Hacker News Reader

The private keys are still vulnerable when they existed on the servers. It would be possible for their servers to be unknowingly breached. Moving the private keys offline won't help if they've been maliciously copied. The thief could wait a while (months, year) before stealing the funds.

View on HN

The private keys need never have existed on that server. On the occasions which they are used, they need never touch the server, and the machine they're actually used on (likely a laptop with a LiveCD) doesn't need to directly communicate with the server so identifying and targeting it would be futile.

Reply on news.ycombinator.com