Private key compromise

A key can be exposed through malware, unsafe backup or a stolen recovery phrase. An attacker can sign as the holder, producing technically valid signatures without the person’s authorization.

Severity depends on the key’s powers. In a simple account it may control assets; in a multisignature account it may supply only one required signature. Programmable accounts can grant limited permissions.

Responses may include signer replacement, session-permission revocation or moving assets to a new-key account. Options depend on architecture; changing an interface password does not make an exposed key secret again.