The $292 Million Blood Case: Rebuilding AI Agent's On-Chain Trust

According to Woofun AI, as AI agents gradually gain on-chain execution rights, the trust paradigm is undergoing a fundamental shift from verifying the authenticity of signatures to verifying the consistency of inputs, decisions, and execution. This shift was not a theoretical deduction; it was forced by a real security disaster. When smart accounts and strategic wallets become mainstream interactive interfaces, a valid cryptographic signature can only prove that the authorization path has been called, but it cannot guarantee that the data the agent relies on or that the decisions are in line with the established policy. The boundaries of verification are being redefined, extending from simple mathematical correctness to matching logic with the truth of state.

The KelpDAO RsETH cross-chain bridge attack that broke out on April 18, 2026 provided painful evidence of this paradigm shift. As a result of this incident, 116,500 pieces of RSetH were abnormally released, worth approximately US$292 million at the time of the incident. LayerZero's incident report revealed the complexity of the attack chain: the attackers first obtained developer session keys through social engineering, then polluted internal RPCs that LayerZero Labs DVN relies on, and suppressed external RPCs with denial-of-service attacks, forcing the signature service to prove false messages based on false data.

The more critical flaw was a misconfiguration, and kelpDAO downgraded the authentication path from 2-of-2 to 1-of-1 DVN at the time. This means that once the only designated DVN issues proof of error, the system no longer requires a second independent DVN to cross-validate, and a single point of failure directly evolves into a systemic crash. CrowdStrike (CRWD.US) and Mandiant confidently attributed the incident to North Korea-related TraderTraitor (UNC4899). This type of incident shows that the core contradiction of on-chain security has moved from the robustness of cryptographic assumptions to engineering implementation aspects such as key control, data sources, verifier configuration, and operation and maintenance rights. The system must answer not only “whether the signature is valid”, but also “who is authorized to sign, based on what information, and whether the state corresponding to the signature actually occurred”.

Existing trust schemes have revealed obvious limitations in dealing with such complex scenarios. In the oracles and dispute adjudication mechanism, Polymarket's market results are first proposed by participants, and only when questioned during the challenge period, token holders who enter UMA vote to decide. The core risk is not a lack of review, but rather the reliability of the review — when rules are vague or voting power is concentrated, the system essentially cedes the power to “define facts” to another governance structure. Although the implementation of cross-chain bridge multiple signatures and DVN is different, they all rely on the application side to clearly configure a set of validators.

The 1-of-1 DVN configuration of kelpDAO is a typical negative textbook. The data source and fault response mechanism of a single verification service can easily form a new single point. Although MPC hosting enables key fragmentation through threshold signatures, it does not automatically decentralize power at the organizational level. According to the Multichain team, after the founders were detained by the Chinese police, the team immediately lost access to the relevant MPC node servers because these servers were running under the founder's personal cloud account. The centralization of cloud accounts, operation and maintenance permissions, and emergency response makes the MPC threshold design still weak at the organizational level.

Although TEE (Trusted Execution Environment) can isolate code and sensitive data, the trust point has not disappeared; instead, it is transferred to hardware root trust and microcode updates controlled by the chip manufacturer, as well as enclave code and upgrade rights controlled by the project party. The TEE protects the computation process, but it cannot automatically distribute governance rights. The failure modes of these solutions vary, but they all point to a problem: the promise of decentralization in the white paper can only form a real security boundary if implemented into data sources, account permissions, and governance processes.

DeepSafe was renamed from Bool Network in 2025, and its core product, CRVA, sought to solve this trust dispersion problem through technical architecture innovation. CRVA continues the technical ideas proposed by Bool Network-related researchers in 2022. The relevant paper was published in IEEE Transactions on Information Forensics and Security (IEEE TIFS, Document ID 9903072), and proposed a cross-chain notarization platform based on the “Evolving Hidden Committee” (Hidden Committee) (Hidden Committee)) .

According to the specific mechanism, nodes participate in random selection through Ring-vRF, and the winners submit certificates and temporary public keys. External observers can verify their qualifications, but it is difficult to identify their long-term identity. The Interim Election Committee then co-signed the threshold MPC to ensure that no single node can independently produce results. Key processes such as key management are designed and run in TEE (Intel (INTC.US) SGX as an example) to reduce the possibility of host operators reading or tampering with key shares. The committee rotates by epoch, and the new one gets a new share through a verifiable key handover, and the old share expires. The project party also hopes to use the TEE to hide the working status of the committee, making it difficult for node operators to determine whether they are participating in the verification.

Woofun AI collated data showing that this dynamic hiding mechanism is designed to structurally reduce targeted attack capabilities against fixed verifiers, but its actual effect is highly dependent on the degree of perfection of the current network code, remote authentication, and side channel protection.

Although CRVA has theoretical advantages in reducing exposure risk for fixed validators, its boundaries and risks remain clear. It cannot eliminate single points of governance, software supply chain risks, and the problems of the rules themselves. Node admissions, protocol upgrades, TEE certification, and software security are still subject to ongoing audits. On the premise that the old share is reliable and the new committee remains sufficiently independent, the rotation mechanism can shorten the attack window for fixed signature groups, but it cannot cover systemic risks such as the software supply chain or upgrade rights. CRVA's technical context can be traced back to the Bool Network paper published in IEEE TIFS Volume 17 (2022) with a DOI of 10.1109/TIFS.2022.3209546. The protocol model, security proof, and prototype evaluation in this paper were peer-reviewed, providing an academic basis for the Dynamic Hidden Committee, Ring-vRF, threshold key management, and TEE protection.

However, what needs to be strictly distinguished is that the peer review targets the model and implementation in the paper; the relationship between the CRVA currently deployed by DeepSafe and the paper plan still needs to be independently judged based on current technical specifications, code audits, and network parameters. CRVA addresses “who verifies and how to safely co-produce results”, and does not automatically define “what results are correct”. In the AI Agent scenario, the committee still has to draw conclusions based on pre-set policies, data sources, and judgment rules — if the rules themselves are flawed or the data source is unreliable, the most secure committee may also jointly confirm the wrong conclusion.

The evolution of DeepSafe's ecosystem reflects the market demand for trust restructuring under modular blockchains. In October 2025, DeepSafe announced the completion of a $3 million seed round with investors including Antalpha Global, ViaBtc Capital, and Gate. According to data for the same period, the network has processed nearly 120 million verifications, more than 2.65 million active accounts, and more than 70 ecological relationships, covering wallet compatibility, technology integration, investment and market cooperation. This round of financing mainly responds to technology research and development and ecological expansion after the brand name change. As blockchain infrastructure gradually becomes modular, and consensus, execution, data availability, interoperability, and account systems are handled by different components, trust issues have not disappeared, but rather have made each layer of security more clear.

Developers must not only choose technology, but also determine who provides security guarantees and responsibilities. After AI agents gain on-chain execution capabilities, verifying that data is trustworthy, decisions are not overtaken, and transactions and authorizations are consistent became new challenges. DeepSafe proposed the “Proof, Not Promises” vision, which aims to abstract verification capabilities from application ancillary modules into infrastructure that can be called by different protocols and AI agents. CRVA has combined anonymous sampling, threshold collaboration, and TEE into a technology path. Whether it can develop into a general verification infrastructure depends on the continuous accumulation of existing network capabilities, independent audits, and real integration. This is a key experiment in the evolution of the Web3 trust architecture to dynamize and anonymize after traditional multi-signatures and oracles.