Staking 70,000 ETH is no small task.

But staking 69,420 ETH 🍀 from TheDAO carries a different kind of weight.

The funds come from one of the most pivotal moments in Ethereum’s history: the 2016 DAO hack. This event caused a fork on Ethereum, brought to the forefront one of the fiercest instances of the debate “is code law?” and forced the community to confront what it means to build decentralized systems with immutable smart contracts publicly available for anyone, good or bad, to scrutinize and try to exploit.

Nearly a decade later, those same funds are being put to work to strengthen Ethereum’s security. The goal of TheDAO Security Fund is to turn a historic failure into a long-term endowment for protecting the ecosystem.

So when we were setting up the infrastructure for staking these funds, we did it with a simple constraint:

We cannot afford these funds to be hacked twice.

If these funds are going to secure Ethereum’s future, the infrastructure securing them must itself be extremely resilient.

When managing infrastructure responsible for tens of thousands of ETH (vertiginously, hundreds of millions of Euros), one cannot afford to think everything will go smoothly. The key question becomes how the system behaves when it does go south.

Servers fail. Software has bugs. Humans make mistakes. Attackers probe every exposed surface.

So the staking infrastructure was designed around one core principle:

No single server, no single key, and no single human can ever compromise the system.

Every layer of the stack (key management, networking, client software, and operational controls) follows that rule.

The result is a distributed validator architecture designed to eliminate single points of failure.

The following section is a bit technical, so feel free to skip to the end if the ins and outs do not interest you and you’ll go straight to a summary on how TheDAO Security Fund also contributes to a safer Ethereum via its own infrastructure. 

At the core of the setup is Dirk, a distributed threshold signing service. Shoutout to the Attestant folks for creating it!

Instead of storing validator keys on a single machine, each key is split into shares and distributed across seven independent signing nodes.

To produce a valid validator signature, four of those seven nodes must independently participate.

This means:

• Validator keys never exist in full on any machine, provider or even continent

• Compromising one or two nodes provides zero usable key material

• An attacker would need to compromise a supermajority of geographically distributed machines simultaneously
  
  

In other words, stealing a validator key is no longer a matter of breaching a server, it would require coordinated compromise across multiple independent systems.

All machines in the validator cluster communicate exclusively through a VPN mesh.

There is no public exposure for internal services.

Each node can communicate with its peers through encrypted tunnels, but external traffic is restricted to the minimum required for Ethereum network participation.

On top of the VPN layer, mutual TLS (mTLS) authentication is enforced between core services such as Dirk and Vouch. Even inside the private network, nodes must cryptographically prove their identity before communicating.

If a machine were compromised, it cannot simply impersonate another service.

Cryptography is nice, but without operational discipline, the system can still be compromised.

Administrative access to the system requires hardware-backed YubiKey authentication, ensuring SSH logins cannot rely on passwords or software-only credentials.

Secrets are managed using SOPS with age encryption, meaning sensitive configuration never appears in plaintext - including inside git repositories.

Firewall policies follow a strict default-deny approach, with only explicitly required services exposed.

All infrastructure is provisioned through Ansible, allowing consistent configuration and security hardening across all nodes. This includes audit logging, automatic security patching, and intrusion-prevention measures aligned with practices commonly found in SOC2 and ISO27001 environments.

When the assets being secured reach hundreds of millions of dollars, “good enough” security simply isn’t good enough.

Backups introduce their own risks. If key material is backed up improperly, the backup itself becomes the weakest link.

To mitigate this, encryption keys protecting backup material are split using Shamir’s Secret Sharing.

Multiple independent custodians hold shares of the recovery key, and no single individual can reconstruct it alone.

Only a quorum of custodians can collaborate to recover the encrypted material.

This design removes the possibility of unilateral recovery by any single operator.

Before deployment, the infrastructure was reviewed with support from SEAL Certs, part of the Security Alliance initiative focused on improving security standards across the Ethereum ecosystem.

Among the positive observations:

• Distributed mesh signing infrastructure improves both resilience and security

• Geographic and vendor diversity strengthen operational robustness

• Third-party packages are pinned to checksums to prevent supply-chain compromise

• Firewall policies enforce strict inbound traffic restrictions

• Automatic security updates are enabled
  
  

As with any serious security review, the process also surfaced areas for improvement - including key management practices and access control refinements within the WireGuard network.

These findings have been addressed as part of the ongoing hardening of the infrastructure.

Security is never static. It is a continuous process of review and improvement.

Validator duties themselves are handled by Vouch, which coordinates attestations and block proposals while interacting with multiple beacon nodes.

Those beacon nodes run a deliberately diverse set of Ethereum clients.

This diversity matters.

Ethereum’s history has shown that client bugs do happen, and monocultures amplify their impact. By distributing validators across multiple independent client implementations, the system avoids catastrophic failures tied to a single software stack.

A bug in one client should never bring down the entire validator fleet.

While Dappnode currently operates the validator infrastructure, the long-term goal is greater decentralization.

Dappnode already powers thousands of home staking nodes across the world, and the same philosophy applies here: infrastructure should become more distributed over time, not less.

Future phases may integrate distributed validator technologies that allow independent operators and home stakers to participate in validator clusters, further strengthening Ethereum’s resilience.

In that sense, this setup is not just securing 70,000 ETH it is also a stepping stone toward a broader, more decentralized staking ecosystem.

TheDAO hack was one of the defining events of Ethereum’s early years.

Nearly a decade later, the funds once associated with that incident are now being used to support the very thing that protects Ethereum from similar failures: security infrastructure, research, and public goods.

The validator architecture described here is just one piece of that effort and we hope that by sharing it here we can inspire people to take this infrastructure security seriously. 

If Ethereum is going to secure trillions of dollars in global infrastructure in the coming decades, it must build systems that assume failure, assume adversaries, and design accordingly.