gitleaks detect --source . --verbose 

HashiCorp Vault — for production-level security. Secrets are stored encrypted, access via dynamic secrets with TTL, audit log of every request. Vault is 10x more scalable than manual secret management. Cloud Secret Managers are 2x easier to configure than Vault for single-cloud projects but lack dynamic secrets.

# Retrieving a secret via Vault CLI vault kv get -field=private_key secret/blockchain/signer # In application: dynamic token with short TTL vault token create -policy="blockchain-signer" -ttl=1h 

For applications in Kubernetes — Vault Agent Injector or External Secrets Operator. The secret is mounted as a file, not exposed in environment variables (which are often logged).

How to Encrypt Private Keys?

Private Key Encryption

HSM for Signing Keys

For production signing keys (multisig, oracle, bridge) — HSM. The key never leaves the device, signing is performed inside. Using an HSM is 100x more secure than software-based keystore. AWS CloudHSM / Google Cloud HSM support secp256k1 (check compatibility). HashiCorp Vault can also use HSM as a backend. Implementation cost for HSM ranges from $5,000 to $15,000 per device.

Nitro Enclaves (AWS) — virtual isolation: the enclave has no persistent storage or network access. Even root on the host machine cannot access data inside. Nitro Enclaves provide 100x better isolation than standard VMs.

Keystore Encryption

For less critical keys (hot wallets with limits) — EIP-55 keystore format:

// ethers.js: create encrypted keystore const wallet = ethers.Wallet.createRandom(); const encrypted = await wallet.encrypt( process.env.KEYSTORE_PASSWORD!, { scrypt: { N: 131072, r: 8, p: 1 } } // high cost factor ); // Save encrypted JSON, not the private key // Decryption at application startup const wallet = await ethers.Wallet.fromEncryptedJson( keystoreJson, process.env.KEYSTORE_PASSWORD! ); 

The keystore password is also a secret. Store it in Vault or Secrets Manager.

Encrypting User KYC Data

If the project stores KYC documents — they fall under GDPR. Minimum requirements:

• Encryption at rest: AES-256-GCM for database data. KMS for key management.
• Encryption in transit: TLS 1.3 everywhere, cert pinning for mobile apps.
• Data minimization: store only the document hash and status, not the document itself. This reduces data exposure by 99%.

-- Encryption in PostgreSQL via pgcrypto INSERT INTO kyc_data (user_id, encrypted_document_hash, verified_at) VALUES ($1, pgp_sym_encrypt($2, current_setting('app.encryption_key')), NOW()); 

Encryption of Data in IPFS

IPFS is a public network. Everything is accessible to everyone. For private data — encrypt before upload:

import { create } from 'ipfs-http-client'; import { box, randomBytes } from 'tweetnacl'; import { encodeBase64 } from 'tweetnacl-util'; async function uploadEncrypted(data: Uint8Array, recipientPublicKey: Uint8Array) { const nonce = randomBytes(box.nonceLength); const { publicKey, secretKey } = box.keyPair(); const encrypted = box(data, nonce, recipientPublicKey, secretKey); const payload = { nonce: encodeBase64(nonce), ephemeralPublicKey: encodeBase64(publicKey), ciphertext: encodeBase64(encrypted) }; const ipfs = create({ url: 'https://ipfs.infura.io:5001' }); const result = await ipfs.add(JSON.stringify(payload)); return result.cid.toString(); } 

Infrastructure Security

Network Isolation

Signing nodes, bridge operators, oracle nodes — not public. VPC with private subnets, security groups with minimal permissions. Isolating signing nodes reduces attack surface by 90%.

Securing RPC Endpoints

Public RPC — an attack vector. Rotate Alchemy/Infura keys, use allowlists by origin. A dedicated RPC node (geth/erigon) in a private subnet is better. Access only through internal services.

Monitoring and Alerting

OpenZeppelin Defender Sentinel monitors on-chain events, sends alerts on anomalous transactions from privileged addresses. Forta — decentralized monitoring with community detection agents. Setup takes 1-2 weeks but provides critical visibility for incident response.

Deliverables

When ordering encryption setup, you receive:

1. Audit of current infrastructure: risk assessment, leak detection, recommendations.
2. Architecture design: selection of secret manager, HSM, encryption scheme.
3. Implementation: deploy Vault/HSM, configure key rotation, integrate with applications.
4. Documentation: infrastructure diagram, rotation procedures, security policies.
5. Team training: workshop on secrets management and incident response.
6. Support: monitoring, alerting, scheduled rotation.

Complete encryption setup for a production crypto project takes 3-6 weeks depending on infrastructure scope. The cost for a full setup ranges from $10,000 to $50,000. Cost savings from preventing a single breach can exceed $500,000. Approximately 60% of crypto projects have experienced a security incident related to off-chain infrastructure; implementing encryption reduces incident probability by 80%. To assess risks, contact us — get a consultation within 2-3 days.