Suddenly, cryptocurrency custody is a hot topic. The developers of new custodial services argue that better safekeeping strategies will help entice institutional investors into digital assets. But why pay 1-2 percent a year for something that can in theory be done for free?
Private keys are free—but don’t disclose them
Cryptocurrency custody starts with a private key: a string of letters and numerals representing a unique claim to ownership.
A bitcoin private key, for example, can be represented as 64 characters selected from the numerals 0-9 and the letters A-F (this counting system is referred to as ‘hexadecimal’, since it gives you 16 choices).
A sample bitcoin private key
E9 87 3D 79 C6 D8 7D C0 FB 6A 57 78 63 33 89 F4 45 32 13 30 3D A6 1F 20 BD 67 FC 23 3A A3 32 62
The private key to a cryptocurrency doesn’t cost anything to generate, though there are some best practices to follow if you wish to do so yourself.
Yet the private key has huge value, since it confers ownership: if you disclose your private key, your cryptocurrency is likely to be lost.
In 2013, a Bloomberg TV host gave two colleagues $20 of bitcoin each on live television, using a paper gift certificate. One colleague opened up the certificate, inadvertently disclosing the private key to the cameras. The bitcoin was immediately stolen by a viewer.
While this theft was arguably educational (the hacker returned the stolen bitcoin in exchange for Bloomberg agreeing to run a segment on cryptocurrency security), other security breaches have been far more damaging.
Common themes running through exchange hacks have been a single point of failure, poor security and inadequate processes.
Many early users of cryptocurrencies have entrusted exchanges with their private keys out of ignorance, for the sake of convenience or to make trading easier, and have suffered serious losses when the exchanges’ systems were compromised.
In the Mt. Gox hack of 2014, 740,000 bitcoins (or 6% of all bitcoin in existence at the time, now worth about $5bn) were stolen. In January 2018, hackers made off with around $500m in digital tokens from Japanese cryptocurrency exchange Coincheck.
At least $15bn in cryptocurrencies have been stolen from exchanges or other central storage venues since 2013, according to one estimate.
Common themes running through these hacks have been a single point of failure (the exchanges’ databases, where private keys were held), poor security and inadequate processes. An institutional investor considering an investment in cryptocurrency would almost certainly shy away from exposure to such risks. So what can be done to improve things?
Splitting access and setting processes
One way of keeping private keys secure is to ensure that they are stored offline. This could mean printing them on paper, etching them on metal or using a specialised USB wallet like a Ledger or a Trezor.
Another option is to split private keys into two or more components (or ‘shards’), to be stored separately. The Winklevoss twins, former partners, then adversaries of Facebook boss Mark Zuckerberg and owners of the Gemini cryptocurrency exchange, have followed this option when safeguarding their bitcoin holdings.
The twins told the New York Times in December that they have cut up printouts of their private keys and distributed the shards in envelopes to safe deposit boxes around the country. This security step means that if one envelope were stolen the thief would not have the entire key and would therefore not be able to unlock their bitcoin vault.
A similar approach—ensuring that access to a cryptocurrency holding requires the agreement of multiple parties—underlies the more advanced custodial models.
“We view multi-signature as a foundational level of security”
In a security protocol called ‘multi-signature’, multiple private keys are required to sign a cryptocurrency transaction: for example, a bitcoin address may require a specific combination of private keys (for example 3 out of 5 keys, or 5 out of 7) to be entered before the coins are released.
Cryptocurrency custodian Xapo, which reportedly holds around 7 percent of the global supply of bitcoin on behalf of clients, uses such a 3-of-5 protocol. The respective private keys are held on devices ‘air-gapped’ from the internet, which are stored in underground vaults on five continents.
Other providers of institutional cryptocurrency custody emphasise the importance of ensuring shared but separate access to private keys.
“We view multi-signature as a foundational level of security. We currently support seven coins, all multi-signature,” Tracy Olsen, head of product at blockchain software company BitGo, told New Money Review.
On its website, BitGo says it offers custody services for bitcoin, bitcoin cash, bitcoin gold, ethereum, litecoin, ripple and Royal Mint Gold.
‘Never roll your own crypto’
However, according to one bitcoin expert and software developer, there’s a difference between cryptocurrencies which have a multi-signature option written into the underlying software protocol—as with bitcoin—and those where a requirement for multi-signature access is written into a smart contract on top of the protocol.
“Even if you’re doing physical security correctly, it’s easy to screw up the smart contracts,” says Jameson Lopp, infrastructure engineer at Casa, a start-up firm developing cryptocurrency wallets for smaller institutions and high net worth individuals. Lopp is a former employee of BitGo.
“There’s an old saying in cryptography and cryptocurrencies: ‘Never roll your own crypto’,” says Lopp.
“Writing smart contracts for the purpose of security is the same as rolling your own crypto. It’s hard to get strong security guarantees.”
And what about cryptocurrencies without a multi-signature feature and without their own smart contracting language?
“You can still hold these currencies using a single-signature custodial solution. For example, you can add other things like Shamir signatures to split up access to the key,” says Lopp.
“We are evaluating currencies which do not have multi-signature technology built into them,” says BitGo’s Olsen. “There are ways you can still ensure security for those chains.”
Olsen makes it clear that the research undertaken by her firm into the security features of different cryptocurrencies comes at a cost.
“Every blockchain is different. There are frequent forks, for example. We have an entire team of folks looking at current blockchains and those we should be supporting. Once we have that model, we apply a single process on top,” she told New Money Review.
The economics of cryptocurrency custody
Even taking such complexities into account, cryptocurrency custody may come across as eye-wateringly expensive for those used to the custody of traditional assets.
BNY Mellon, one of the largest traditional custodians of financial assets, may charge as little as 1 basis point (0.01%) per year for holding clients’ equities or bonds. But the annual cost of safekeeping bitcoin and other cryptocurrencies is more than a hundred times higher.
Coinbase, for example, charges a set-up fee of $100,000, plus 1.2 percent a year, for a minimum account size of $10m.
The high costs reflect a lack of competition in a market racing to develop institutional-quality services.
“The trajectory for digital asset custody costs is lower.”
“The digital assets market has had a hard time keeping up with the value increases in the system. It’s one thing to custody $3bn of digital assets, like in 2015. Then, it was reasonable to have paper wallets,” says Danny Masters, Co-Principal and Chief Investment Officer at cryptocurrency fund Global Advisors.
“It’s another matter when you had $1trn in assets, like at the end of 2017,” Masters told New Money Review.
Global Advisors announced in May it was teaming up with investment bank Nomura and hardware wallet provider Ledger to develop institutional custody services in the digital assets market.
Masters expects cryptocurrency custody rates to fall, but takes the precious metals market, rather than the markets for equities and bonds, as a benchmark.
“In a mature market like gold, where custody arguably has higher inherent costs, the rate is around 15bp a year,” says Masters.
“I’m not sure how quickly we’ll see digital asset custody costs fall, but the trajectory is lower.”
However, explains Masters, the benefits of improving safekeeping services reach beyond headline fees.
“All digital assets currently sum to around $350bn,” Masters told New Money Review.
“So if everyone paid 1% today for custody, that’s $3.5bn in fees. But a lot of people don’t custody their assets, while some digital assets can’t be held in custody. So the total market revenues are smaller.”
“What’s more important to us is that the lack of a credible custody solution is inhibiting larger investors from participating in the market. Helping correct that has much broader positive implications for our digital asset management business.”
