Security Architecture: Non-Custodial Design vs Custodial Agent Wallet Attacks

[up2itnow0822]

Context: Lazarus Group / Bitrefill Attack (March 1, 2026)

On March 1, 2026, Lazarus Group (North Korea) breached Bitrefill through a compromised employee laptop. The attack chain:

1. Social engineering - employee laptop compromised
2. Lateral movement - access to internal systems
3. Credential theft - production wallet keys extracted
4. Hot wallet drain - funds transferred
5. Data exfiltration - 18,500 customer records stolen

Why This Matters for Agent Wallets

As AI agents begin handling real money at scale (MoonPay Agents API, Coinbase Agentic Wallets, Visa Agentic Ready), the attack surface for custodial agent wallet providers is expanding rapidly.

Custodial agent wallets are vulnerable to this exact attack pattern:

• Central key store = single point of failure
• Employee access to production key material
• One compromised credential = all agent wallets drained

agent-wallet-sdk Non-Custodial Architecture

agent-wallet-sdk is non-custodial by design:

• No shared key infrastructure. Each agent generates and holds its own keypair locally.
• No production keys on servers. Deployment infrastructure never holds wallet keys.
• Agent-scoped blast radius. One compromised agent loses only its own funds (capped by SpendingPolicy).
• SpendingPolicy guardrails. Per-transaction and daily limits cap damage.

Architecture Comparison

Attack Vector	Custodial	Non-Custodial (agent-wallet-sdk)
Employee laptop compromise	All wallets at risk	Zero wallets at risk
Production key theft	Mass drain possible	No central keys exist
API credential leak	Full access to all funds	Agent-scoped only
Single agent compromise	N/A (centralized)	Only that agent funds
Lateral movement payoff	Jackpot (all keys)	Nothing to find

Key Design Decisions to Maintain

1. Never introduce a central key store or key management service
2. Keep SpendingPolicy as mandatory for all agent wallets
3. Ensure no agent key material ever touches server infrastructure
4. Document the non-custodial security model prominently for enterprise evaluators

Related

• Article: Why AI Agent Wallets Must Be Non-Custodial
• Prediction P-143: Lazarus attack pattern expands to AI agent hot wallets within 8 weeks