When AI Agents Gain On-Chain Execution Authority: Who Verifies the Information They See and the Commands They Issue?
I. What the KelpDAO Incident Exposed
On April 18, 2026, KelpDAO's rsETH cross-chain bridge was attacked, resulting in the abnormal release of 116,500 rsETH, valued at approximately $292 million at the time. The incident report from LayerZero revealed that the attacker obtained the developer's session key through social engineering, contaminated the internal RPC relied upon by LayerZero Labs DVN, and suppressed external RPCs with denial-of-service attacks, causing the signature service to issue proofs for forged messages based on erroneous data. At that time, KelpDAO changed the verification path from 2-of-2 to 1-of-1 DVN. Once the uniquely designated DVN issued an erroneous proof, the system no longer required a second independent DVN to cross-verify the same message. CrowdStrike and Mandiant attributed the incident with high confidence to North Korean-affiliated TraderTraitor (UNC4899).
Such incidents are not isolated cases. Many significant on-chain security events often do not stem from the overthrow of cryptographic assumptions but rather from issues in key control, data sources, validator configurations, protocol implementations, and operational permissions. The system must not only answer "Is this signature valid?" but also "Who has the authority to sign, based on what information, and is the state corresponding to the signature genuinely occurring?"
An increasing number of AI Agents are gaining on-chain execution capabilities through smart accounts, strategy wallets, or restricted signature services. A valid signature can only prove that a certain authorization path has been invoked; it cannot prove the reliability of the data the Agent relies on, that the decisions align with established strategies, or that the transaction was indeed supposed to occur at that moment. The objects of verification are expanding from "the authenticity of the signature" to "whether the input, decision, and execution are consistent."
## II. What Existing Solutions Address and What They Leave Behind
Several existing solutions address parts of the trust issue, each entrusting the remaining trust to different roles:
**Oracles and Dispute Resolution:** The market results of Polymarket are proposed by participants and only enter UMA's token holder voting resolution if challenged during the challenge period. The issue is not about "lack of review" but whether the review is reliable—when rules are ambiguous, real-world events have multiple interpretations, or voting power is concentrated in a few addresses, the system effectively hands over the question of "who defines the facts" to another governance structure.
**Cross-Chain Bridge Multi-Signature and DVN:** While implemented differently, both require the application side to clearly configure the set of validators and thresholds. After KelpDAO configured the path as 1-of-1 DVN, the entire verification path relied on a single validation service; the data sources and fault response mechanisms that this service depended on could potentially create another layer of single point of failure.
**MPC Custody:** The selling point of threshold signatures is that keys do not exist entirely in one place, but cryptographic sharding does not automatically lead to organizational power decentralization. As disclosed by the Multichain team, after the founder was detained by Chinese police, the team immediately lost access to the relevant MPC node servers, which were running under the founder's personal cloud account. Once cloud accounts, operational permissions, and emergency responses are centralized in one person, the threshold design of MPC may still leave organizational single points of failure.
**TEE:** Trusted Execution Environments can isolate code and sensitive data, but they do not eliminate trust; they merely change the trust locus. Hardware root of trust and microcode updates typically rely on chip manufacturers, while enclave code, upgrade permissions, and authentication policies may be controlled by project or operational parties. TEE can protect the computation process but cannot automatically decentralize these governance permissions.
These solutions have different failure modes but point to the same type of problem: the thresholds and decentralization written in white papers can only form a real security boundary if they are genuinely implemented in data sources, account permissions, upgrade keys, and governance processes.
## III. CRVA: Redesigning the Allocation of Verification Authority
DeepSafe was renamed from Bool Network in 2025. CRVA continues the technical ideas proposed by researchers from Bool Network in 2022. The related paper was published in IEEE Transactions on Information Forensics and Security (IEEE TIFS, Document ID 9903072), proposing a cross-chain notarization platform based on an "evolving hidden committee."
The specific approach is: nodes participate in random selection through Ring-VRF, and the selected ones submit proofs and temporary public keys, which external observers can verify their qualifications but find it difficult to identify their long-term identities. The selected temporary committee then jointly signs through threshold MPC, where no single node can independently produce results. Key management and other critical processes operate in TEE (using Intel SGX as an example) as designed in the paper, aiming to reduce the likelihood of the host operator reading or tampering with key shares. The committee will also rotate by epoch, with the new session obtaining new shares through verifiable key handovers, while old shares become invalid, with the specific rotation cycle determined by actual network parameters.
The project team also hopes to leverage TEE to obscure the working status of the committee, making it difficult for node operators to determine whether their nodes participated in a particular verification. The extent to which this goal can be achieved depends on the current network code, remote authentication, host-side metadata, and side-channel protection; it is not a conclusion that can be automatically established just by "using TEE."
However, these mechanisms address "who verifies and how to safely jointly produce results" but do not automatically define "what results are correct." In the context of AI Agents, the committee still needs to draw conclusions based on pre-set strategies, data sources, and executable judgment rules—if the rules themselves have issues, the data sources relied upon are unreliable, or the verification objects do not have objectively determinable answers, even the safest committee may jointly confirm an erroneous conclusion.
CRVA attempts to reduce the risks associated with the long-term exposure of fixed validators and the concentration of signing authority but cannot completely eliminate single points at the governance and implementation levels. Node admission, protocol upgrades, TEE certification, and software security still require continuous auditing. Under the premise that old shares reliably become invalid and new committees maintain sufficient independence, rotation can shorten the attack window against fixed signing groups but cannot cover systemic risks such as software supply chains or upgrade permissions.
## IV. Technical Foundations and Implementation Progress
The technical lineage of CRVA can be traced back to the Bool Network paper published in Volume 17 of IEEE TIFS (2022), DOI 10.1109/TIFS.2022.3209546. The protocol model, security proofs, and prototype evaluations in the paper underwent peer review, providing academic support for designs such as dynamic hidden committees, Ring-VRF, threshold key management, and TEE protection. It is important to distinguish that the peer review focused on the models and implementations in the paper; how DeepSafe's currently deployed CRVA corresponds to the paper's proposal still needs to be assessed in conjunction with the current technical specifications, code audits, and network parameters.
According to DeepSafe's disclosure in October 2025, the network had cumulatively processed nearly 120 million verifications, with over 2.65 million active accounts. The project team also stated that its ecosystem relationships had exceeded 70, involving various types such as wallet compatibility, technical integration, investment, and market cooperation.
In October 2025, DeepSafe announced the completion of a $3 million seed round, with investors including Antalpha Global, ViaBTC Capital, and Gate. From the timeline, this round of financing mainly corresponds to the technological research and ecological expansion after the brand renaming.
## V. From Verification Solutions to General Infrastructure
As blockchain infrastructure gradually becomes modularized, consensus, execution, data availability, interoperability, and account systems are starting to be handled by different components. Modularization has not eliminated trust issues but has made the security boundaries of each layer clearer—developers not only need to choose which technology to use but also need to determine who provides the security guarantees for that layer and who is responsible when issues arise. Once AI Agents gain on-chain execution capabilities, new questions arise: who confirms the reliability of the data they read, whether their decisions are within authority, and whether the final transaction aligns with user authorization? These questions will not automatically be answered by a valid signature.
DeepSafe aims to abstract verification capabilities from a subordinate module within a single application into an infrastructure available for different protocols and AI Agents to call—"Proof, Not Promises," replacing the promises of executors with verifiable evidence. CRVA has already combined anonymous selection, threshold collaboration, and TEE into a technical pathway; whether it can further cover different scenarios such as oracles, cross-chain, and AI Agents, and develop into a general verification infrastructure will depend on the continuous accumulation of current network capabilities, independent audits, and genuine integrations.
> This article is from a submission and does not represent the views of BlockBeats.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like

SNDK Stock Trading Rewards: Share $100K on WEEX

How Much of the $1.5 Billion Can Be Recovered? The Realistic Boundaries and Industry Insights of Bybit's Lawsuit Against North Korea

Breaking the 'Blame-Shifting Narrative' and Secret Governance: A Structural Bloodletting in Tokenomics and the Governance Challenge Behind Sun Yuchen's Lawsuit Against WLFI

MultiversX to pause transactions for 24 minutes during Supernova upgrade

Does YZi Labs Have Dreams?

CryptoQuant: Trend Reversal Signal After 8 Months... Is the Bear Market Over?

Bitcoin leads Ethereum and Solana in decentralization, ARK finds

Korean Won Stablecoin May Reduce Capital Outflow Concerns

Bitcoin: What convinces Americans to buy BTC?

Can On-Chain Rollbacks Recover Stolen Assets?

G20 Evaluates Contribution of Digital Assets to Economic Growth and Improves Regulatory Framework

Important News from Last Night and This Morning (September 1 - September 2)

Tuven Chain: A New Solution to the Gas Fee Payment Dilemma and Analysis of Related Security Risks

Belgian Police Target Crypto Wallets Linked To Offshore Piracy

How recovery of 61 BTC unlocked a potential $432M treasure hunt for early Bitcoin users

UK Intensifies Crackdown on Cryptocurrency Networks Linked to Russia

Russia's Largest Bank Accepts Bitcoin as Collateral Starting Today

21 International Financial Institutions Plan to Establish Stablecoin Company

Where Should Global Crypto Platforms Report CARF? An Analysis of Reporting Nexus Rules

Kast Launches Stablecoin Settlement and Wealth Management Platform for Enterprises

Stablecoins: The Hidden Gear Behind American Debt Revealed

U.S. Treasury Secretary Yellen Urges Japan to Raise Interest Rates, Bitcoin Monetary Policy Under Scrutiny

Felix Pago Completes $200 Million Series B Financing with Participation from a16z and Customer Value Fund

2026 Crypto TradFi Landscape Report: How Competition Evolves Under Explosive Growth? | RootData Research

Analyzing 43,000 Hyperliquid Accounts: Unveiling the Profit Systems of 12 Top Traders

Latest Holdings of AllianceDAO and FOMO Founders: 70% in US Stocks, Only BTC and Zcash in Crypto

Russia opens regulated crypto trading as new law takes effect

What is liquidation? The trading minute

KuCoin Ventures Weekly Report: Waller Strengthens Rate Hike Expectations, ETF Funds Significantly Flow Back, RWA Narrative and Attention Assets Reshape the Crypto Market










