Blockradar’s key management system represents a revolutionary approach to blockchain security, eliminating the traditional risks associated with private key storage while maintaining full functionality and user control. Our architecture ensures that private keys are never stored, never transmitted, and only computed when absolutely necessary for transaction signing.

​
Core Security Principles

​
No Private Key Storage

Unlike traditional custodial solutions, Blockradar never stores private keys on our infrastructure. This fundamental design choice eliminates the single largest attack vector in blockchain applications - private key compromise through storage breaches.

​
Derivation Path Architecture

Instead of storing private keys, Blockradar stores only wallet derivation paths - mathematical instructions that can generate private keys when needed. This approach provides:
  • Zero private key exposure in our systems
  • Mathematical impossibility of key extraction from stored data
  • Complete user sovereignty over cryptographic assets
  • Auditable security model with verifiable properties

​
Business-Level Key Management

​
Dual Seed Phrase System

Each business account operates with two encrypted seed phrases:

Mainnet Seed Phrase

Production Environment
  • Encrypted using advanced AES-256-GCM
  • Generates all mainnet wallet addresses
  • Protected by enterprise-grade encryption
  • Never accessible in plaintext

Testnet Seed Phrase

Development Environment
  • Separate encrypted seed phrase
  • Isolated testnet operations
  • Same security standards as mainnet
  • Complete environment separation

​
Advanced Encryption System

Blockradar employs a sophisticated multi-layer encryption system for seed phrase protection: Encryption Process:
  1. Seed Generation: Cryptographically secure seed phrases generated
  2. Advanced Encryption: Seeds encrypted using AES-256-GCM with custom key derivation
  3. Encrypted Storage: Only encrypted seeds stored in our infrastructure
  4. Access Control: Strict authentication and authorization controls
Security Benefits:
  • AES-256-GCM Encryption: Industry-standard authenticated encryption
  • Custom Key Derivation: PBKDF2-based key derivation with high iteration counts
  • Random IV Generation: Unique initialization vectors for each encryption
  • Authentication Tags: Built-in integrity verification for encrypted data

​
Real-Time Key Computation

​
On-Demand Private Key Generation

Private keys are computed only when transactions need to be signed:

​
Transaction Signing Flow

// Simplified transaction signing process
async fn sign_transaction(derivation_path: &str, transaction: &Transaction) -> Result<SignedTransaction, Error> {
    // 1. Retrieve encrypted seed phrase
    let encrypted_seed = get_encrypted_seed(derivation_path).await?;
    
    // 2. Decrypt using advanced AES-256-GCM
    let seed_phrase = advanced_decrypt(&encrypted_seed).await?;
    
    // 3. Compute private key
    let private_key = derive_private_key(&seed_phrase, derivation_path)?;
    
    // 4. Sign transaction
    let signed_tx = sign_with_private_key(&private_key, transaction)?;
    
    // 5. Securely clear private key from memory
    secure_clear(&private_key);
    
    Ok(signed_tx)
}

​
Security Architecture Benefits

​
Eliminated Attack Vectors

Our architecture eliminates common attack vectors:

Database Breaches

Traditional Risk: Private keys stored in database Our Solution: Only encrypted derivation paths stored Result: Database breach reveals no usable private keys

Memory Dumps

Traditional Risk: Private keys in memory dumps Our Solution: Keys computed and destroyed immediately Result: Memory dumps contain no private key data

Insider Threats

Traditional Risk: Employees with key access Our Solution: Keys only computed during transactions Result: No persistent access to private keys

Network Interception

Traditional Risk: Private keys transmitted over network Our Solution: Keys never leave secure environment Result: Network interception reveals no private keys

​
Compliance & Auditing

  • SOC 2 Type II: Comprehensive security controls audit
  • ISO 27001: Information security management certification
  • PCI DSS: Payment card industry security standards
  • GDPR Compliance: Data protection and privacy regulations
Blockradar’s key management system provides enterprise-grade security while maintaining the flexibility and ease of use that modern applications require. Our architecture ensures that your private keys are never at risk, even in the event of a complete system compromise.

Our Approach

Learn about Blockradar’s overall security philosophy and approach to protecting your funds.

Disaster Recovery

Understand how Blockradar ensures business continuity and fund security during disasters.

Shared Responsibility

Learn about the shared responsibility model for security between Blockradar and your organization.

Report Vulnerability

Learn how to report security vulnerabilities to help improve our platform.