Is your protocol one stolen key away from a drain?
In the first eight months of 2026, DeFi lost at least $1.3B to hacks, and leaked private keys and admin access overtook smart contract bugs as the top cause (source). Wasabi Protocol lost about $4.5M in April because one deployer EOA could upgrade everything (CoinDesk, Halborn).
An audit checks the code. It doesn't tell you who holds the keys. OneKeyAway does that: for any contract it reads the proxy admin, the beacon and owner(), and it follows ProxyAdmins and Safes down to the keys that actually sign.
Free check: who controls this contract?
Runs in your browser over public RPC. Nothing is sent to us.
Free check: a whole protocol
Reads up to 12 contracts per protocol, taken from DefiLlama's open-source TVL adapter (585 protocols indexed). The list can include third-party tokens a protocol holds, such as USDC, so check the name column.
What we found
Contracts that hold TVL: we read the control path of about 2,000 contracts from about 480 protocols, using addresses from DefiLlama's open-source TVL adapters. Each hit was then checked by hand, and we dropped third-party tokens and factories that can't touch existing funds. At least 35 protocols and token issuers have a core or fund-holding contract whose upgrade path ends at one EOA, with no on-chain multisig and no timelock.
Recently launched DeFi: 10 of the 125 protocols listed in the last 12 months, including a ~$157M stablecoin wrapper, a ~$142M BTC yield vault and a perps bridge that holds user deposits.
BTC and stablecoin yield: several vault and receipt tokens backing $100M-$300M protocols.
Tokenised assets: the largest issuers do it too. USDC, PYUSD, USDtb, BUIDL-I and several tokenised fund shares are upgradeable by a single EOA. These issuers almost certainly keep that key in an HSM, which is the point: the safety lives off-chain, where nobody else can see it, and there is no timelock that would give holders warning.
We contact each team privately before we publish contract-level rows. This applies whether or not they buy anything.
Governance and protocol tokens (480 scanned)
We took every DeFi protocol on DefiLlama with at least $300k TVL that lists an EVM governance or protocol token on one of 15 chains, then read each token's control path on-chain. Scanned 2026-10-06. These are public on-chain facts, and each address links to a block explorer so you can check it. "Single key" here means one EOA, which may be MPC- or HSM-backed off-chain. A single-EOA owner is not automatically dangerous: what matters is what that owner can call. For example, the Superform UP token has an EOA owner, but its mint is locked for 3 years and capped at 2% a year. Upgrade rights and mint rights are the serious cases.
·
Fix it before someone else finds it
Permission Map
$99
USDT, one-off
Every contract in your protocol (up to 25) mapped: who can upgrade, pause, mint, set oracles, or move funds
Each role traced to the keys that sign it: EOA, Safe m/n with signer types, timelock delay
A migration plan: Safe thresholds, TimelockController delays, role splits (guardian vs. upgrader)
Ready-to-run Foundry or Hardhat scripts for the ownership transfers, plus a dry-run on a fork
A key-ceremony checklist and an incident runbook for a compromised key
Done by engineers who have built and run DeFi protocols since 2018
Admin-change alerts
$19/mo
Waitlist. First month free for early sign-ups.
Email or Telegram alert within minutes when any contract you depend on is upgraded, changes owner, or changes a Safe threshold
For funds, LPs, integrators and DAOs watching the protocols they hold
Up to 50 contracts
Order or join the waitlist
How to pay: send USDT on Arbitrum One to 0x36c37d1b47737ba2b2a2cf1b5bc38509516b222f, then email the transaction hash and your protocol name to [email protected]. Check the chain and token before you send. Work starts once the payment confirms, and if we can't deliver, you get a full refund. Card payment is coming soon.
FAQ
Is this an audit? No. We don't review your code logic. We map who holds the power to change it, which is the cause of most 2026 losses.
Why publish this table? Everything in it is readable on-chain by anyone, attackers included. Publishing it lets users and teams see it too. If your protocol is listed and you have fixed it, email us and we'll re-scan within 24h. If you think a row is wrong, tell us and we'll correct it.