRN COO David Schwed's fix isn't glamorous: hire experienced CISOs instead of promoted junior engineers, staff actual 3-5 person security teams, and accept the procedural delays that come with it. Self-custody keeps failing because investor pressure to ship beats security discipline, not because the model itself is broken.

TLDR by @Benthic