Crypto Custody, Cold Storage, and What Wallet Security Actually Means

There's a there's a lot so such an important conversation around really what you oversee at defense as CSO when it comes to really the truth of what is happening, what is important. The SEC is just coming out with some very important, but also very basic things yesterday on on X around guidance, around custody, and security. I think the conversation and product and business you guys have been building for years, and the value and priority you have around some of these topics is finally coming into the spotlight.

So we're really excited to have you on and maybe myth bust a little bit. Maybe as we kick off, give the audience a quick overview of your role at the firm, and really when you think about CISO, what that looks like day to day at defense. Yeah. Definitely.

So yes. So I'm trying to build help the company build a project that is, like, as secure as possible. And this is this, like, is, a scope that you need to build, like, brick by brick, and it's not only, like, linked to just the applications that you are developing, who is developing this application, where this is being deployed, how this is run run, what what is the governance that you have, who is responsible for what.

And so defining all of this space and build, like, this, like, framework and security program to make sure that you don't miss anything and you try to, like, monitor and prevent any any threats that can happen to your system. So, yeah, that's that's basically my role. As I used to say, security is interesting because nobody hears about security but when there is something that goes wrong. This is what I'm telling my team. Nobody is gonna tell you, ask you something unless there is something that goes wrong. Right?

That's not totally true because the team at defense are very well aware of the, like, security implication of what we are building, and so they always come to us for, like, advice and making sure we we grow something. But that's that's the idea. When we talk about security, and I think especially when consumers

hear about wallets, you know, they think about their MetaMask wallet, their Phantom wallet, and probably one of the first security relevant phrases they're gonna get thrown is is not your keys, not your crypto. But it's also probably I know for me, when I was getting into the space, probably that, you know, when I was taking custody of my wallet, that was that was scary moment. I don't wanna lose this seed phrase. I'm gonna lose all my money.

You hear the stories of people losing their keys to their Bitcoin wallet that's in the landfill now. What what is correct maybe about that statement? And is there anything about that statement though that from your perspective, you you kinda wanna pull back on

that you maybe dispel? This this statement is is nice. Right? It's a nice statement that comes from Cyberpunk era, and and everybody, like, embrace it at the time. So issue is, like, the implementation that's been done to, like, try to stick to this mantra as much as possible. Right? So the very as you as you said, what that means is that the very basic way to implement that, it's to say, I have a piece of paper.

I'm just gonna write my private key to this piece of paper, and only me is gonna have access to this piece of paper. And so each time I need to sign a transaction, I can do it using as a secret word on my my paper. So that's great. But then, unfortunately, this is impossible. This is not sustainable. We we've seen, like, a house on fire, wherever you backed up your your seat phrase as this part is gone.

We've seen, like, people getting very scared and some, like, attacks, like physical attacks on on people to, like, try to get access to their. So all of this implementation starting from this mantra, we got this basic implementation and basic way of saying, okay.

Everybody can manage its own, like, basically token, so its own money created a lot of issues that resulted in I think it's more like 20% of all Bitcoin circulation has been lost and not because of, like, DPRK, North Korean hacker, or, like, a lot of big hacks, but just because people, they lost their keys. And so that's a real problem. That's like a disaster. You have 25,000,000 become in circulation circulation. 20% of them are lost. People, they lost all of their, like, life saving money. This is a real disaster.

So by starting with, like, a very simple and interesting idea, the implementation got into the way, and we realized that now that's not something that can be is that easy to do. So when institutions are approaching defense and they're engaging in this in this institutional wallet conversation,

I assume that most of these people may start as consumers with this understanding of the not your keys, not your crypto, with this notion that self custody is king. What does the conversation look like to dispel some of those myths and to start helping them think about wallet security in the correct way? I don't know. Maybe did this happen with with IBM and Digital Asset Haven? Or what does that educational cycle look like

for for wallet security in general? I would say when we talk with, like, big financial institution, big banks, IBM as well, they are pretty aware of what that mean to under billion of dollars for their customer and the risk associated with it. Right? They have an existing framework in place and compliance for, like, all of their, like, today's assets.

And what they want is to make sure that by getting exposed to digital assets, they can they don't have to change their all of their framework and their compliance, and they can find something that is similar for the digital asset, space. And so that's what's interesting and where the the you you can see, actually, the shift is coming for, like, for one year now, even, like, a bit more than that.

But we all started with, as a consumer, as you said, with, like, hardware wallets and putting half of your, like, maybe on the phone or this kind of, like, using consumer device. But that's not something that works with, like like, all the financial institution who know how to, like, secure billions of dollar for their customer. You can't tell them you're gonna have half of your critical secret in a phone or in an Apple wallet. They they asking for more, and this is exactly the discussion that we have with them.

And that's why we try to position ourselves in a in a, different way by decoupling how do you access a platform from the critical secrets that you need to secure charge of digital asset keys. Now we do have a lot of conversation with, like, maybe more Web three native companies who are really in this, like, belief of, like, not your key, not your cryptos. And so there is actually, that's where you have more education to do.

Where when you say not your key, not your cryptos, we we mentioned that we all agree this is nice. But as soon as you try to you start to put your private key in any, like, technical provider, you you start to work with any technical provider. So with even with an hardware wallet company, you have an implicit trust in this hardware wallet company. Right? How do you know that the firmware that is running on your hardware wallet doesn't have any malicious access?

How do you know that as soon as you're gonna upgrade your firmware to have access to more staking or more advanced functionality, you're not gonna get a bad job on your on your hardware wallet. So this is where we there is a bit of education, in my opinion. And whenever we start to say that, people are like, oh, yeah. That's true. I guess I need to trust this company even though I I I thought I had my hardware wallet. I was the only one who controlled.

So when we were talking about this conversation a little bit earlier, there there was one thing that stood out. Since smart contracts remove

the need for custody, what do you mean by that exactly? And maybe what are the implications

to that for financial institutions? So we've seen a lot of, discussion around you can manage all your assets using, some smart contracts and implement maybe MuteSig and try to implement all of your logic inside the smart contract. And because the smart contract is code that is on chain, you have this belief that the blockchain brings all the security, and so you don't need advanced security. You don't need, like, some advanced monitoring and all of that. It all goes back always to the same thing.

It's not because you have components that is secure, that the access to this component is secure. Right? It's not because you put all of your, like, money in a vault that is very secure, but that access to the vault is secure and that if you if you don't keep the key to access the vault in, like, operational secure way, that that you can say that your money is secure.

And so that that's the same here is who has access to this smart contract, how this smart contract can be updated, upgraded, what is the logic, how do you make sure that all the logics that you put in your smart contract is cannot be a tamper with and can evolve with all your needs. So each time you need to add a new person to your multisync, what do you do? How do you sign that? Who has access to the secret that can update those parts?

So those are a lot of, like, governance discussion that are very important to take into consideration. And even if the code run-in a blockchain with a secure consensus protocol,

that doesn't mean that your assets are secure. How how is AI impacting this conversation? I think we just saw the other day lending protocol on base Moonwell. There's a one I think it was like a $1,800,000 exploit that they sourced back to an AI vibe coding error. How should firms be thinking about vibe coding? I know this is a little bit of a curveball, but yeah. How how do you even think about approaching this this conversation? Because it's only gonna increase. Right?

I mean, I think about the amount of AI that we use in in our systems to to build the studio even. Yeah. That's a great question. Us as, like, security engineer, we are kind of in the crossfire here. Right? Because you asked me,

should I let a robot code, like, put some code in my application? A year ago, I would have told you, no way. It's, like, impossible. This is not secure. How can you trust this thing? Right? It's like, fundamentally, it goes against a lot of, like, principles that you have in security, where you always want to check to make sure that the logic is is is alright and that people, they did the design a good design decision, and then they move into the code, and they they implemented that in a secure way.

Now for sure, AI is adding a lot of velocity. And, in an industry that's moving very fast, like like, three, four of the company are, like, embracing it, and so you already needs to find the right middle ground with that. And that's always the same with security. If you want a secure system, you just unplug everything. You have a system that's not connected to anything that nobody can access. It's secure, but it is useless.

So you still want to create this, like, a usable ecosystem that people can strive into and and and create things while still being secure. So, yeah, vibe coding, I think it's always important to, like, reduce the code and not getting into this maybe laziness, I would say, of saying, oh, yeah. For, like, the last 100 times I did a commit, everything was clear. Everything was secure. Everything looked great because I reviewed it.

So the 100 the like, now, this just one time, I'm just gonna not review it because I'm pretty sure it's gonna be can trust it. So, like, never trust basically, never never trust anybody. Right? You always need to, like, review some code, and this code has been reviewed by has been written by a human or by AI. You always need to, like, question what's being done and make sure that another pair of eyes are looking at it. This this might be a bit of an out there question. But

as a security company, you want everybody that uses you to trust you innately, but you also said to not trust any everybody. What what does trust mean to you? How does trust get built as a, you know, essentially a security partner with these institutions?

So you said we want everybody to trust us. What I'm gonna tell you is that I don't want anybody to trust us. I want people of customer and the compliance and the security people and the firm that are using us to be able to use our projects without having to trust us. Right? This, like, has been, like, famously pushed by Apple saying, it's the idea. If the API comes to us and ask to read the message, we can't provide this content because we don't have the the ability to do it because it's all on fifty ten to end.

And so this is what we want to enable with our solution. We wanna say to the companies, we have our products. You can use. You can run our products. This product can be in can be run on your infrastructure, or you can also use our infrastructure.

But at the end of the day, we got no further use the ability to validate every interaction and validate all the integrity of the system so that if we go rogue, if we are getting we are hacked and there is some malicious people inside your system, you're not gonna be impacted. So, yeah, I would say what we are building now when when a company comes to us and say, we cannot trust you, but we're gonna use your products. This is always a good victory for

Anything else, you know, when we think about the these myths or expressions in this space that or or maybe anything that's particularly relevant that you've seen lately that you maybe wanna dispel when it comes to wallet wallet security? So

I think there are we we we are seeing a lot of discussion in the space lately around, like, regulation. And with regulation comes some discussion around, like, cold storage. Right? So you have the regulators that says to the financial institution, you need to keep in, like, a cold storage solution. So what is cold storage is basically your values implementation of the term, and people all around the world, regulators, they have also various understanding of it.

But you you could say, I'm just gonna put my private keys in a disconnected computer or in an HSM that is connected to a disconnected computer. And because because there is this air gap between the connected world and the part that is disconnected, everything is gonna be secure. Right? And because the regulators, they asked for it, we've seen some people implementing some solution just to say that they have a disconnected solution, but not really thinking more about that.

And so here, what is important to understand is when you do that, you may create a solution that is even less secure than, like, a a fully connected system. Because if you just put a small HSM on a computer in the locker of your desk, and anybody can come in and just talk with your HSM and and start to sign transaction. This is actually a very, very unsecure setup. It's again, we're going back to the governments, and it's not because you have a system that feels secure that access to this system is secure.

So this is very important to see that a bit more globally as a full system and say, how do I enable, like, integrity and end to end security by the time where I wanna pass an order. So So we call that an intent. I wanna say, I wanna transfer 1 Bitcoin from this wallet to that wallet.

From this moment to the moment where it goes to the HSM or to the MPC, and this is actually being signed and broadcasted to the blockchain, you have an end to end trust and integrity that you can put in place to make sure that no syncing between can change that. So if you do that, you can tell anybody you can go

see a man on the street and say, go plug this USB key to my HSM to sign it, and this person won't be able to do anything with it because you have a good integrity check right at the end of the process. Does that make sense? Following you a little bit, there was a few things at the end that I think were getting above my pay grade here, but this is, I think, part of the reason this is this is why Drew and I wanted to do the show.

You know, I think we made a comment last week when we had some of our first guests on that we were excited to do this to not only obviously bring these insights to our community, but also to accelerate our learning to dive deeper into these new stories and and context that you see all over crypto, Twitter, and LinkedIn. So I do think we have we have our next guest, Nick, in in the green here. Anything else to to leave a listener here that may be thinking deeply about their wallet security right now?

Any any final thoughts you wanna leave them with? Yeah. I I would say there is no reason why

a Web three stack cannot integrate well with, like, some existing framework. And so whenever you wanna get exposed to digital assets, you don't need to like, as a financial institution, you shouldn't need to be afraid to try to reinvent the wheel and try to have your compliance team agreeing to something that's not something that they know. You can definitely go to a technical provider and ask for everything that you used to ask for, like, other assets. What is my disaster recovery strategy?

What if you disappear in an instance? How can I recover my assets? What are all of your certification? How do you under your government? Can I deploy everything on my data center? All of that is something that is post there is no reason why it's not possible. And what what we mentioned during this past thirty minutes saying, I'm just gonna give you one key share, put that in your phone, and you're gonna be secure. This is actually not true and doesn't fit any compliance model. So don't be afraid to ask for that.

You have people in the space that are building it like this. We've been talking with 100 of institution. We know their requirement, and it's definitely possible to do something that can be, like, accepted and stick to their, like, risk framework. Well, I just I wanted to ask this a little selfishly before we let you go.

Just your background in the French military and Google and security. I know we didn't have a a time ton of time to get into any of that, but what would you say just the journey that you're on and learning so much about this space and how security can apply in all these different contexts, whether it be government, fintech. There's just so many different use cases. What would you say? But maybe maybe more in the French military.

I'm just curious, like, any any key takeaways or key learnings that in that context you you picked up in a role like that? I don't know how long you were working in that in that environment or what role that played in in the security journey, but I just had to ask. It's such a unique point in the journey for you. Yeah. With security,

it always comes down to the same thing is you have a software, you have a system in front of you. Either you're on one side, so you're testing the security of the system. We are you're on the other side. You are securing not trying to secure the system. It's always the same question is how can I find a way to bypass all the logic of the system to then do some things that shouldn't be allowed to do? Right? And these those are, like they can happen in in always, even, like, in in real life.

If if you have if we have, like, one minute, up a small anecdote. But, like, two years ago, I was, like wanted to visit, like, a famous church in Venice, I think. And you had this long this is very long line in front of the of the church. And so I just go in front, and I see that some people with bags, they are sent away to another small location to, like, put their bags there. And then they they get a ticket, and they can go back and, like, bypass all the line. Right? And so what I did, I had a bag.

I just went there, got my tickets, put my bag, and bypass the line until the church. Right? So this is with security in, like, cyberspace is is all is the same thing. It's how do you try to find those, like, bypass to be able to access some, like, unwanted feature of the system. And in the, French mis military of defense, it was the same thing. It's just that instead of doing that with only the cyberspace, you have some, like, military.

So you have also people that are on the ground that needs to take some decisions that rely on how you do things digitally. And so I would say the the pressure and the processes are much more, like, much higher. And so if you ask me what did I learn back then that now I like and I build on is sometimes whenever we have a small security incident or we have some small monitoring and we have people that are stressed.

For me, when you lived in a time where you had, like, military that were, like, really timely depending on your action and take some some decision, Now it feels like pretty easy easy things to do. So working under stress and just stay calm, understand what's going on,

and make sure that you have all the signals that you need to have to make sure that your system is secure is something that I learned over the years. Yeah. Amazing. Well, to both, thank you so much for joining us. This was really great. There's so much more to dive into. I think what we'll try to do is get maybe these types of conversations on the end of the show. Should we still have a hard stop?