Who holds the keys

Graduate · enrolled learners

This lesson opens with AnubisDAO, 29 October 2021.

What happened

AnubisDAO was a fork of OlympusDAO, with no website and a pseudonymous team, that held a token sale through a liquidity bootstrapping pool on Copper and raised about 13,556 ether, roughly 60 million dollars, in a sale planned to run for a full day. About 20 hours in, the pool's liquidity was removed and the ether raised was sent to a different address, an instant loss for the investors, and it was never recovered; in July 2023, almost two years later, it was moved through the Tornado Cash mixer. The pool had been deployed by a pseudonymous founding member, Beerus, rather than from the project's multisig, which a project lead later called the critical mistake, and the wallet that created the Copper launch was the one that removed the liquidity. Beerus said a phishing PDF had exposed the private keys used for the launch; researchers found nothing malicious in the PDFs, and observers widely called it a rug pull. What is not in dispute is the structure: the entire raise could be pulled by whoever held the key to one wallet, run by a person no contributor could name, and pulling the liquidity and sending it to a different address put all of it beyond reach. Whether the cause was an outside compromise or an inside theft, the outcome and the exposure were identical, because there was one key, pseudonymous hands on it, and no accountability behind it.

The decision point

AnubisDAO is where every technical control in this track meets the question underneath them all. There was no oracle to manipulate, no reentrancy, no public function to catch; the money left through the front door, from a pool controlled by a single wallet whose holder could not be identified or held responsible. A user could have audited the contract to perfection and learned nothing that mattered, because the deciding fact was custodial, not technical: who holds the keys, and what stops them from leaving with everything. This is the last and deepest step of a security review, and the one that can override all the others. A flawless contract whose funds sit under one anonymous key is not safe; it is a single decision, by a person you cannot name, away from empty. The keys, and the accountability behind them, are the floor beneath the code.

Recorded loss

$60,000,000

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.