Slope was a mobile Solana wallet. Its iOS and Android applications sent users' recovery phrases, in plaintext, to a remote telemetry server, logged through a third-party application monitoring service.
Not encrypted. Not hashed. The seed phrase, in a log file, on a server.
Starting at 22:37 UTC on 2 August 2022 and running for about four hours, 9,231 wallets were drained of somewhere between $4.5M and $8M.
No user could have detected this. There was nothing to read, no warning to heed, no signature to verify. You installed a wallet from an app store and it logged your seed.
Then the detail that makes this the right autopsy for this lesson.
Investigators noted the damage was substantially larger than Slope's own user balances, because many people had imported the same seed phrase into other wallets. The compromise reached funds that had never touched the Slope application at all.
The users controlled exactly one thing here, and it was not the software quality. It was how much a single seed was allowed to reach.
Almost everybody starts with one wallet, and one wallet is a design in which every risk you take is taken with everything you own.
The fix is not a better wallet. It is more than one.
Three tiers, defined by their job
Burner. Connects to anything. New protocols, mints, airdrops, anything you do not understand yet. Holds an amount you would be mildly annoyed to lose and no more.
Its job is to absorb experiments. You should expect to lose a burner eventually, and when it happens, the correct feeling is mild irritation. A burner that has never been at risk is not doing its job.
Daily. Regular activity with protocols you have used before. Roughly a month of transacting.
Its job is to carry routine risk. It is exposed, deliberately, but it is bounded. It has approvals, and you review them on the schedule from F105-05.
Vault. Long-term holdings. What you cannot replace.
Its job is one sentence: to still be there in ten years. It connects to nothing. It has no approvals. It signs almost never, and every signature is an event you plan. It is boring on purpose, because boring is the property.
Notice these are defined by job and permitted loss, not by amount. The amounts follow from the jobs.
Separate seeds, not separate addresses
This is where most people implement the idea and get no benefit from it, and Slope is the demonstration.
Most wallets generate an unlimited tree of addresses from one seed, per F103-01. It is tempting to use address 1 as your vault and address 5 as your burner, and it looks like separation on screen.
It is not separation. Anything that reaches the seed reaches every address it derives, and both the Slope logging and the fake application in this course's opening autopsy captured seeds, not addresses.
Real isolation means a separate seed per tier. Different seed, different backup, different device where possible.
That is more work, and it is the entire mechanism. A tiering scheme built on derivation paths gives you an organised way to lose everything at once.
Expected-loss reasoning, with illustrative probabilities to show the method. These are not measured rates and are not an estimate of your risk.
Suppose you hold $50,000 and you interact with a new protocol roughly twice a month, so 24 exposures a year. Assume each exposure carries a 0.5 percent chance of a compromise that reaches whatever the signing wallet controls, which covers a hostile contract, a drainer front end, or a Slope-style wallet failure.
Single wallet holding everything.
Probability of no incident across the year:
0.995^24 = 0.887
Probability of at least one:
1 - 0.887 = 0.113, about 11 percent
Expected annual loss:
0.113 x $50,000 = $5,650
Tiered: $500 burner, $2,000 daily, $47,500 vault.
Exposure rate is unchanged, because you interact just as often. What changes is what is reachable. All 24 interactions happen on the burner:
0.113 x $500 = $56.50
Expected annual loss falls from $5,650 to $56.50, a reduction of about 99 percent, and the vault's exposure across those 24 interactions is zero, because it was never connected to any of them.
Two things are worth extracting.
First, the improvement comes entirely from decoupling activity from holdings. You did not become more careful, use better software, or reduce your activity. The same number of mistakes now costs a hundredth as much.
Second, the vault's protection is structural rather than probabilistic. It is not that the vault has a lower chance of being drained by a dApp. It is that a dApp cannot reach it at all, because it never signs for one. That is the difference between reducing a risk and removing a category, and it is why the tier boundary has to be a seed boundary.
Moving between tiers
The tiers are only useful if value can flow, and this is the step where people quietly undo the work.
Vault out to daily. Infrequent, planned, and a real event: hardware out, verify on the device screen, send, put it away. If you are doing this weekly, your vault is your daily wallet and you should re-cut the tiers honestly rather than pretend.
Daily in to vault. Routine and low-ceremony. Receiving into cold storage requires no key at all, which is the pleasant asymmetry of this design: funding the vault is safe and easy, spending from it is deliberate and rare.
Burner to daily. Consolidate proceeds occasionally. Never the reverse; funding a burner from a vault is how the burner stops being a burner.
The tiers are isolated in key material and they are visible on a public ledger.
A direct transfer from your vault address to your daily address permanently associates them. Anyone who identifies the daily wallet, and daily wallets are the ones that touch dApps, sign messages and appear in front ends, can then read your vault balance.
That is not a key-security problem, and it is squarely F106-04's targeting problem: an identity joined to a balance.
Route through an intermediate hop, or fund the vault from a source that is not your public-facing wallet, or accept the link deliberately if your threat model is low. What is not defensible is building three tiers and then drawing a public line between them without noticing.
Getting from here to there
If you currently hold everything in one wallet, do not attempt this in one evening.
- Create the burner first and start routing all new experimentation through it. This alone captures most of the benefit and costs nothing.
- Create the vault next, with a fresh seed on a device you set up yourself per F104-03, and move the long-term holdings across in one planned session.
- Whatever remains becomes the daily, which is usually the right size already.
Then F104-L1 is the deliverable: stand up all three tiers with real but small funds, so the mechanics are proven before anything meaningful depends on them.
Three wallets means three seed phrases to lose, so I have tripled my risk of losing access.
The concern is legitimate and it is the correct thing to worry about, given that F103's opening survey found losing access is more common than being robbed. It just does not net out the way it feels.
Two of the three tiers are designed to be losable. Losing a burner seed costs you $500 and a shrug. Losing a daily seed costs you a month of spending money. Neither is a catastrophe, and neither justifies elaborate backup.
Only the vault seed requires the full F104-04 treatment: metal, multiple locations, verified restore. And that is one seed, exactly as before, except that it now belongs to a wallet that never connects to anything, so the chance of ever needing an emergency recovery on it falls sharply.
So the honest accounting is that you have one seed backed up properly, plus two you can afford to lose, replacing one seed that was simultaneously your most exposed and your most critical. The number went up and the concentration went down, and concentration is what the Slope users were actually hurt by.
One wallet means every risk you take is taken with everything you own, so split by job: a burner that absorbs experiments and is expected to be lost, a daily that carries a month of routine exposure, and a vault whose only job is to still be there in ten years. Isolation comes from separate seeds, not separate addresses, because anything that reaches a seed reaches everything derived from it, which is what turned Slope from a wallet failure into a loss reaching balances that had never touched the app. The gain is structural rather than probabilistic: the vault is not less likely to be drained by a dApp, it is unreachable by one. And when you move value between tiers, do not draw the public line you built the tiers to avoid.