Irreversible by design. So make sure a human signed it.
A crypto withdrawal or treasury transfer can't be reversed. Attackers have moved eight figures in single incidents by approving transfers through compromised sessions, social-engineered operators, and deepfaked executive sign-offs. The keys were secure. The authorization wasn't.
The problem custody doesn't solve
Exchanges, treasuries, and DAOs have spent years hardening custody — MPC, multi-party signing, cold storage. That secures the key. It does not secure the intent. The recurring loss pattern isn't a stolen key; it's a legitimate signer who was tricked or hijacked into approving a transfer: a compromised operator session, a deepfaked executive on a call greenlighting a movement, a social-engineered approval. The transfer is cryptographically valid and economically catastrophic, and on-chain it's final.
Why MPC and policy engines aren't enough alone
MPC distributes the key so no single party can sign alone — but if the humans holding the shares are each independently fooled into approving the same fraudulent destination, MPC dutifully produces a valid signature. Policy engines and allowlists help, until the attacker's destination is added through the same compromised channel. The missing piece is binding each approval to a live, enrolled human and to the exact destination and amount.
Require a per-action human signature on irreversible transfers
Each withdrawal or treasury movement above threshold requires a fresh passkey-plus-liveness signature, bound to the destination address and amount, from the enrolled signer's own device — and emits an offline-verifiable receipt. An attacker who controls the operator's session, or who deepfakes the CFO on a call, still cannot produce that signature for an out-of-policy destination. The transfer doesn't go. Pair it with multi-sig and the attacker now has to defeat several independent live humans on their own devices, not one fooled session.
Honest limits
Enrollment is the trust anchor, and a malicious insider who still holds their own enrolled device is a different threat — which is why this composes with multi-sig and separation of duties rather than replacing them. It cannot reverse an on-chain transfer; its entire job is to make sure no transfer leaves without a real human's signature on the exact destination. For irreversible money, that's the control that matters.
Frequently asked questions
Doesn't MPC or multi-sig already cover this? They secure the key and distribute signing — but if each human signer is independently tricked into approving the same fraudulent destination, a valid signature still gets produced. This binds each approval to a live human and the exact destination.
What stops a deepfaked executive approval? The approval requires a signature from the executive's enrolled device with liveness, bound to destination and amount. A deepfake on a call can instruct, but can't sign.
Can it reverse a fraudulent transfer? No — on-chain transfers are final. It prevents the unauthorized transfer from being signed in the first place, which is the only point at which irreversible money can be stopped.
You can't claw back a blockchain transfer. The only control that counts is the one that runs before the signature — and asks a real human to give it.