Key Rotation Best Practices for Crypto Teams

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. Rotate on events first: a departure, a lost or suspect device, a leak, or access no longer needed. On a schedule, NIST recommends at most about one to three years for signing keys; rotate service credentials more often.

Watch: Key Rotation Best Practices for Crypto Teams 1:34

Video transcript

Rotate keys on events first and on the calendar second. Onchain, a new key usually means a new address, so rotation is a migration.

An Ethereum address comes from its public key, so changing a bare key changes the address. A Safe keeps its address when its owners change, which makes rotation cheap.

NIST recommends a maximum cryptoperiod of about one to three years for private signature keys. Service credentials should rotate far more often.

Rotate at once when someone with access leaves, a device is lost or suspect, a secret leaks, or a delegation ends.

At Ronin, Rekt says access from an arrangement that had ended was never revoked. About 624 million dollars was stolen.

For a Safe, the SEAL runbook says to verify the new address with a signed message, add the new signer, remove the old one separately, then sign a test transaction.

Hot wallet keys mean a new address and a migration. MPC shares can be refreshed for the same key, and API keys overlap two credentials so nothing goes down.

Rotation also has limits. At Drift, BlockSec saw signs the attacker regained the threshold under a new council. About 285.3 million dollars was lost.

Guardian's Managed Security watches keys, signers and secrets, and reviews every multisig transaction before it is signed. Read the full article, or talk to Guardian.

In a cloud key manager, rotation is quiet. AWS KMS swaps the key material, keeps the key ID, and applications need no code changes.

Onchain keys rarely work that way. A new wallet key means a new address, and everything tied to the old one has to move.

Why Onchain Rotation Is Different

An Ethereum account’s address is the last 20 bytes of the Keccak-256 hash of its public key, per ethereum.org. Change the key and you change the address.

Contract accounts are the exception. A Safe keeps its address when its owners change.

So multisigs and contract roles make rotation cheap. A bare key makes it a migration.

Rotation also carries risk. NIST warns that where manual key distribution is “subject to human error and frailty, more frequent key changes might actually increase the risk of key exposure.”

When to Rotate

NIST SP 800-57 calls the time a key is authorized for use its cryptoperiod. Personnel turnover is one of the factors it lists for setting one.

For a private signature key, it recommends “a maximum cryptoperiod of about one to three years.” It adds: “If a key is compromised, its cryptoperiod shall no longer be considered valid.”

The calendar is the backstop. Rotate at once when:

A signer, engineer or vendor with access leaves.
A device holding a key is lost, stolen or suspect.
A secret leaks, or a tool that touched it is compromised.
A delegation or integration ends.

After the tj-actions/changed-files GitHub Action was compromised in March 2025, CISA said: “Rotate all identified secrets immediately as they should be considered compromised.”

Forgotten access is another. Rekt says the Ronin attacker got the fifth of five needed signatures through an Axie DAO arrangement that had ended months earlier.

In Rekt’s words, “the whitelist access was never revoked.” About $624 million was stolen in March 2022.

A policy template

Our suggested defaults. The 1 to 3 years applies NIST’s signing-key guidance; the other rows are our suggestion.

Key	Suggested schedule	Method
Multisig signer	Within 1 to 3 years	Add new, verify, remove old
Hot wallet key	Within 1 to 3 years	New address; move roles and funds
MPC key shares	When a holder or device changes	Refresh, or new key and migrate
Contract roles	On every holder change	Grant new, then revoke old
Exchange and RPC API keys	Short expiry, automated	Overlap two keys, revoke old
Deploy keys and CI tokens	Replace with expiring tokens	GitHub App tokens

Rotating Multisig Signers

A Safe changes its owners only through its own transactions. Safe’s docs say swapOwner “can only be done via a Safe transaction.”

The Security Alliance (SEAL) runbook sets the order:

Document the reason for the change.
Verify the new address with a signed message, matching the hash on the hardware wallet.
If the old key still works, add the new signer first, then remove the old one separately.
If the old key is lost, confirm identity by video call and batch the add and remove.
Keep at least 3 signers and a threshold of at least 50%.
Have the new signer sign a test transaction, then verify membership onchain.

For departures, SEAL’s deadlines are 48 to 72 hours on emergency Safes, 7 days on critical ones and 14 days otherwise.

Rotation does not cancel what was already signed.

Safe’s help center: “The only way to ensure that your signature cannot be used by someone else, is to ‘consume’ the nonce of that transaction.”

If the rotation follows a compromise, use our compromised signer runbook instead.

Hot Wallets, MPC and KMS Keys

Hot wallet keys

A hot wallet key can’t rotate in place. Rotation is a migration:

Create the new key in your HSM, KMS or MPC system.
Grant its address the roles and allowlist entries the old one had.
Send a test transfer, then move funds in tranches.
Revoke the old address’s roles, and zero allowances that let it spend.
Keep monitoring the old address.

Allowances are easy to miss: under EIP-20, an approval lets the spender withdraw “multiple times, up to the _value amount” until it is changed.

Keeper and admin roles

OpenZeppelin’s AccessControl moves keeper, relayer and admin roles with grantRole and revokeRole, called by the role’s admin.

Grant the new address, run one real job, then revoke the old.
Use Ownable2Step, so a new owner must call acceptOwnership.
Guard DEFAULT_ADMIN_ROLE, which OpenZeppelin says “carries significant risk.”
Prefer AccessControlDefaultAdminRules: one admin, a 2-step transfer and a delay.

MPC shares

MPC can rotate shares without changing the key. Coinbase’s open-source MPC library: “Use the corresponding refresh* APIs when you want fresh shares for the same (combined) key.”

Refresh when a share holder leaves or a device is replaced.

To replace the key entirely, it says to “run a new dkg* flow and migrate in the application layer.” That means a new address.

If compromise is suspected, it says to stop signing until your incident process picks refresh or retirement.

KMS keys

AWS KMS rotates only symmetric encryption keys in place. A signing key is asymmetric, so rotating it means a new KMS key, a new address and a migration.

API Keys and Deploy Keys

Service credentials can rotate often. OWASP: “You should regularly rotate secrets so that any stolen credentials will only work for a short time.”

Avoid downtime by overlapping two valid credentials. In AWS Secrets Manager’s alternating users strategy, an app that fetches the secret mid-rotation “still gets a valid set of credentials.”

Exchange and RPC keys: set an expiry where offered. Kraken lets you create a key that works only for a set time.
Deploy keys: GitHub says they “don’t have an expiry date.” It recommends GitHub Apps, whose installation tokens expire after an hour.
After a leak: OWASP’s order is revoke, rotate, then remove the secret from the exposed system.

For vaults and short-lived credentials, see secrets management for crypto companies.

What Rotation Can’t Fix

Rotation retires a key. It does not undo what the key already did, or clean the path that leaked it.

Funds already moved are gone; rotation protects what remains.
Approvals and roles elsewhere survive until you revoke them.
The attacker’s way in still works on new signers.

Drift shows the last one. On March 27, 2026, a planned Security Council migration voided the signatures an attacker had collected, per BlockSec.

By March 30, BlockSec saw signs the attacker had regained the 2-of-5 threshold under the new council. About $285.3 million was lost on April 1.

So pair rotation with NIST’s compromise-recovery basics: an inventory of all keys, and monitoring of the re-keying to confirm every affected key was replaced.

How Guardian Helps

Guardian’s Managed Security covers operational security across nine domains and 118 controls: keys, signers, access, secrets, devices and the pipeline that ships them.

Changes such as a rotated signer or a permission granted surface as they happen. Every multisig transaction is reviewed before it is signed.

An OpSec audit maps where keys live, who holds which share, and what happens the day someone leaves or a device is lost.

An infrastructure pentest checks secrets handling, rotation, and what survives an employee leaving.

Frequently Asked Questions

How often should private keys be rotated?

NIST SP 800-57 recommends at most about one to three years for a private signature key. Rotate sooner after a departure, a lost device or a leak. Service credentials need short, automated cycles.

How do you rotate a Safe multisig signer?

Per SEAL’s runbook, verify the new address with a signed message, add it, then remove the old owner separately. Keep at least three signers and a 50% threshold, then sign a test transaction.

Does rotating a key cancel signatures it already made?

No. Safe says the only sure way to stop a signature being used is to consume its nonce. Approvals and roles on other contracts also stay in place until you revoke them.

Can MPC keys be rotated without changing the address?

Yes, by refreshing the shares, which keeps the same combined key. Coinbase’s MPC library has refresh APIs for this. Replacing the key entirely means a new key generation and a migration, so a new address.

Sources

Know every key that can move your funds

Guardian maps your keys, signers and roles, and surfaces a rotated signer or a new permission as it happens.

Talk to Guardian Explore Managed Security