Curriculum·G203 Reading Audit Reports·about 30 min
The centralization finding you cannot audit away
By the end of this lesson you can
- →Explain why a centralization finding describes a risk no code fix can remove, only a governance or custody change
- →State how Multichain's collapse showed one person holding every key was the real risk, not the code
- →Compute the single-point-of-failure count for a protocol from who holds keys, servers and infrastructure
- →Read an audit's centralization section as the description of a trust you are being asked to extend
Graduate · enrolled learners
This lesson opens with Multichain, July 2023.
- What happened
- Multichain was a cross-chain bridge. From 6 July 2023 more than 125 million dollars was withdrawn from its bridges, and the team said assets in its MPC addresses had been moved abnormally to unknown addresses. The cause was off-chain and structural: the chief executive, Zhaojun, had been taken away by Chinese police on 21 May, the MPC node servers ran, like the team's other servers, under his personal cloud server account, his devices were confiscated, and all operational funds were under his control. Nobody else on the team could access the node servers or stop the outflows, because one person held everything. Multichain ceased operations on 14 July. Whether the outflow was theft by whoever obtained the keys or a controlled action is still not fully established; what is established is that the protocol's entire operation depended on one individual.
- The decision point
- Multichain had been audited, and Dedaub's March 2022 report even named the dependence: every cross-chain operation relied on one external authority, the MPC vault. No audit could have changed the fact that decided its fate: one person held all the keys, ran all the servers, and controlled all the operational funds. That is a centralization finding, and it is a different kind of finding from a code bug, because there is no line to fix. The only remedies are governance and custody: distribute the keys, separate the infrastructure, remove the single point. An audit can name the centralization, and a good one does, but it cannot remove it, and a user reading that section is not reading a bug that will be patched. They are reading a description of exactly whom, and how few, they must trust for the protocol to keep working.
- Recorded loss
- $125,000,000
What you will be able to answer
- →What caused the Multichain collapse?
- →Why can an audit not fix centralization?
- →What does a centralization section describe?
- →How do you count single points of failure?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.chainalysis.com/blog/multichain-exploit-july-2023/
- https://bitcoinist.com/multichain-confirms-ceo-arrest-ceases-operations/
- https://www.bloomberg.com/news/articles/2023-07-14/crypto-bridge-multichain-shuts-down-says-chinese-police-arrested-ceo
- https://cointelegraph.com/news/multichain-stops-operations-over-lack-of-funds
- https://dedaub.com/audits/multichain/multichain-mar-28-2022/
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
Chainalysis puts the outflow at more than 125 million dollars, about 120 million of it from the Fantom bridge. Whether it was theft by a third party who obtained the keys or a controlled movement is not fully established; Chainalysis says it appears to be a hack or rug pull by insiders and does not rule out an outside party. The account of the CEO's detention and of the servers running under his account is Multichain's own statement, not independently confirmed; the established fact, one-person control of all infrastructure, is what the lesson relies on.
The Multichain autopsy is also used in G705-03 for detection. Here it is used for the centralization finding an audit cannot remove. Both angles are drawn from the same documented facts.