# Squads says its multisig secures billions as it debates Bastion over custody Stabledash Live, a Stabledash show. Oct 5, 2026. Nassim Eddequiouaq. https://live.stabledash.com/shows/the-live-show/episodes/should-you-trust-code-or-institutions-with-your-money-l_RJc8WutrQ The founders of Squads and Bastion disagree on whether immutable code or legal liability protects user assets better, though both say the two models should exist side by side. Stepan Simkin, co-founder and CEO of Squads, says its Squads Multisig product secures billions in value and moves billions of stablecoins every month. He debated Nassim Eddequiouaq, founder of Bastion, on whether regulated custody or self-custody should hold users' money. ## Two models of custody Bastion offers regulated stablecoin infrastructure for enterprises, and Eddequiouaq says it serves Sony through Sony Bank. Squads started in 2021 building programmable, self-custodial financial account infrastructure for Solana. Simkin says that about a year ago it began building Altitude, a global operating account for businesses that connects to local payment rails and issues corporate cards. He thanked Stabledash for being a customer. ## Non-custodial is not trustless Nassim Eddequiouaq argues that users of non-custodial wallets "still trust wallet developers," hardware makers, firmware, smart contracts and the developers' AWS credentials. Possessing access, he says, does not guarantee exclusive control over assets. He pointed to a past wallet logging flaw in which credentials were pushed to an off-chain server, leading to hacks of self-custodial wallet users. If trust is modeled deeply enough, he says, the guarantees come out the same as with a regulated custodian. ## Immutable code, open interfaces Stepan Simkin says the two programs behind Squads Multisig are immutable, with no admin functions on-chain, and can be used through the main UI, a local interface or UIs hosted by other providers. He expects the test for self-custody to become the ability to export keys and access assets no matter what happens with the front end. He adds that smart contract exploits happened every month back in '21, and attackers are now moving up the stack toward credentials and employees. ## Liability as an incentive Bastion has obtained OCC conditional approval for a trust bank, which Eddequiouaq says means fully segregated client assets and a fiduciary duty that makes the company legally liable. He argues that this incentive structure makes secure operations more likely. He also says each layer of abstraction between users and the cryptography adds counterparty risk. ## The bridge exploit Host Drew Rogers raised the exploit of Paylink's bridge contract on Ethereum. Eddequiouaq described bridges as counterparties in the flow of funds. Simkin replied that licenses would not have prevented it, because "a bug in a smart contract is a bug in a smart contract," and said no regulator will oversee a team's operational security for it. Simkin expects hacks to keep happening but says each one improves the systems, and that over the last five years crypto has been regulating itself by developing standards. Even so, he says both models need to exist side by side because every approach has trade-offs. ## Key takeaways 1. Stepan Simkin says Squads Multisig secures billions in value and moves billions of stablecoins through its infrastructure every month. 2. Nassim Eddequiouaq of Bastion argues that non-custodial wallets carry much the same trust risks as a regulated custodian, because users still trust developers, firmware and cloud credentials. 3. Simkin says a license would not have stopped the Paylink bridge exploit and calls for building better systems, while saying both custody models need to coexist. ## Chapters - 0:00 Founders of Bastion and Squads introduce themselves - 4:18 Debate began with a tweet after the Rain exploit - 7:00 Non-custodial does not mean trustless - 9:23 Licensed custodians are opaque while onchain systems are transparent - 14:51 Every self-custody model shares weaknesses with custodial systems - 19:37 Immutable multisig and alternative interfaces keep users in control - 24:01 Legal recourse is not worth giving up permissionless systems - 28:23 Licensing, insurance and fiduciary duty align custodian incentives - 32:26 Neither audits nor licenses replace ongoing security work - 35:18 Each abstraction layer adds counterparty risk that needs regulation - 39:18 Pay bridge exploit tests both views, and they close ## Transcript **Drew Rogers** (0:06) Alright. Here we go. This is fun. And thank you, by the way, I think, NASS for giving giving us some really fun visual aid here. I mean, come on now. This is this is really great. Did you make this? **Nassim Eddequiouaq** (0:22) I got mugged by and Stefan, just like them attacked me against me. I'm getting face marked. That's **Drew Rogers** (0:30) so funny. I think you you both look rather rather masculine and strong here. So this is this is looking nice. This is looking nice. Maybe we'll do one of the orange videos after this with you both. Been seeing a million of those. My favorite one was the Airwall x Sequoia investor one that that I saw. But, anyway... Okay. I digress. Thank you guys for coming on here. I'm trying to... I'm I'm both pro... Producing and programming the show and hosting it. So give me a second here. I think I'll I'll try to I'll try to do this as as best as best as we can. So let's start with how this all came to be. I'm gonna pull up the kind of original tweet. I think that might be the best. But before we do, Nas, I'll kick it to you. Give us your intro, a little bit about Bastian, the the huge news to share as well that that recently, **Nassim Eddequiouaq** (1:27) I think, this week was was revealed. And then, Steph, we'll have you do the same. Sounds great. Excited to to be on, and especially every single conversation with Stephanie is always amazing. So I'm Nas, founder and and COO at at Bastion. I've been there in the crypto space for quite a bit of time before that. I was at Apple in the security team working on key management, trust management, and so on. Same thing at at Docker, more cloud infrastructure side. I then moved to Anchorage Digital, which ended up being the first federally chartered digital asset bank in The US. I was taking in a lot of the key management, hardware hardware security modules, and and so on. Same thing at at Meta on the Libra project back when Facebook wanted to launch the the ZugBug. I was kind of taking in a lot of the the the key management infrastructure and and custody. And then I was a chief security officer at a six sixty crypto. Again, a lot of security and then started Bashan started Bashan as regulated stablecoin infrastructure for enterprises. So we serve companies like Sony's... Through Sony Bank, and we're about to announce other very, very large corporates pretty soon that are gonna be launching flagships. They become products on top of fashion. So that is really where we live and and and then my focus. **Drew Rogers** (2:51) That's awesome. Alright. I'm transitioning here over to two step. **Stepan Simkin** (2:56) Quick intro on you, brother. Thanks for having me. It's been... **Drew Rogers** (3:00) I I don't know how how many times I've been here before, but I've always times. I think you you you might have the podium now on on appearances. **Stepan Simkin** (3:09) I mean, I hope it's not the last. Let's see how the debate goes. But, yeah, thanks for having me. Again, as always. Yeah. Actually, I I stopped saying this when doing introductions, but I think now it's it's somewhat relevant. I have a legal background. I did corporate M and A on the sort of legal side for for a couple years before starting Squadz in 2021. We originally focused on building programmable, self custodial financial account infrastructure for Solana. And Squad MultiSig is our flagship product built on top of the protocol. We secure billions in value and move billions of stable coins through our infrastructure every month. And then about a year ago, we started building Altitude, which is also built on our account infrastructure that allows businesses all over the world to get a global operating account and manage their financial operations, connect to different local payment rails, issue corporate cards. I mean, thanks for StableDash being a customer, and we are gonna work with a lot of companies in crypto, but also with businesses across all kinds of verticals that are now using Stablecoins and essentially running their entire financial operational stack on on our infra. It's awesome. Okay. **Drew Rogers** (4:18) So I'm gonna pull up... And we love we love Altitude and and Bastian. I'm gonna pull up the original tweet here, and then maybe maybe frame a little bit. We're talking about... Here's what I know to be true. Like, you both want more adoption. You want more people using these products in a safe way. You want... Like, it seems like we're so aligned, I'm sure, on on many things, but it it seems like there's some key differences in terms of how we think about getting there. Let me pull up step this original retweet from you, and then... Yeah. Let's just frame frame it a little bit. What was the original take here step? **Stepan Simkin** (4:58) Yeah. So actually, this was a cold tweet to Luca's post that was actually commenting on security issue that Rain had with one of their on chain contracts that led to loss of funds. And Luca was basically saying that if we are to bring DeFi, bring stablecoins, and kind of mass adoption to this technology, that essentially all the assets should sit in regulated custody because we can't make this system secure. And I guess, you know, he was pointing to the recent incident with Reign. My response to that was that this is a misguided take, though I'm I'm a huge fan of Luca, and I think he's building something, you know, I'm I'm I'm a big fan of. But I do think that... And I'll I'll kinda summarize my my argument. But first of all, there is different types of on chain infrastructure, and the distinction is very important. Right? You have infrastructure for, you know, custody of assets for money movement for kind of some of the more payment type operations. And then you have much more, you know, complex DFI protocols and, you know, the things that are much more involved from an on chain infrastructure perspective. I think my point is that we are technologists. Right? And when a piece of code or some infrastructure fails, the answer come to be, let's go to, you know, regulated custody and basically start relying on paper promises and, you know, essentially government guarantees in certain sense over, you know, mathematical guarantees that the code provides. That was really kind of the the crux of my argument. I I do think that there is definitely a world for regulated custody, and it it matters, and I think they they kinda connect nicely. And if you look at a lot of the, even, you know, custodians today, they rely on on chain infrastructure. They rely on smart contracts. Right? I think the the really... The argument we're gonna be talking about here is sort of to what extent, you know, custody and regulated custody should penetrate, you know, the crypto ecosystem and where the assets should reside. I guess maybe, Nas, you can frame your **Drew Rogers** (7:00) your your response as well if Yeah. So I'll I'll pull up Nas here. So Nas comes in and and sort of... And I love I love this too. Like, we should do the live debate. I think that's great, and I'm glad that we are. So, Nas, I'll pull you up here. What was your response to this and help us frame a little bit how you you think about this? **Nassim Eddequiouaq** (7:20) Yeah. From from my standpoint, the way I think about it is that non Qsodial, which is really a term that was really invented by us. Right? Like, the regulators are not really defining what Qsodial versus non Qsodial means concretely. Some are. I think it's, in in EU and The UK, we're starting to have just more granular definition there. And we see, you know, key management schemes and cryptographic schemes, etcetera, are gonna... Is all of the time. But non Kusorio does not mean trustless. And I think that the big problem is that it's all the... Painted as such. Right? You still trust wallet developers. You still trust hardware manufacturers. You still trust firmware, small contracts, integrations, operations. You still trust, you know, the the the wallet developer that you use and their AWS credentials and, you know, how they manage all of those things. Right? So that's kinda like one. Second thing is that possessing your access does not mean possessing your keys. It does not guarantee exclusive control over your assets. And I think that you're you're getting a lot of... If you go deep enough in trying to model the trust that you're putting as a as a user into your wallet provider, you essentially get the same trust guarantees with a regulated custodian and with a non custodial solution. Because ultimately, the the the weak points as part of the kill chain, the set of events that need to happen for a security incident to to happen is pretty similar in both cases. Whether you're trying to hack into Coinbase or you're trying to hack into Coinbase Prime or whether you're trying to hack into Altitude, you're probably gonna go for the same the same vectors. **Drew Rogers** (9:23) Yeah. It's interesting how you both you both have sat in the custody and the, like, the application layer too in different ways. Like, Steph, how do you how do you, yeah, how do you respond to this, and how do you think about this both from... I think your perspective is really unique too as you... As you've, you know, started with squads multisig. You have a ton of convictions around custody, but now you're also building the front end with Altitude. How do you think about the the trust models here in terms of the properties that really matter? And at the end the day, when you boil all this down, like, where do you kind of... Where do you end? **Stepan Simkin** (10:00) So let's look at, at least, my understanding of regulated custody. Right? You have a you have a business. You have a company that is getting a license. And, again, custody can be defined through different licenses. You can get, you know, MGLs. You can get a national charter. There's different options that you can go with. And when you get this license, it's a, you know, it's a long and complicated process that requires, you know, a lot of work on behalf of the company. That said though, as far as I understand, when you are getting this license, you're... The the regulator is not actually going into your system and verifying your operational security. Right? They're not actually checking who has access to, you know, AWS, who is maintaining any kind of admin keys, how is key generation happening. Right? None of that is actually happening when you're getting this license. Right? And if you're keeping access with a regulated custodian, there is no disinference, right, applying to to these tokens. What, however, is happening is the systems that are securing your assets are obviously a big. Right? Usually, there's a lot of pooling that happens. Right? Like, when you actually have an account with centralized custodian, there's not like a dedicated wallet that you control through their infrastructure for the most part. It's, you know, there's assets pooled into different wallets, and they can do kind of their own management behind the scenes. So similar to FBO. And the opaqueness of the system is obviously, you know, one of the concerns that I always had, and why I always felt like self custody, as much as it is, you know, it's it's very transparent, and it has kind of pros and cons to to that approach. But when you think about regulated custody, there's no FDIC insurance, so the government is not actually backstopping any losses there. You can get some private insurance, but at least in my experience with centralized custodians, there's always limits to it, and then there's the backstop of the balance sheet of the company. So it does give you some additional guarantees, but those essentially are given to you as a price for the sort of opaqueness of the system, and the fact that you are, at the end of the day, saying, I actually shouldn't worry that much about the operational security of the, you know, provider because they have a license, because I trust them, and we have a, you know, paper agreement that gives me certain, you know, guarantees. In a self custodial system, things are harder. Right? Like, all these... Majority of these protocols are open source. They're out there, particularly now with AI. There's a lot more scrutiny both from, you know, attackers and people who are trying to secure these systems. But I think, naturally, a more transparent system gives me, and I think a lot of the, you know, participants in the industry, a lot more comfort that I understand the logic and essentially the code, right, that governs the security of my assets. And it used to be, by the way, right, that, like, everybody would say, well, it's open source. Go read the code. Nobody ever read the code. Now it's actually much easier to read the code. You can point your clauder GPT at, you know, whatever whatever you're looking to, you know, to scrutinize. And so I think that transparency is is one of the key factors. And then the other thing is a lot of these systems, D5 protocols, right, they're... Once you create a protocol and, like, ship it on chain, it lives there. There's a lot of people contributing to it. There's... It... It's naturally more open. It's kinda global by default. It sort of scales together with the, you know, global nature of the blockchain. And I think it's getting us to a world where we have these kinda lengthy, transparent systems that govern this very core logic that secures our assets, or, you know, allows us to earn yield or whatever it is we're doing in DeFi. And I think nothing stops you from using those systems with custodian behind the scenes. Right? Like, you can create hybrid systems, and there's... It it... But the the point is that it should be open for you as a customer to make your own choices. Right? And I think the transparency here is is absolutely paramount. And so that's kinda where my bias comes from, that I think from a self custodial perspective, it just... It's harder to get to that stage. Right? But we are building... We're we're here to build, you know, open systems that are windy, that are secure. And I think what you see in the market, like, when these kind of hacks and incidents happen, like, it's kind of the same argument that you see right now happening in AI, right? Like, Vincent Phong was just doing this interview with New York Times. And again, like, the Hugging Face incident doesn't... It shouldn't actually mean, at least in my opinion as well, of like, that now we should regulate everybody and kinda stop all development. It means there's a problem. You gotta go and fix the problem. Right? You gotta figure out how did this happen. What about containment? How are you doing evaluation? Same thing happening here. And, you know, you remember how many smart contract we had in the early days of crypto, like, back in '21. They were happening every month. Now, you know, the attackers are, for the most part, moving up the stack. Right? They're trying to go after credentials and compromise different employees. That also tells you something. Right? That, like, the systems are becoming more secure. And in a world where, like, you can use AI to scrutinize them as an attacker as well, I do hope that, like, the period right now that we're going through, like, that one will be bumpy, but we're gonna, you know, come out much, much stronger. **Drew Rogers** (14:51) Fading to the background. I'm gonna let you guys just kinda riff for a little bit. That sounds great. Yeah. I I think that there **Nassim Eddequiouaq** (14:58) are there are to, like, generally, like, two, you know, three subcategories of self custody. There is the... You own your device or there's kind like, some extension that runs only client side within the browser. Then you will have, you know, kind of like a... I would say more like a... The the the and the turnkeys of the world that might be more on the... Of, like, fully back end managed, but... And they have control essentially over the... Ultimately, the key that's, you know, like the EOA's key behind the scenes. But because access to those keys is very secure and enforced cryptographically, then there is kind of like a a case that is made by these companies typically that... It's self custodial. And then you have a third category. And let me know if I'm misrepresenting that, but typically, the third category would be closer to what you guys have been building where you have quite a bit of the logic that is moved on chain for for purpose of trustlessness at this level of whether that's authorization, access, and allowing specific actions to be taken by the the the the the the wallet. And then as part of that, there is still an operational and and some controls that are happening off chain as far as I understand. Right? Like, if Nas, for example, logs in with Google, with his Google accounts to be able to do something on the blockchain, there is still some back end components, right, that receives that kind of approve... That authorization that identifies, authenticates the the the NASA user and then allows something to be, you know, to be unlocked and accessed or or execute some action against the the smart contract. So the smart contract is not... Even in that case, which is, like, you have... You push more logic into this trustless zone, basically. You still have a non negligible amount of logic and operations that live alongside that pure software that lives off chain. And my point is essentially that once you try to attack the company, because the people, because the operations, because the software release process, because the integrations with the vendors that are also API key based and so on are gonna be the weak point. You essentially get the same trust properties in a custodial system versus a non custodial system. And so the the the point that I'm trying to make... And I'm talking even about, like... It might be a little bit harder, but I'm talking even about a phantom. Right? Like, we saw that... I don't know if you guys remember the slow pack, right, a few years back where some... You know, there was essentially a login that was happening on the devices. It was a client side only extension. This was pushing logs into... Which shouldn't have been logged that included credentials that were pushed to a logging server fully off chain and then were resulting essentially in a lot of in a lot of wallet users, self custodial wallet users getting hacked without anything, you know, really being out of... You know, in their control. And so I think that it's important to just realize that when you're building systems that... Where we we we say self custodial, there are two aspects to it. The first one is can I use the system without the self custodial provider operating? So for example, tomorrow, can I still use my money if, like, an altitude or, like, a pretty? Just goes away immediately? Typically, the answer is no. And the second thing is, which is like the other side of of of self custody is him, my provider, take some actions without me being part of the the the process, the request. And I would also say that it is possible with enough software updates, compromises of developers internally to actually get to get to to to that as well, and and we've seen that in the past. So that is kind of like... I'm trying to go a little bit more granular to, you know, expand the different types of self custody options, and that all of them, in my opinion, are, like, fairly weak against the same type of attacks that we're seeing against custody **Stepan Simkin** (19:37) solutions out there. But so let's use the... Let's use Multisig as an example. Right? Like, SPAM Multisig today, you have... There's two programs actually that power depending on which one you wanna use. They're both immutable, so on the on chain level, there's no admin functions. There's nothing. Right? Like, there's nothing we can do or anybody else can do to modify the on chain code. On top of that, you have the main UI that you can go and use. There is alternative interfaces that you can send up. You have a local one. You have UIs that are hosted by other providers. And so in case, you know, something goes wrong, you can always you can always go to another interface. Or if you just prefer to use another one, you can do that. And then there's no kind of back end magic happening behind the scenes. Right? Like, at the end of the day, you can connect with any wallets, and then if you have that wallet, you're gonna be able to... Even, you know, right now, there's, like, certain explorers that give you that functionality. You can go straight to the program and get your funds out. I think in... That... That's just an example of, like, how how Multistig works. I think it really depends on the application. Right? Like, using, you know, traditional, you know, hot wallets as an example. There's different, like, levels to how many things they can actually do. Do they modify transactions? Right? Like, I think we're gonna get to a place where from a regulatory perspective, we'll get the right definitions. Right? What self custody means? I think right now, based on some of the kind of European definitions which probably are more restrictive, we're gonna get some kind of middle ground. I think being able to always, export your keys, access your assets, no matter what's happening with the front end, I think that's gonna be probably the default test we're gonna we're gonna land on. And then there's gonna be a bunch of, like, edges around it, and I'm actually, you know, really excited for us to to get a lot of clarity on what this looks like. None of that was part of the Clarity Act, but I think maybe at some point, we'll we'll get to that stage. I think what you... The way I read your, also like original post that that you replied with, was also just about like, you know, admin functions and and keys, and we've seen a lot of like recent issues happening from a security perspective on chain, right, because of that. I think that is a valid argument, right, that, we we should figure out what is the right, you know, configuration. Some protocols need to retain certain admin functions. Should they be controlled by councils? Should they be controlled by Adrian's? Should they be controlled by DAOs? But I think it's a self correcting system, right, as we have seen. It used to be that every protocol was, you know, upgradable by default. Now we're moving to immutability. Now we're moving to more formal verification. Right? And so I think it is a self correcting system in a way that like there's a lot of pain, you know, on the way there. But I think it's kinda the same argument. Like, do you want to come in and sort of regulate that and figure out... Have people who don't understand probably that deeply how it works, try to figure out, you know, what is the right combination? Or actually, you know, as a market, write self correct to to the right architecture. But I I totally agree with you that there's degrees of self custody. Right? And I think until we have a clear definition of what self custody means, we're gonna go and, you know, test a 100 different models and and see what works. I think from a security perspective though, I agree that in certain cases, you have the same, you know, trust assumptions as you do with, you know, a centralized custodian. But the argument here is that you you have a choice. Right? And, like, it's it's... At the end the day, just like if I'm looking for a bank, right, I I lived through, you know, as as as many of us, like, through 2008, but, like, I actually was, at the time, already started kinda doing things. I was studying, I think, for law at the time, and then as I started working, I was... One of the things I was doing is like opening bank accounts for, like, high net worth individuals in in Europe. And the main concern, number one concern when choosing a bank is like, is it gonna fail? And then can we go and figure out, like, is it the bank that's gonna collapse in a couple years? That the... That memory was still there. So it's... Again, do your own research still applies. Right? And I think from that perspective, I guess I can flip the argument on you as well. It's like, e even if somebody is regulated, even if they have a license, that shouldn't actually mean that nothing's gonna happen. Right? And it's For sure. My point is that, like, in in on chain self custodial systems, you have a lot more to scrutinize. Right? You you actually have a lot more data to act on, because a lot more of it is there. And, you know, I I don't know if I can probably get all the information about, particularly all, like, off chain structures that exist above the smart contract. I assume that's probably part of the argument. But even that, right, I think, you know, if if that's your preference, we we do have a lot of startups in crypto over the years that are doing decentralized front ends, right, that, like, allow you not to ever, you know, rely on any kind of blockchain infra. **Nassim Eddequiouaq** (24:01) Yeah. Is... So if... And and and you mentioned that the, you know, the the the trust the trust properties and kinda like the the the security properties that that you get are very oftentimes similar. Don't you want to be able to on... Be able to legally blame someone else for for that if that is the case and that something fails with that counterparty? Don't you feel like it is a good thing generally for the consumers of that application, software, etcetera, to be able to blame and hold someone else liable for for it? I think **Stepan Simkin** (24:40) I wouldn't trade that for having an autonomous, immutable, decentralized system that is allowing me to do all these things in a way that's permissionless. And I think if we have this like Did you just said the import? **Nassim Eddequiouaq** (24:54) Sorry to to cut you off. But but you just said that the the trust properties are the... Can oftentimes be the same because you're still gonna be producing software. You're still gonna be running certain admin functions. Obviously, like, you you you can have immutability over some of the software, but this software might have some security vulnerability in it. And so... Which we've seen recently in the... Kinda like the the the the thing that sparked this actual debate is the fact that you need to be able to move from one insecure smart contract to another one if that smart contract is is is unsafe. Right? And so that still means that as a client, for example, of you guys, I would still need to trust you guys to tell me, okay. I need to move to the next contract, and this is how we're gonna do it. And we're gonna be moving our data, our users in in in that fashion. **Stepan Simkin** (25:48) Isn't that correct? Or do I miss something? You mean, so we we we... If we were in this situation, we'd have to facilitate the migration to, like, a safer system? Okay. And then that puts the trust in in us as a provider, and so it's the same argument... It's the same model essentially as doing a centralized custody. Is that what you're saying? **Nassim Eddequiouaq** (26:07) Or, like, to to move essentially to any other system that is considered more safe. Right? That, like, you guys have been building, that you're operating, that you're auditing, and, you know, it it... There is nothing to do on that on that contract because it is fully immutable. My point is that you're still authenticating me as a business. Right? You're still validating my identity. You're still **Stepan Simkin** (26:33) routing certain things under certain conditions. Isn't that Not in the multi sect context. Right? Not not in the multi sect context. In the multi sect context, we don't know who you are. You come in to a front end, you sign in with a wallet, and then it's it's the same argument as applies to all the DeFi protocols, right? Like, I can use Camino by connecting my wallet and... Or Aave, right? That's that's the value prop of these systems. And I think there's still, you know, a lot of them are now at a place where they're getting to, you know, formally verify a lot of parts of their code. And Mhmm. I think with AI, we we can get to a plausible future where not just on chain code will be formally verified. Right? Like, if all the code is generated by AI, then we can generate it formally verified with proofs from the start. Right? Like I think that's a that's a viable option. I'm just kind of... I'm weary of saying, let's go to sort of a traditional structure where somebody, you know, I I essentially have a contract with someone, and I can sue them in court because it doesn't prevent failure. Right? It just gives you certain recourse. But again, as we discussed before, and like even when people talk about bank... The banking system, right? If it's not government backed, the the trust the trust and kind of anything else is is pretty small unless, you know, we're talking about like very large companies. And so I would say having recourse is a nice short term advantage. But if that's the price we're paying for not having systems where we we're not gonna need to to go to court, right, then like, I I think that probably is too high of a price to pay. And that that's the point I was making in the the quote tweet, right, that like, we should improve these systems and not give up on them and say, okay, let's just go back to the same stuff. But like banking with tokens, let's improve the infrastructure so we we don't need to. Because naturally, that just gives, you know, the industry a lot more room to to do incredible things as it was there. **Nassim Eddequiouaq** (28:23) Yeah. And to be clear, the... Very valid point. And and to be clear, I'm not saying that the and, you know, I've I've I've been working on the the key management and, like, a for for a long time now. I do think that it is important for the entire industry to keep progressing on building more features and more features and more features. Right? Like, as a custodian, my goal is to make sure that if Lazarus, some North Korean hacker or or state sponsored group gains access to, you know, high level employees at the the company, they're still not able to move any fund. Right? That that is what a secure system is, is when you can literally, as part of your audit, hand over a laptop that is logged in on all of your systems, AWS and so on, And the the the attackers, the bad actors cannot move your funds. Because ultimately, phishing is gonna be what Lazarus and others are gonna go for. This is how they hack all the, you know, custodial or non custodial systems. And so I do think that... So my point was really that if you're gonna get this trust properties, you may as well hold someone else liable, whether it's the the... You know, you're producing a a small contract or or something else. Part of the the regulations is also understanding where the liability lies and where it doesn't. Right? What are the roles and responsibilities? What happens in certain cases? You do need to get some insurance. When you get insurance, obviously, the regulators are not reviewing the security of your systems. Insurers do. Right? And you kind of get this transitive property of if you have a license, that means that you have insurance. If you have insurance, that means that someone actually looked at, you know, pretty deeply at your different audits and security properties and so on. So I think that it's kind of like this transitive property that you get by having a license. There are a lot of boxes that need to be checked, which is not necessarily the case when you're... Whenever you're building something that you see as solely software. And then if you're kind of like... There are levels to licenses. Right? You have money transmitter licenses, then you have trust trust bank charter and and so on. So we just obtained our OCC conditional approval for for for an OCC trust bank. And part of the the the properties that clients get with that is assets are fully segregated. We, as a business, are required to hold a pretty high amount of money aside from everything else that gets audited in case of wind down, in case of any issue with the business so that we can still continue running the business all the way to winding down. And all of the assets that we hold for our clients are our clients only, and we have fiduciary duty, which means that if we don't act in their best interest, we are actually legally liable. And so I think that those properties are... The world is defined by incentives. Right? If my... If the incentive is that I... If I don't perform well in the interest of my clients and I don't safe keep their assets, I go to jail. Right? If I do... If I protect them well, then I actually can build a great business. And because we have the right incentives, then the outcomes will be much more likely. Right? And I think that if there is no disincentivization of, you know, not really securing the r... Your operations, your software, and and running in a specific way, then you you might run into bad outcomes. So I see those regulations as a way to incentivize the right behaviors and increase the likelihood of the of the preferred outcomes. **Stepan Simkin** (32:26) I think that's a great point from an incentive perspective. Right? And like, I think when we think about, you know, whether it's multisig or or how we're building Altitude. Right? And we've been kind of in the security space. Naturally, if you're building, you know, infrastructure like ours, you're you're both, you know, a security company and and whatever else. And I think for our from our perspective, like, we... It was a big realization at some point, you know, just maybe a year, year and a half into building the company that in crypto, the the understanding was, like, let's secure our own chain systems and that's, you know, the job is done. We really quickly started moving up the stack, and, you know, when we talked to larger customers that we onboard, the level of scrutiny that they give us, right, in terms of us giving them guarantees, in terms of our security posture, and, you know, how our looks like. And it's our job to, first of all, do everything internally to adhere to, you know, the standards that you're talking about, and then also give our customers the tools to be secure. Right? Because I think right now we're getting to a world where just you having the liability and doing everything right on your side is becoming not enough. Right? I think there's so many opportunities for, you know, an attacker, even if everything in, you know, from the provider went right. There's still so many ways that the customer can still make a lot of mistakes. And I think that's also like how we always thought about, you know, that being our job as well. But like we should help our customers be more secure and give them the tools to do that. And so I think the incentives... Like our incentives are not they're coming from a more positive place. Right? Like, we actually want to serve our customers. We want to serve them well, and that's why we're, you know, we're we're going in that direction. But Same. By the way. Sorry sorry for the... For for flipping it. But that that's really... That that's really how how how how we think about it. And I I think both both are really valid. Right? And, like, it's just it's just a question of when when when you're onboarding a customer, right, like, you you you always want to make sure that you give them the best possible service. But from a security perspective, you also want to make sure that they really understand the system they're interacting with, and they're kind of not hand waving it because, oh, well, those guys are regulated. Like, we we had a bunch of, you know, issues in fintech that had nothing to do with crypto. Right? Where, like, you know, there's ledgering issues and, you know, middle layer... Middleware fintechs losing, you know, track of who actually owns what. And then, you know, people are still in litigation with with sign ups. Right? So 100%. I think those are all at the end of day, what what what I think we're talking about here is that, you know, have... Saying your protocol is audited, or saying that I have a license doesn't actually, you know, act as a substitute for the work. Right? And it's a constant process, which which needs to constantly evolve. And incentives can be, you know, different, or or they can be aligned. But the result is that we should have, you know, more secure, robust systems that help us do all these amazing things that we wanna do on chain. **Nassim Eddequiouaq** (35:18) Yeah. And something that is actually... It has been interesting in the, like, in the history of of self custody is that certain things have really been pushed through self custody first, essentially, as as ways to, let's say, reduce the control that the service provider has over the assets. I'm gonna give you a very simple example. MCP. Right? Like, MCP. Sorry. I think about AI too often. MPC. Fireblocks essentially pushing pretty hard on the the MPC side of things. And especially in 2019 and 2020, really, were doing a lot of iterations on their protocols and and really enabled things that I think the the custodial side really benefited a lot from. Right? There are a lot more companies that are custodial behind the scenes may have moved certain aspects that were more just quorum based to MPC based solutions because in certain cases, it actually enabled them to put less trust into their own system, more trust into the the cryptography of of it. And so I do think that we're all, obviously, together technologists and and and really pushing to build just the best systems and more secure systems, whether it's on the operational side, software, algorithms, cryptographic schemes. But, ultimately, I think that my point is that you put a lot of trust into a counterparty, and you should have people and and and entities that ensure that this this counterpart... This counterparty has to follow certain rules that ensure more and more safety over time and keep improving. And especially one thing that I wanted to add is that, especially as we're... The worst security is the the security that no one uses because it's it's it has too much friction. Like, we all know that. And our goal, I think, as an industry has been to, one, making things secure, but second, obstructing away the complexity of blockchains. And you do so by not showing the blockchain, trying to hide more of the the the wallets and the the seed phrases and so on. And by doing so, you're adding layers one by one of abstraction from the actual underlying cryptographically guaranteed security mechanisms. Right? Like, I can give you... I can just, like, give you a signed transaction that you're gonna post on chain. You know? I don't need to trust you. I just need you to trust you to to submit it. Right? And then there is, like, me actually signing one thing, and then you take that, and then you unlock another signature with it or another key with it. Now you have an intermediary. And you you can add more things once you start adding social sign in and and so on. And my point is, as we add those levels of abstraction between my grandmother and the actual cryptography and the the smart contract, you add layers of counterparty risk to that. And anyone in the middle will actually be able to perform certain actions on behalf of whoever is above them. And that is just like a nature of those systems. Even if you want to have one system that is cryptographically secure with the next one, you're still gonna have essentially every layer of obstruction introduced risk. And this is why I'm saying that the the trust properties are essentially the same regardless of the the the model. And so you may as well want to push more regulations onto onto all parties, basically. **Drew Rogers** (39:18) I'm hopping I'm hopping back in here. Hello again. One, this has been really fun, and I appreciate both of you... Y'all's opinions here. Just in terms of bringing this and both of these perspectives into today's news, I don't know if you guys have seen this, but Pay's bridge contract on Ethereum was exploited. I'm wondering just like this just happened. Would love any thoughts if either of you have, like, perspectives on either of the opinions you shared, like how it comes to fold or how how we should think about something like this. And then we can... Maybe each of you can can close with a final statement, and we can wrap. Maybe, Nas, if you wanna go first. **Nassim Eddequiouaq** (39:59) Yeah. Actually, I actually don't know how PayLink advertises themselves when it comes to CASI versus self CASI. Do guys know if they're regulated? I'm trying to I'm not sure. I'm not sure. I'm pretty sure. Okay. So But maybe Yeah. And I think that that's kind of like an example of something that I was about to say. You want to obstruct away the complexity of moving from one chain to the next. Right? You want your USDC to work across chain seamlessly. Then that means that there's gonna be a bridge behind the scenes that need to to to do that. We're not gonna ask NAS or NAS's mother or grandmother to know about that bridge to actually perform the multiple transactions, which means that pay is responsible for one building that bridge, operating it, simplifying transactions across the bridge, which probably is gonna require two or three of them typically to be able... For money to to move seamlessly across networks. And as a result, that's a counterparty that is kind of like in the flow of funds in a sense. Right? And so you probably want to make sure that this party... And that being in the flow of fund has a lot of different definition as you, Siban. But, like, my my my point is that actions that PayLink is taking do impact the flow of funds. Right? Operations, people building certain software, pushing new updates. And so this is probably why you want to have just more guarantees on what a pay link would would be doing. And so that is that is my point. I hate... My goal is not to just, you know, push on people that are already having a bad day. My my goal is just to kinda, like, make my point. I want everyone to be secure. I want no hack whatsoever. Whenever there's a hack, we all lose. That's that's kinda like the that is at the very top of the pyramid. But my point is that because you're building this infrastructure that obstructs away the complexity, you are essentially introducing counterparty risk, and so you should be liable for certain things that that you do and that you're responsible for. Alright. So bring us bring us home here. **Stepan Simkin** (42:07) First of all, very unfortunate. Really like that team. I think they're doing some really interesting work. So I hope there's some there's some swift resolution there. I would say if if pay was regulated, that would not have prevented this from happening. Right? If they had a bunch of licenses, still, you know, a bug in a smart contract is a bug in a smart contract. Right? And we don't know exactly, you know, what happened in in this case. But I guess the the point I'm I'm I'm always, you know, trying to make is that we should just build better systems. Right? And at the end of the day, if you're regulated, nobody's gonna oversee, you know, your OPSEC and and help you be more secure. Only you and your team have to go and figure out how to build systems that scale, how to build systems that are secure. And I think, you know, hacks are are gonna continue happening. Right? But every time they happen, we learn something, and we improve the systems. And I think it's very important that, you know, we're able to continue doing that. And I think regulation, if it's kinda thoughtful and targeted, if it provides kinda the right guarantees, it can be helpful. But at the same time, I... Again, I can't fully comment specifically on pay, but there's a lot of transparency in... Like, the customer. Like, what what is the what is the service that you're using? Is it custodial? Is it self custodial? That usually is stated, you know, directly. And, you know, customers are making making choices whether they want to use the system or another. Right? Like nobody, you know, forced to use the customers to use pay. Right? They they want and and want you to interact with that system. And there... You know, I think there's definitely conversation to be had in terms of how we design, you know, OPSEC structures around smart contracts. How we design OPSEC structures above the smart contract. I think those are really healthy conversations, and I think having standards is really important. But actually, if you think about, like, the five... The last five years of crypto, we we are self regulating. We're developing a lot of these standards, and we're improving over time. Right? And I think it's very important to keep doing that. And having, you know... And and I think it's a it's a free market. Right? Like, if you want to provide similar services with with a license and being eco styled, then if you think that allows you to give better guarantees to the customers and ultimately get more customers, that is a great strategy. And, you know, congrats to you guys for for getting the charter. I think it's an incredible, you know, achievement, and I'm I'm I'm really rooting for you to do incredible things. But I do believe that both systems need to, you know, exist side by side. Because there's trade offs in in in all approaches. Right? Licensing and regulation places certain limits that have nothing to do with security, but actually have a lot to do with how you're gonna build the product, how you're gonna run the company. So I think finding that balance is is the most important thing. And I think once we get more regulatory clarity on what this, you know, self custody versus custody means, I think we'll be able to, you know, operate within the bounds of that. Until then, I think it's our responsibility to just keep improving the technology, right, and keep building better systems. Beautiful. **Drew Rogers** (45:17) It is interesting how we try to kind of combine regulatory realities and security realities, and we kind of think... Sometimes, it's like, oh, we are regulated or we are licensed in this way. When in reality, like, the the product and the security and the things that happen under the hood, it sounds like you guys definitely agree, like, getting more regulated doesn't actually solve a lot of these things. You have to... You know, both both have their unique places. So, guys, thank you for this. This was fun. It's such a... It's it's funny. Nas, I think we were in a Uber one time, and we were... I think you were on the way to a debate or something at breakpoint when you're... Some some conference, and you were preparing for it. And I I think it was about custody or something. And it was interesting because at these events, you really don't have enough time, or you you always are, like, kinda fighting for sound bites and stuff. So Yeah. Thank you guys for pushing for this, for thinking of us. We'd love to have you back. And for anyone listening to continue to have more of these, like, candid industry focused debates, I think having these perspectives is so valuable. So thank you guys for what you're building and for contributing your knowledge here. We'll try to actually take both of these perspectives and put them into, like, a a single place. I don't know what that form will be. Maybe like a very simple article or Twitter thread or something. But thank you, guys. This was fun. Thank you. **Nassim Eddequiouaq** (46:41) It's a while since then. Alright. **Stepan Simkin** (46:43) Cheers. Thanks.