Vitalik Buterin has been promoting smart contract wallets since around 2014, rather than just using external account private keys. After funds were drained from The DAO in 2016, Ethereum used a hard fork to roll back the ledger, and subsequently large treasuries shifted to multi-signatures. Gnosis Safe later became a common treasury shell, with signers still using their own ECDSA keys. This correction is not about the shell, but about the key remaining valid after being used once.

Money movement is halted in the process. Offline signature collection reduces the hours of signature exposure, and after the operation is completed, each signer changes their key, so even if the old key is later computed, it cannot sign another transaction. Account abstraction has long allowed contract addresses to remain unchanged while signers can be replaced; there are also discussions in Ethereum research threads about making ECDSA a one-time key. Failed user operations must also complete the rotation; otherwise, the failure itself exposes the current signer. He now consolidates the same logic into the ideal rules for multi-signatures while keeping the migration budget in check: configuration errors from hasty upgrades can lead to losses before the algorithm weakens.

This is similar to websites changing passwords from being long-term valid to one-time passwords, and banks turning dynamic tokens into single-use verification codes. Passwords can leak, but once leaked, they cannot be used to log in again. Encrypted treasuries are still stuck in the habit of pre-expansion transformation: multi-signatures like Safe have become popular, but one-time key changes have not become the default option. The significant losses related to Ronin in 2022 and Bybit in 2025 were due to the signature path and interface, not because ECDSA was mathematically broken on that day.

Essentially, it is a transfer of pricing power. The security price of the treasury shifts from "how many people sign at the same time" to "how long this key can still be used". The mechanism is that once a signature is made public, the attack clock starts ticking. If cracking is not completed instantly, offline signature collection combined with immediate key changes can stop the clock. The rules can be written as an ideal state first, but if the migration button is rushed and misconfigured, ownership will be lost before cryptography fails.

ABAB News · Cognitive Laws

Once a key has been used, its exposure starts the timer.
Algorithms will gradually weaken, and hasty upgrades will lead to losses first.
Ideal rules can be ahead of time, but migration buttons cannot be.