Private Key, Public Risk

## Executive Summary This report is a security guidance piece for Web3 teams focused on private key management—covering secure key generation (TRNGs, HSMs, key ceremonies), storage options (HSMs, MPC, isolated device keychains), safe usage practices (M-of-N signing, policy enforcement, WYSIWYS), and operational assessments. It highlights common pitfalls (centralized backends, weak encryption, insecure storage), gives practical mitigations, and describes CertiK’s services to assess and harden custody and signing workflows; it is not an incident or threat advisory.