AEREDIUM has launched AERSeal, a smart contract security product designed to replace reliance on a single administrative private key with threshold signing and approval-based controls.
The company said Wednesday that AERSeal is its first end-to-end product built using AERKey, AEREDIUM’s threshold-key infrastructure. The system targets privileged smart contract functions such as upgrades, token minting and other administrative actions that can carry substantial security implications if controlled by a single account.
Under conventional smart contract ownership models, an administrator can hold broad permissions through one externally owned account. If the private key to that account is compromised, an attacker may be able to exercise the same privileges. Losing the key can also make certain administrative functions inaccessible.
That risk is recognized beyond AEREDIUM. Ethereum’s developer documentation describes assigning contract ownership to a single address as a potential single point of failure and recommends mechanisms including role-based access control and multisignature accounts for sensitive functions.
The risk has surfaced in recent incidents as well. A Polymarket operations wallet lost about $700,000 in May after what the platform described as a private-key compromise rather than a smart-contract exploit.
OpenZeppelin, whose smart contract libraries are widely used by Ethereum developers, similarly recommends stronger access-control structures as applications move beyond simple deployments.
How AERSeal Works
AERSeal is intended to shift a contract’s privileged authorities from a conventional private key to a threshold-controlled address.
AEREDIUM said the underlying key is divided into shares stored separately inside hardware-attested enclaves. Those shares are used collectively to generate signatures rather than being assembled into a conventional private key held by one administrator.
The company says AERKey uses CGGMP24, a threshold ECDSA protocol. AEREDIUM had documented CGGMP24 as part of its key-management infrastructure before the AERSeal announcement, while its AER360 product documentation describes a combination of threshold signing, transaction policies and approval requirements.
AERSeal adds an organizational approval layer on top of that signing infrastructure. Customers can establish an M-of-N approval policy, specifying the number of authorized people who must approve an administrative action before it can proceed.
For example, an organization could require multiple designated signatories to approve a contract upgrade. Those users approve the requested action using passkeys, after which the threshold infrastructure produces the necessary cryptographic signature, according to the company.
The distinction is important: the organizational M-of-N approval process determines who must authorize an action, while AERKey provides the underlying signing mechanism.
Existing Contracts Do Not Need to Move
AEREDIUM said AERSeal works with existing smart contracts rather than requiring customers to redeploy them to a new chain.
Before activating custody, the system identifies the administrative privileges associated with a contract. Those powers — such as ownership, minting or upgrade authority — must then be transferred to the threshold-controlled address.
AERSeal subsequently checks onchain that the intended authorities have been transferred before activating the organization’s governance policy, according to the company.
The product currently supports contracts deployed on Ethereum Virtual Machine and EVM-compatible networks, AEREDIUM said.
The approach resembles a broader security practice in which privileged smart contract roles are transferred away from individual externally owned accounts. Ethereum’s documentation recommends multisignature governance and other distributed authorization mechanisms to reduce trust in individual administrators, particularly for upgradeable contracts.
AERSeal differs in its use of an offchain threshold-signing infrastructure that ultimately produces a conventional blockchain signature rather than requiring each approving participant to independently hold and use a complete signing key.
AEREDIUM Adds Independent Key Verification
AEREDIUM is also positioning cryptographic verification as part of AERSeal’s onboarding process.
The company said customers can verify the threshold key assigned to them using address derivation and a freshly signed challenge. That verification can be performed independently, including offline, rather than requiring customers to rely solely on AEREDIUM’s assertion that the key is correctly controlled.
Organizations onboarding to AERSeal must complete KYC or KYB checks, register their contracts, verify the assigned cryptographic key, transfer the necessary contract privileges and configure their approval policies, according to the announcement.
AEREDIUM’s previously published technical documentation describes AERKey as a threshold-signing system operating across hardware-attested environments. Its public AER360 materials also describe policy checks and approval quorums as conditions that must be satisfied before signing occurs.
“The goal is to remove the idea that control over an entire smart contract should depend on one private key,” AEREDIUM founder and CEO Albert Dadon said in a statement. “With threshold signing and defined approval policies, control can be distributed and independently verified rather than concentrated in a single point.”
AERSeal is part of the company’s broader AER360 product family and is provided by Aeredium Network LLC using AERKey technology, according to the announcement.
AEREDIUM did not disclose named AERSeal customers, production usage figures or pricing in the materials provided with the announcement. As with any new custody or key-management system, the security of the implementation — including its enclave infrastructure, approval policies, software and operational controls — remains separate from the security properties of the underlying cryptographic protocol.
AEREDIUM Holdings Inc. describes itself as a blockchain infrastructure company focused on institutional digital-asset settlement. Its public platform currently includes AERKey, policy-management tools, wallet infrastructure and controls for automated agents.
