Most teams still treat cryptography as the hard part and operations as the soft part.
That ordering is backwards.
If you look at the losses that actually moved the market over the last two years—compromised Safe signers, poisoned transaction UIs, recycled MFA sessions, “temporary” hot keys that stayed hot—the pattern is blunt. The signature scheme held. The people and machines around it did not.
This is not a lecture about “human error.” It is a practical scope note for anyone running a treasury, bridge guardian set, protocol admin Safe, or exchange cold path in 2026.
What we mean by signer ops
Signer ops is everything that happens before a private key produces a valid signature that moves value or authority:
- How the operator authenticates to the signing environment
- What they are shown versus what gets hashed
- Which device holds the key material
- Who can change the policy that decides whose signature counts
- How recovery works when a signer laptop dies at 2am
A contract audit that never touches those questions is describing a mathematical object. Production risk lives one layer up.
Three failure modes we keep seeing
### 1. Shared blast radius across the threshold
A 3-of-5 looks diversified on a whiteboard. In practice we still find:
- Three signers on the same MDM profile and browser extension set
- Shared password-manager vaults for “ops accounts”
- The same cloud identity provider gating every Safe session
If one phishing kit can land three sessions, your threshold is a delay, not a control.
Ask: how many distinct compromise paths are required to assemble a quorum? Count machines, identity providers, and physical locations—not job titles.
### 2. The UI is still the oracle
Transaction simulation helped. It did not end UI-layer attacks.
Operators still approve what looks familiar: a known destination, a round amount, a green “success” badge. Attackers still inject between eyes and bytes—malicious frontends, compromised browser extensions, spoofed WalletConnect sessions, or simply a rushed “this is the same transfer as last week.”
If your process cannot answer “what exact calldata / typed data am I signing?” without trusting the primary screen, you are signing theatre.
Minimum bar in 2026:
- Independent simulation on a second machine or hardware viewer
- Clear decoding of role changes, module enables, and allowance grants—not only token transfers
- A hard stop when simulation and UI disagree
### 3. Policy drift after the ceremony
Teams hold a careful key ceremony, publish a blog post, then six months later:
- A module was added “just for claims”
- A guardian was swapped during an incident
- Spending limits were raised and never reset
The onchain config quietly diverged from the threat model everyone thinks they still have.
Treat Safe modules, owners, thresholds, and guardians like production code: change control, dual review, and a current inventory that matches chain state—not a Notion page from launch week.
How we scope a signer-ops review
When AN3 reviews this layer, we do not start with brand of hardware wallet. We start with paths:
- Quorum map — every human, device, identity, and recovery path that can assemble a valid set of signatures
- Approval surface — every UI and API that can present a payload for signing
- Policy change surface — everything that can alter who signs, what they can sign, or how fast
- Incident first hour — who can freeze, rotate, and communicate without improvising
That is the same mindset we use on contracts: follow privilege, follow trust, follow what can move money.
What “good enough” looks like in practice
You do not need a bank-grade HSM farm on day one. You do need honesty:
- Signers on materially different devices and networks
- No shared “ops” inbox that can reset everyone
- Simulation that treats role and module changes as first-class risks
- An owner list that matches the explorer today
- A rehearsed freeze path that does not depend on the person who is currently asleep
Cryptography buys you integrity of the signature. Signer ops decides whether that signature was the one you meant.
AN3 Intel · written for operators who hold keys that matter.