Key Management Is the Real Onchain Vault Threat, Veda CEO Says

The crypto industry has spent years treating smart contract audits as the main line of defense. Sun Raghupathi, CEO of onchain vault infrastructure provider Veda, argues the threat model needs an update. The biggest risk to an onchain vault is no longer a bug in the code; it is key management: who holds the admin keys and where they are stored.

Smart contract code matures through repeated audits and live usage, Raghupathi said. The process shifts the attack surface toward access control. Several high-profile incidents in recent memory did not involve exploiting a vulnerability in a protocol's smart contracts. They involved compromised private keys or insider threats that handed attackers a backdoor into systems that were technically sound.

Veda, founded in 2024, has routed more than $16 billion through its vault infrastructure without a reported security incident on its smart contracts. The company builds standardized infrastructure for developers and institutions that want to launch yield products with risk and compliance controls built in. Rather than forcing each issuer to write a new contract from scratch, Veda supplies a common layer for deposits and payout calculations. Its biggest client is Kraken, whose Earn vaults run on Veda's infrastructure. Those vaults hold more than $600 million in deposits, and Veda says inflows have continued accelerating since June 2025.