Nobody Needed to Steal the Key: How the $6.36B Hot Wallet Exploit Happened—and How to Stop It

I've been looking for ways to mitigate hot-wallet theft, particularly following the October 2026 crypto theft reported by TRM Labs.

In that incident, an attacker exploited an exchange's existing signing infrastructure rather than extracting its private key. On Ethereum, the hot wallet had signed 50 EIP-7702 authorizations in advance. One matched the wallet's current nonce, allowing a sweeper contract to take control of the account.

What caught my attention was that the signatures were valid. The signing system simply executed instructions it was authorized to sign.

I started exploring a question: how can we prevent a hot wallet from blindly signing dangerous transactions, even when the application requesting signatures is compromised?

That led me to https://github.com/globalmpc/rwa-kit-js

packages expecially @globalmpc/sign-guard

A sign-guard puts a written policy in front of the key. Same requests, same key, one difference:

✅ the normal call is signed
❌ an unknown delegation, a full-balance send and a raw hash are refused

Only what the policy names gets signed.

and @globalmpc/hot-wallet-watch,

A Hot-wallet-watch reads your hot wallets every few seconds and alerts on the signs a takeover can't hide: a delegation you didn't approve, code at the address, a nonce you didn't move, outflows over a cap.

Same night, replayed: alarm one block later, 6 sweeps stopped.

Together they shrink a breach from "drain everything" to "what the policy allows", and catch it fast

for reference you can check this out Globalmpc documentations

Resources:

• npm package: github.com/globalmpc/rwa-kit-js/sign-guard
• Source code, policy reference and refusal rules: github.com/globalmpc/rwa-kit-js
• Wallet monitoring: @globalmpc/hot-wallet-watch
• Incident analysis: TRM Labs