Curriculum·G206 Running a Security Review for a Small Team·about 31 min
Who holds the keys
By the end of this lesson you can
- →State the question that sits beneath every technical control: who ultimately holds the keys and can they be held to account
- →Explain how about 60 million dollars raised by AnubisDAO left through a single key held by anonymous parties with no recourse
- →Compute why key custody and accountability decide the outcome regardless of code quality
- →Ask the key-custody question of a project as the last and deepest step of a security review
Graduate · enrolled learners
This lesson opens with AnubisDAO, 29 October 2021.
- What happened
- AnubisDAO was a fork of a popular protocol, run by an anonymous team, that held a fair-launch sale and raised about 13,556 ether, roughly 60 million dollars, over about a day. Shortly after the raise, all of the ether was moved from the project's wallet to an unknown address and then routed through a mixing service, and it was never recovered. The team said the deployer wallet had been phished; observers widely called it a rug pull. What is not in dispute is the structure: the entire raise sat under a single key held by people whose identities no contributor knew, and one transaction moved all of it beyond reach. Whether the cause was an outside compromise or an inside theft, the outcome and the exposure were identical, because there was one key, anonymous hands on it, and no accountability behind it.
- The decision point
- AnubisDAO is where every technical control in this track meets the question underneath them all. There was no oracle to manipulate, no reentrancy, no public function to catch; the money left through the front door, held by a single key whose holders could not be identified or held responsible. A user could have audited the contract to perfection and learned nothing that mattered, because the deciding fact was custodial, not technical: who holds the keys, and what stops them from leaving with everything. This is the last and deepest step of a security review, and the one that can override all the others. A flawless contract whose funds sit under one anonymous key is not safe; it is a single decision, by a person you cannot name, away from empty. The keys, and the accountability behind them, are the floor beneath the code.
- Recorded loss
- $60,000,000
What you will be able to answer
- →How did AnubisDAO lose about 60 million dollars?
- →Why does the hack-versus-rug distinction barely matter for AnubisDAO?
- →What question sits beneath every technical control?
- →What makes one key holder safer than another?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://rekt.news/anubis-dao-rekt/
- https://www.coindesk.com/markets/2021/10/29/defi-project-anubisdao-loses-60m-in-alleged-rug-pull/
- https://blog.chainalysis.com/reports/2021-crypto-crime-report-intro-ransomware-scams-darknet-markets/
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
The AnubisDAO loss is reported at about 60 million dollars, roughly 13,556 ether at the time. Whether the cause was an outside phishing compromise of the deployer, as the team claimed, or an inside rug pull, as many observers concluded, was never conclusively settled; this lesson's point, that a single anonymous key with no accountability produces the same exposure either way, does not depend on which it was.
The anonymity of the team and the routing of funds through a mixing service are documented; specific individuals were never conclusively identified.