Crypto Custody Stocks in Focus as Hardware Wallet Owners Look for an Exit
"People have spent years building their wallet setups. Asking them to move every asset and relearn everything is a real barrier," Zach Herbert, Foundation's cofounder and chief executive, said in the company's announcement. "Legacy Mode lets them keep what they've built and put it on an open source foundation."
"We reimplemented the interfaces that Ledger's open source apps use to talk to BOLOS, its operating system," said Ken Carpenter, Foundation's cofounder and chief technology officer. "That includes cryptographic operations, screen rendering, and USB communication. We can compile the existing app code for Passport and run it on KeyOS, without running Ledger's proprietary operating system."
Foundation says it is not affiliated with Ledger. Ledger stopped selling the Nano S in 2022 and said last year updates would end, since its 320 KB of memory leaves "very little room for anything else," chief technology officer Charles Guillemet told The Block.
Then Coldcard. A firmware flaw shipped in March 2021 left seed phrases guessable. More than $116 million has been drained.
"This bug was sitting out there for five years. So everyone missed it," Tanguma said in an interview in August. "There's a single point of failure whether it's Coinbase or yourself."
Coinbase: the default custodian
Coinbase @COIN holds the coins for 9 of the 11 US spot bitcoin ETFs, about $74 billion, according to Crypto Briefing.
That concentration is the bear case. "If you centralize an asset that's supposed to be decentralized, you will effectively kneecap it," Tanguma said.
BlackRock: the ETF exit
US spot bitcoin ETFs took in about $620 million in the sessions after the exploit, most of it into BlackRock's iShares Bitcoin Trust (IBIT) , cryptonews reported. BlackRock (BLK) collects the fee.
"TradFi doesn't seem so lame now after all does it?" Bloomberg Intelligence ETF analyst Eric Balchunas posted. He would not pin the flows on the hack, though. "I'm not saying it's connected, we just don't know," he said. "Long-term I can't imagine there aren't some who migrate over."
BitGo: split the keys
BitGo @BTGO priced its IPO at $18 in January and closed at $7.97 on September 24, per StockAnalysis. In August it bought NYDIG's institutional trading business for $42.5 million plus an earnout.
BitGo is one of the regulated key holders in Onramp's vaults. "Why would you trust one custodian versus three? It's pretty straightforward. We're just so early. That's why people don't do it yet," Tanguma said.
STMicroelectronics: the chip inside
Ledger's Nano X keeps keys on an ST33 secure element from STMicroelectronics (STM) , per Ledger. Immaterial to the chipmaker's results.
"Every hardware vendor is fallible. If you want to hedge against vendor risks and supply chain risks, the solution is multi-vendor multisig," Casa co-founder Jameson Lopp posted after the hack.
"Self custody has a much better track record than third parties," early Bitcoin Core developer Peter Todd posted, defending the practice.
Where the money goes
- (COIN) : ETF custody, ~$74 billion.
- (BLK) / (IBIT) : ETF fees, most of the post-hack inflows.
- (BTGO) : multi-institution key holder, below IPO price.
- (STM) : secure elements, small.
- Private: Foundation, Ledger, Coinkite, Casa, Unchained, Onramp.
The bottom line
"What's a bit unfortunate about it is that attackers understood that before infrastructure teams and before security teams," Ido Sofer, founder of key-management firm Sodot, said on the On The Margin podcast.
"The market has to level up because the game is changed and how people manage this asset in 2012 is how they do it today, and it fundamentally won't work," Tanguma said.