This week, someone stole 1,367 Bitcoin, roughly $89 million, across 4,585 addresses.

Every victim owned a Coldcard, a hardware wallet marketed for people who take self-custody seriously. Offline devices with keys that were never shared. Nobody clicked the wrong link or entered passwords into the wrong form.

All their security procedures worked. Their Bitcoin is gone anyway.

It was something far simpler than a tampered device. One character in a line of code written in March 2021 sent wallet creation to the wrong random number generator. Every seed made on that firmware was guessable from the moment it existed.

So how did it happen?

2. The Lock

Unbreakable Codes

The Enigma machine was used by the Nazis in WWII to encrypt their military communications and was thought to be unbreakable as it had about 159 quintillion possible settings.

The machines were used until the end of the war and the number of settings never changed. What cracked it was Bletchley Park, Britain's wartime codebreaking centre, narrowing down how many of those settings were ever actually reachable.1

What Protects a Bitcoin Wallet

Every Bitcoin wallet begins with one random number, called the seed. Your twelve or twenty-four words are that number written down so you can copy it onto paper.

Every private key you own is then calculated from it. So the seed is not a key. It is the thing that stamps every key you will ever have.

The formula that does the stamping is a published standard, which means an attacker can run it too. There is no password to get wrong, no limit on attempts and they never have to touch your device. They can generate candidate numbers on their own computer and check each one against the public blockchain to see whether it produced an address holding money.

Bitcoin wallets aren’t like a safe. The coins are not inside the device. They sit on a public network that hands them to whoever presents the right number, from anywhere in the world.

So a Coldcard is not a vault holding your money. Coldcard is a vault holding a copy of the combination. Everything it does protects that copy:

• The PIN and the secure chips stop someone using the device

• The air gap stops anything reaching it over a network

• The tamper protection stops someone opening it up to read the number out

Even when all of it works, none of these controls stops someone calculating the same number on their own computer and spending your Bitcoin before you notice.

Narrowing Combinations

A seed is supposed to have 2^128 possible values. Written out, that is a number with 39 digits.

Because of the way Coldcard generated them, Coinkite, the Canadian company that makes the device, now estimates the real figure at around a trillion on the older models.2

That may be a generous estimate. Block, who analysed the same code separately, arrived at a similar ceiling but think the true number could be far smaller, possibly as low as eighty thousand.

Either way the attack was the same. After figuring this out and narrowing the list down, the attacker was then able to cycle through the combinations until they found wallets worth stealing from. That is the whole attack. Nothing was broken into. The number was just far easier to guess than anyone believed.

Which raises the obvious question. Coldcard is built for exactly this problem, and it contains dedicated hardware to solve it. So why were its numbers guessable?

Subscribe now

3. The Wrong Door

Unpredictable numbers are hard to produce with software. A computer following instructions does the same thing every time, so anything it calls random is really a formula dressed up to look unpredictable.

So serious hardware wallets contain a dedicated chip that makes them from physical noise. Voltage jitter, heat, things that cannot be predicted or replayed.

Coldcard has the noise circuit. Coinkite wrote their own code to read it.

But for five years, seed generation never called it.3

The one character that did it

Coldcard’s build settings contain this line:

The zero tells MicroPython, the software Coldcard runs on, to stay out of the way, because Coinkite is handling randomness themselves.

The crypto library then checked that a hardware generator was available

#ifndef asks whether a setting exists. It does not ask whether it is switched on.

The setting existed, set to zero. The check passed. The library wired itself to MicroPython, and MicroPython, seeing that zero, had already built its software backup instead of the hardware path.

Think of it like this:

• A safety inspector checks that a fire alarm is listed in the building’s documents. It is. Tick.

• Nobody checks whether the alarm has a battery in it.

The paperwork is perfect. The building still burns down.

What it fell back to

MicroPython’s backup is called Yasmarang. It is a small, fast generator of the kind you use to shuffle cards in a game. It starts once, from three ingredients, and then never takes in anything new:

• The serial number stamped into the processor at the factory

• A countdown timer that resets every millisecond

• Two clock registers holding the time and the fraction of a second

Every number it produces after that is a fixed step from that starting point.

None of those three are secret. The serial number is factory metadata, and part of it appears in the device’s USB identifier. The countdown timer has at most 80,000 possible values on the Mk2 and Mk3, and 120,000 on the newer models. And on the Mk2 and Mk3 the clock is switched off at startup, which strongly suggests those two registers were sitting at zero.

That is where the trillion comes from. A trillion still sounds like a lot. But nowadays, a computer can get through a trillion candidate seeds in days.

There was a safeguard for exactly this. The output was combined with a second generator, so that if one turned out to be weak the other would cover it. That second generator started from three numbers written in plain text in the public source code: 0x0a8ce26f, 69, 233.

Combining sources only helps if at least one of them is genuinely unpredictable. Here, two predictable streams combined give you one predictable stream.

The fault shipped in v4.0.0 on 17 March 2021 and sat there for five years before it was noticed.

4. The Sweep

Finding the victims was easy.

Bitcoin addresses are public, and the broken generator produced a recognisable family of them. Candidate seeds could be rebuilt offline, turned into addresses, and checked against the ledger from a laptop.

By 30 July the attacker had a list. It was sorted by balance, largest first.

At around 1am UTC on a Thursday, thousands of people had Bitcoin sitting in wallets they had every reason to trust. Most of them were asleep.

Thats when the attacker struck.

The biggest loss came in the opening minutes, about $1.8 million from one wallet. Chainalysis found roughly $30 million was gone inside ten. The people with the most to lose had the least warning, because the attacker had studied the population before starting and worked down from the top.

Every transaction paid the same fee, exactly 30.0 sat/vB, against a median of under 1 sat/vB that week. Identical fees a thousand times is also the signature of a preloaded script rather than a person at a keyboard.

Forty-one minutes later it stopped. By the time anyone worked out what they were looking at, it was over.

Two more waves followed over the next two days. Galaxy Research mapped all three and says each wave was internally one operator. Wave three averaged 0.1 Bitcoin per victim, which suggests the profitable end of the key space has already been picked over.

Stats

• Wave one: 1,082.65 BTC from 1,196 addresses, about $70.2 million

• Duration: 41 minutes, blocks 960,183 to 960,191

• Gone in the first 10 minutes: roughly $30 million

• All three waves to date: 1,367 BTC from 4,585 addresses, about $89 million

• Time before Coldcard’s public warning: ~30 hours

  Thanks for reading Risk Frontiers! Subscribe for free to receive new posts and support my work.

5. The Parts That Cannot Be Fixed

Every protection on the physical device did its job on 30 July. Nobody guessed a PIN and nothing was tampered with.

It made no difference. That leaves two problems that a better device can’t fix.

1. Nothing Can Block a Valid Signed Transaction

All 1,196 transfers were correctly formed and signed. As far as the Bitcoin network was concerned, the attacker was the owner.

Transaction policies and other approval workflows all sit between you and your own keys. None of them sit between a stranger and a copy of your key.

2. A Patch Cannot Undo It

Coinkite shipped corrected firmware within a day. It protects every seed made from that point on and repairs none of the ones already in the world.

You cannot un-know a number. Update the device and restore the same words, or move them into any other wallet, and the weakness travels with them. The only fix is a new seed and moving every Bitcoin across to it.

Which means the version on your device today tells you nothing. What matters is the firmware that was running on the day the seed was made. So you could have followed every rule on the list, bought what was marketed as the most careful device on the market, and still lost everything.

6. Conclusion

Three Times in Twelve Months

We have now watched this happen three times in twelve months. Coldcard, Coinspect’s Ill Bloom in July, and LuBian before them, where a mining pool’s keys came from a Unix timestamp and $3.5 billion vanished in two hours.

It’s the same sequence. A flaw sits quietly in the codebase for years while everyone using it feels safe. Someone patient maps it. Then it executes at machine speed, all at once, before anyone can convene a meeting.

If your defence stops working the moment the key is compromised, it’s not truly defence in depth. So the next layer cannot be another lock. It has to be the ability to react.

The Window Nobody Used

A Bitcoin transaction is not final the moment it is broadcast. It sits in the mempool, the queue of pending transactions, waiting for a miner to pick it up. On average that takes about ten minutes.

Which means the Bitcoin is not gone yet. In that window the owner can broadcast a competing transaction, spending the same coins to a safe address, and attach a higher fee. Miners chase the better fee, so the owner can win.

The attacker knew this. It is why every sweep paid 30.0 sat/vB against a median of under 1. They were trying to buy a place at the front of the queue before anyone could outbid them.

None of the funds were saved, because saving it meant a human spotting the anomaly at 1am, understanding it, believing it, locating their hardware wallet and getting a higher-fee transaction broadcast before the next block.

Ten minutes is enough time to win that race. It is nowhere near enough time to notice you are in one.

Thats where Circuit fits in.

Circuit holds pre-approved, pre-signed transactions ready to move funds to safety the moment keys are compromised. It monitors mempool transactions to spot anomalous activity and save funds without needing a human in the loop. It cannot stop your key being worked out. It can let your transaction be the one that reaches the miners first.

Circuit is backed by Lloyd’s of London and recognised by 10+ major insurers as an enterprise risk control that reduces premiums. If you are thinking about how to protect digital assets against key compromise, we’re here to talk.

Final Thought

Germany investigated Enigma more than once and concluded each time that the machine was sound. They were looking for a symptom, and a broken cipher does not produce one. It encrypts just as fast and the letters come out just as scrambled.

Coldcard’s owners had the same evidence for five years, everything seemingly working correctly. It also handed out a guessable number every time somebody set up a new wallet.

Working perfectly was never proof of anything.

Why did nobody found it sooner?

The code was public on GitHub the entire time. Anyone could have read it and exploited it before now.

Coinkite’s CEO Rodolfo Novak thinks someone finally pointed AI at it. His advice to other developers: “If your firmware is open-source or has ever been public, assume it’s already being read by attackers and defenders alike.”

He may well be right. You can now hand a model an entire repository and ask it one adversarial question that finds a bug. Several researchers reproduced this finding within hours of it becoming public.

Narrowing the search space for the Enigma machines took a national programme, purpose-built machines and years of work. Now narrowing the possibilities for attacks like this can take just a well directed prompt.

If you want to go deeper:

• Block: Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware

• Coinkite: Entropy technical backgrounder

• Coinkite: Seed generation warning and remediation steps

• Galaxy Research: on-chain mapping of the sweep

On April 18, Kelp’s Ethereum bridge released $292 million to an attacker. The largest DeFi exploit of the year.

The bridge checked every box on its internal list before handing the funds over. The signature was valid. The verifier watching the source chain confirmed the transfer had happened.

The problem was that none of it was real.

The verifier had been fed lies by infrastructure it trusted, manipulated by Lazarus Group, North Korea's state-backed cyber unit and the same actors who hacked Drift Protocol three weeks ago.

The theft was only the start. Within minutes, the attacker used the stolen funds as collateral on Aave and borrowed against them. By the time Kelp could freeze anything, the damage had escaped the bridge entirely. Aave was carrying ~$200 million of bad debt, WETH suppliers were locked out of their funds, and the cascade had pulled in every major lending protocol on Ethereum.

This piece walks through how one forged signature started a cascade which has impacted all of DeFi.

2. The Setup

What Kelp Is

Kelp is a liquid restaking protocol. Users deposit ETH, Kelp routes it through Ethereum staking and a secondary yield network called EigenLayer, and issues a receipt token called rsETH in return.

rsETH lives on more than 20 chains. Ethereum is the hub. Every other chain holds a wrapped version, a copy of the token backed 1:1 by real rsETH held in custody on Ethereum.

Custody Contract

When you bridge rsETH to a Layer 2 (L2) chain, your actual tokens don’t travel anywhere. They get deposited into Kelp’s custody contract on Ethereum, and an equivalent amount gets minted on the L2. Bridge back and the L2 version gets burned, releasing your original rsETH on Ethereum.

Think of it like this: the custody contract is a shared safety deposit box holding everyone’s rsETH. The L2 wrapped tokens are withdrawal slips against that box. Drain the box and every slip becomes worthless.

At the moment of the attack, the box held 116,723 rsETH.

How the Messages Are Verified

LayerZero is the messaging layer that connects these chains. It delivers instructions, it doesn’t hold funds. Think of it as SWIFT for blockchains.

LayerZero’s security rests on verifiers, a separate party that watches events on the source chain and attests to the destination chain that they actually happened. LayerZero calls them DVNs, for Decentralised Verifier Networks. The name is misleading. In practice, a DVN is typically a smart contract run by one operator with an internal multisig.

Applications pick how many DVNs they require. LayerZero’s own documentation recommends at least two.

Kelp’s Unichain-to-Ethereum path required exactly one.

That one verifier was operated by LayerZero Labs, the same team that built the messaging layer. It runs a 2-of-3 multisig: three signing keys, with two needed to approve any attestation, all held by one organisation.

When an application picks LayerZero Labs as its only verifier, the messaging layer and the verification layer collapse into the same party. Two signatures from the same firm do not become independent verification because there are two of them. One organisation ends up running both the roads and the traffic lights.

The attacker understood this, picked the weakest path, and walked through it.

3. Act 1: The Forged Message

The Pre-Stage

Ten hours before the attack, someone funded nine fresh wallets from Tornado Cash, a privacy tool that breaks the link between the source and destination of funds. All previously unused and loaded with roughly 0.098 ETH each.

The Transfer That Wasn’t

The attack took three transactions and two minutes.

At 17:33 UTC, a DVN admin submitted a signed attestation on Ethereum. The attestation said a transaction on Unichain had just asked Kelp to release 116,500 rsETH to a specific recipient address. The signatures matched the DVN’s authorised keys and Ethereum accepted the attestation.

Two minutes later, the attestation entered into Ethereum’s official record, marking the message as verified and ready to execute.

Thirty seconds after that, the attacker called the execute function. Ethereum performed its one check: did this incoming message match the verified attestation? It did. The instruction passed to Kelp’s custody contract, which decoded the message and transferred 116,500 rsETH to the recipient.

From Ethereum’s perspective, everything worked exactly as designed.

The Impossible Math

But there was a problem.

Every EVM-chain transaction carries a nonce, a counter that tracks transaction order for each account. Nonces go up by one. They can’t be skipped or reused. If Kelp’s Unichain contract had genuinely sent a transfer message, its nonce would have advanced.

It didn’t. The Unichain outbound nonce stayed stuck at 307 throughout. It never advanced to 308.

No source-chain transaction ever happened.

The rsETH total supply on Unichain stayed at 49 tokens, unchanged across the entire attack window.

A legitimate burn of 116,500 rsETH was impossible.

Ethereum released user deposits against a transfer message nobody had ever sent. The signature proved someone authorised to sign did sign. It did not prove anyone had actually watched Unichain before signing.

What Actually Happened

The DVN’s job was to watch Unichain. To do this, it relied on RPC nodes, servers that index blockchain data and answer questions about what’s on-chain. The DVN’s RPC nodes are its eyes.

Days before the attack, Lazarus Group had compromised two of LayerZero Labs’ RPC nodes deeply enough to replace the software running on them. The replacement binaries were surgical. They showed the DVN a forged transaction record. They told every other observer the truth. LayerZero’s monitoring systems saw nothing unusual because they were watching the same nodes and getting honest answers.

When the attack began, Lazarus launched DDoS attacks on the honest RPC nodes to take them offline. The DVN’s failover kicked in and it started reading from the only nodes still answering: the compromised ones. Those nodes told it a fake Unichain transaction had happened. The DVN signed.

The signing keys were not stolen. The DVN did exactly what it was designed to do. The deception happened one layer below, in the infrastructure the DVN trusted to tell it the truth.

Once the attack completed, the malicious binaries were designed to self-destruct, taking the evidence with them.

LayerZero’s post-mortem explains what the implants did. It has not explained how Lazarus got root access to the RPC nodes in the first place. That entry vector is the part of the story still open.

The Response

Forty-eight minutes after the first drain, Kelp’s multisig executed an emergency freeze. The rsETH token contract was paused. Transfers to the attacker’s recipient wallet were blocked.

By then, a second forged message had already been verified on Ethereum, queued to release another 40,000 rsETH worth $100 million. The freeze was the only thing stopping it. The message still sits on Ethereum today, verified and undelivered.

Forty-eight minutes is fast for human incident response. DeFi moves faster than that. What happened inside those forty-eight minutes is Act 2.

Subscribe now

4. Act 2: The Cascade

The Attacker Now Had a Problem

At 17:35 UTC, the attacker held 116,500 rsETH. They now needed to convert them into something spendable, before the alarm went up.

Dumping them on decentralised exchanges was the obvious move. But rsETH secondary liquidity was thin. Selling 18% of circulating supply onto open markets would have crushed the price before the attacker could exit.

Aave offered a better exit.

How Aave Became the Exit Ramp

Aave is the largest lending protocol in DeFi. Users deposit tokens to earn yield. Others borrow against collateral they post. An oracle tracks market prices and tells Aave what each token is worth.

The attacker could post the stolen rsETH as collateral, borrow WETH against it, and walk away with liquid ETH without ever touching the rsETH market. WETH trades everywhere. Aave’s oracle would price the stolen collateral the same way it priced the legitimate kind.

Better yet for the attacker, Aave had been running rsETH in an efficiency mode, a setting for assets that move together. Correlated tokens let borrowers take higher leverage between them. The mode let users borrow 93 cents of WETH against every dollar of rsETH collateral.

The assumption was that rsETH would track ETH closely. That assumption holds under normal market conditions. It breaks entirely when the rsETH backing disappears.

Aave priced rsETH as though its security was rsETH security. It was actually the security of Kelp’s bridge configuration, held together by LayerZero Labs’ signing keys.

Test-Then-Scale

The attacker didn’t commit the full amount straight away. They ran tests.

1 rsETH supplied first. Then 5,000. Then 20,000. Then 27,999. Then 400.

Each step was a probe. Did any circuit breakers fire? Did the oracle refuse to price the new supply? Did a risk manager notice? When each step cleared, the attacker committed more. The attacker used them to confirm Aave’s parameters weren’t about to catch up with them.

Running in Parallel

Six other branches moved simultaneously.

Some repeated the Aave play at smaller size. Some used Compound and Euler instead. Some swapped rsETH directly for ETH through exchange aggregators. Some bridged rsETH to Arbitrum and ran the same Aave strategy against Arbitrum’s deployment.

Total debt extracted across Aave, Compound and Euler: ~$236 million.

The Position Nobody Would Close

When a borrower’s collateral on Aave falls in value, liquidators, third parties paid to close risky positions, step in. They repay the debt and take the collateral at a discount. The mechanism keeps the protocol solvent when borrowers default.

For the attacker’s position, nobody showed up.

The oracle, which updates on a delay, continued marking rsETH near its pre-attack price even though the real market was collapsing. Kelp paused redemptions, so nobody could unwind rsETH back into underlying ETH. Liquidators faced two options, neither workable: close the position at the oracle price and buy rsETH they had no way to sell, or close it at the real price and take an immediate loss on what they paid.

The position sat. Aave’s WETH pool hit 100% utilisation, meaning every available WETH had been borrowed. Every supplier trying to withdraw was blocked.

The Contagion

Aave’s total value locked fell from $26.4 billion to roughly $20 billion within 24 hours. Over $5 billion of ETH walked out. The AAVE token dropped 16%.

Other lending markets froze rsETH within hours. SparkLend, Fluid and Upshift shut down new activity. Lido paused deposits into its earnETH product because of indirect rsETH exposure. Ethena paused its own LayerZero bridges despite having no rsETH exposure.

The combination of one verification failure, one bridge configuration, and one lending market parameter started a cascade which is still ongoing.

5. Where We Currently Stand

The attacker’s Ethereum wallet holds 75,700 ETH. It has not sent a single transaction since the money arrived. A second wallet on Arbitrum holds another 30,700 ETH equivalent, equally untouched. Every analytics firm can see them. Nobody can freeze them. They sit, waiting, until the attacker decides to cash out.

Kelp’s contracts remain paused. The leveraged Aave positions on both Ethereum and Arbitrum remain open, carrying tens of thousands of rsETH as collateral against loans nobody can liquidate. At current prices, Aave is now carrying somewhere between $177 and $196 million of bad debt it cannot recover through normal mechanisms.

The protocol has an insurance-style backstop called Umbrella, which holds around $50 million of staked WETH designated to absorb exactly this kind of loss. Umbrella is queued to be slashed for the first time in its existence. The gap between what it covers and what was actually lost flows to ordinary WETH suppliers as a haircut.

Kelp has not published a recovery plan for bridged rsETH holders. Tokens on 20+ chains now have uncertain backing. The protocol’s ability to honour redemptions at full value depends on whether any portion of the stolen funds can be recovered.

Attribution is now confirmed. LayerZero has identified the attackers as Lazarus Group’s TraderTraitor subgroup. The same actors behind the Drift exploit three weeks ago.

The story isn’t done. We’ll cover the aftermath in a follow-up once the dust has settled.

6. The Broader Lesson

When Aave listed rsETH as collateral, it was implicitly underwriting every upstream dependency that kept rsETH backed. The actual stack looked like this:

• Aave trusted rsETH to be backed

• rsETH was backed by Kelp’s custody contract

• Kelp’s custody contract trusted LayerZero’s DVN to verify cross-chain messages

• LayerZero’s DVN trusted its RPC nodes to report what happened on-chain

• LayerZero’s RPC nodes trusted their own software to run correctly

• The software was replaced with a lie

Every layer trusted the layer beneath it. The attack broke the system three steps below the contracts. Nobody was looking there because nobody had thought to.

None of that stack appeared anywhere on Aave’s books. The risk it created ended up on the loan book regardless.

One compromised pair of servers should not be able to drain a custody pool holding hundreds of millions. It was able to because Kelp accepted a single-verifier configuration, because LayerZero’s architecture permits that configuration, and because Aave accepted the resulting token as high-leverage collateral without fully pricing what that token’s backing depended on.

Every tokenised or bridged instrument carries the security of its weakest upstream step. Until Saturday, that property was implicit in every liquid restaking token listed on every lending protocol in DeFi. Now it’s explicit.

7. The Speed Gap

Kelp’s freeze came 48 minutes after the first drain. For a weekend human response, involving multisig coordination and emergency contact chains, that’s fast. Most incident response teams would envy it.

In those 48 minutes, the attacker moved roughly $196 million of stolen rsETH into Aave, executed seven parallel strategies, and set up leveraged positions on two chains that cannot now be unwound.

Every attack in 2026 is happening at machine speed. Every response is still happening at human speed. The gap is where the money goes.

Circuit builds for this gap. Automated asset extraction that moves funds to safety when funds are compromised, before a human team can log in. Backed by Lloyd’s of London and recognised by 10+ major insurers as an enterprise risk control that reduces premiums.

Somewhere, the attacker is waiting. We'll cover their next move, and the damage Kelp and Aave are still working through, in the follow-up.

Subscribe now

Thank you to the LayerZero post-mortem and @banteg who's references I relied on to piece this together. If you want to go deeper, I’d suggest reading their work:

Claude Opus 4.7 was used to help put together the visuals in this piece.

On April 1st, $285 million was stolen from Drift Protocol in 12 minutes. This is the largest DeFi hack of 2026, associated with Lazarus Group1, North Korea’s state-sponsored cyber-crime unit.

The attack didn’t start on April 1st. It started six months earlier, at a crypto conference, with a handshake.

A group posing as a quant trading firm spent months building trust with the Drift team. They met in person across multiple countries and deposited over $1 million of real capital. When they had enough access, they tricked key signers into pre-approving hidden transactions, manufactured a fake token out of thin air and drained $285 million in real assets before anyone could react.

2. The Relationship

Drift is the largest decentralized perpetual futures exchange on Solana. At the time of the attack it held roughly $550 million in user assets. For an attacker, it was a high-value target with complex governance and multiple entry points.

The Approach

In the fall of 2025, a group presenting as a quantitative trading firm approached Drift contributors at a major crypto conference. Over the next six months they showed up at multiple conferences across several countries, building rapport with Drift team members.

They were technically fluent, had professional backgrounds and were familiar with how Drift worked. A Telegram group was set up after the first meeting, and months of substantive conversations followed about trading strategies and vault integrations.

Everything about this looked like a normal business partnership.

Between December 2025 and January 2026, the group onboarded on Drift. They deposited over $1 million of their own capital. They shared code repositories, tools, and applications they claimed to be developing. They asked detailed product questions across multiple working sessions. These interactions continued up until the attack.

Then right as the attack went live, the group’s Telegram chats and software were deleted.

The Twist

The people that Drift met in person were not North Korean nationals. DPRK threat actors used third-party intermediaries for face-to-face relationship building. The individuals had fully constructed identities with public-facing credentials.

Before Drift, the crypto industry treated meeting collaborators in person as a reliable filter. That filter no longer holds.

The Human Reality

Consider the perspective of a Drift contributor. You’ve met these people in person, multiple times. They’ve deposited real money into your protocol. They ask smart questions. They’ve seemed genuinely engaged for six months.

At what point do you stop verifying every interaction and start trusting?

3. The Setup

The Compromise

There are two suspected entry points.

One contributor likely got compromised after cloning a code repository shared by the group. Opening the project was enough to silently execute malicious code with no warning.

A second contributor downloaded a wallet app via Apple’s TestFlight, a platform for distributing pre-release apps that bypasses Apple’s normal security review. The group asked the contributor to beta-test it.

Once devices were compromised, the attackers had what they needed to obtain multisig approvals.

The Fake Asset

Three weeks before the attack, on-chain staging began. The attackers withdrew ETH from Tornado Cash and deployed a fictitious token: CarbonVote Token (CVT). They minted 750 million units, seeded a few hundred dollars of liquidity on Raydium, and used wash trading to maintain a price near $1.

Over three weeks, this manufactured trading activity built a credible price history on a Switchboard oracle feed, one of the pricing services Drift relies on to value assets. The oracle did what it was designed to do: report the last traded price from on-chain exchanges. It doesn’t check liquidity depth, number of counterparties, or whether the trading is real. It just notes the price.

Think of it like this: someone incorporates a shell company, issues 750 million shares, and trades them back and forth with themselves until the stock shows a stable $1 price.

An automated pricing service marks the stock at $1 based on observed trades. The fake asset now had a real-looking price history, sitting in a live oracle feed, waiting to be connected to Drift.

The Pre-Loaded Trap

Drift uses a borrow/lend system. Users deposit collateral and borrow assets against it. This is how the attackers planned to extract funds: deposit fake collateral, borrow real assets.

But first they needed admin control.

Drift’s Security Council operated as a 2-of-5 multisig. Any two of five signers could authorize admin actions.

Solana has a legitimate feature called “durable nonces” that lets you sign a transaction today and execute it later without it expiring. This gave the attackers a way to collect signatures in advance and hold them until the right moment.

How the attackers obtained the multisig approvals is still under investigation by Mandiant. There are two likely paths.

1. The malware delivered through the code repository and TestFlight app compromised the signers’ devices directly, allowing the attackers to extract keys or trigger signatures.

2. The attackers presented misleading signing requests that looked routine but carried hidden admin authorizations, similar to what we saw with Bybit.

Either way, the outcome was the same. Pre-signed transactions sitting ready to execute whenever the attacker chose.

The Last Defense Removed

Five days before the attack, Drift migrated its Security Council to a new 2-of-5 multisig configuration with zero timelock. The migration was a planned operational change due to a council member changeover.

Timelocks create a mandatory delay between when a governance action is approved and when it takes effect. That delay is the detection window that gives the community or security team time to catch and reverse actions. Removing it meant that any two signers could authorize admin actions with immediate effect.

Whether this migration was influenced by the attackers through social engineering or was a coincidence they exploited remains under investigation. Either way, the attacker adapted in real time. They’d already compromised signatures on the old multisig. By March 30, three days after the migration, they had re-obtained 2-of-5 authority on the new configuration.

Subscribe now

4. The Attack

April 1, 2026, 9am Pyongyang time. The pre-signed transactions deploy.

Two transactions, here and here, four Solana slots apart, were enough to complete the admin takeover. Within minutes the attacker had full control of Drift’s protocol-level permissions.

They used that control in rapid sequence: listed CVT as a new market with valid collateral, pointed its pricing at the Switchboard feed they’d spent three weeks manufacturing data for, raised withdrawal limits to extreme levels, and deposited hundreds of millions of CVT against the manufactured price.

Then the borrowing began. The attacker used Drift’s own lending system to borrow real assets against the fake collateral. USDC, JLP tokens, SOL, wrapped BTC. The protocol processed every withdrawal as a legitimate collateral-backed loan. From its perspective, someone had deposited hundreds of millions in collateral and was borrowing against it. Standard operations.

Going back to our analogy: now the person who created the shell company took over the bank. They choose which pricing feed to trust, set the borrowing limits, and approve their own worthless shares as collateral. Then they borrow real money against them and walk out.

31 transactions in roughly 12 minutes. $285 million in real assets drained.

5. The Aftermath

Where the Funds Went

The stolen assets were consolidated and swapped into USDC and SOL, then bridged to Ethereum within hours using Circle’s Cross-Chain Transfer Protocol (CCTP). On Ethereum, portions were converted into ETH, accumulating roughly 129,000 ETH across attacker wallets.

The speed outpaced even the Bybit laundering operation in 2025. Lazarus has refined this playbook across multiple hacks: bridge assets across chains to break the transaction history, swap out of freezable stablecoins into ETH, then disperse.

Over $230 million in USDC was bridged across more than 100 transactions during US business hours. ZachXBT criticized Circle for not freezing the stolen USDC during the six-hour window after the attack began. Circle has stated it only freezes assets when legally required.

The Blast Radius

More than 20 Solana protocols with exposure to Drift liquidity paused operations or assessed losses. Some lost access to user funds entirely and will be forced to shut down.

In DeFi, the beauty is in creating “money legos”, linking protocols together to create new products. The peril is that every protocol becomes a counterparty and when one fails, the exposure cascades.

Attribution

Elliptic and TRM Labs attributed the attack to DPRK-linked actors. Fund flows trace back to the same group behind the $53 million Radiant Capital hack in October 2024. Over $6.5 billion has been stolen by DPRK-linked actors in recent years.

DeFi’s failures are directly funding nuclear weapon programs in North Korea.

Share

6. The Connection

In February 2025, Lazarus stole $1.4 billion from Bybit by compromising a signing interface and hiding a malicious parameter inside a routine transaction. Employees approved it because the interface told them it was safe.

This time they came back with an even longer game. They targeted the employees themselves, over six months of conferences and working sessions. They deployed $1M of real capital as cover. By the time of the attack, the Drift team had no reason to question them.

Drift had passed multiple audits. But no code was compromised. A 2/5 multi-sig meant the attacker only needed to compromise two people to take full admin control with immediate effect. For a protocol holding $550 million in user assets, that threshold was too low and the safety net was missing.

7. Conclusion

Was the Drift hack preventable? That’s a harder question than it was for Bybit.

Some of the fixes are straightforward.

Signing devices should be isolated from day-to-day work machines. If the compromised contributors had used dedicated hardware for multisig approvals, separate from the laptops where they cloned repos and downloaded TestFlight apps, the malware would never have reached the keys.

Timelocks on admin actions are essential. Even a 24-hour delay on the governance migration would have created a window to detect and block the attack. A higher signing threshold, 3-of-5 or 4-of-5 for a protocol of this size, would have forced the attacker to compromise an additional person.

These are known best practices and should have been in place.

The scarier part is the nature of the attack itself. This was a con with 6 months of preparation. Real people at conferences, real money deposited. Every interaction designed to build trust so that when the moment came, the targets wouldn’t think twice.

If you’ve seen The Sting, you know how this works. You build an entire world around the target. Everything they see confirms what they believe. By the time the trap closes, they don’t even know they’ve been played.

In the film, the prize was $500,000. The Drift operation followed the same playbook for $285M. At those stakes, six months of preparation and a million dollars of cover is a rounding error. As more value moves on-chain, the cons will only get more elaborate.

No single control survives that. You need overlapping layers across code, people, and governance. Each one has to catch what the others miss. And when something is caught, the response has to be automated. Twelve minutes doesn’t leave time for a phone call.

Attacks like this won’t stop. But with layered controls and the ability to respond at machine speed, they don’t have to win.

The attack surface keeps expanding, from code to signing interfaces to the humans behind them, but the underlying problem remains the same: when something goes wrong, the window to respond is shorter than any human process can match.

Circuit builds infrastructure for this scenario. Automated controls that move funds to safety when a threat is detected, without waiting for manual intervention. These are the kind of attacks our systems are designed to prevent.

Circuit is backed by Lloyd’s of London and recognised by 10+ major insurers as an enterprise risk control that reduces premiums. If you’re thinking about how to protect digital assets against attacks like this, we’re here to talk.

This week, Google made headlines around the world. Every major publication reported the same thing: the security protecting Bitcoin is going to be broken sooner than anyone expected.

The headlines are bold. But the details are hard to check as they’re spread throughout a dense 57-page paper that covers advances in quantum computing, cryptography, blockchains, property rights, and national security policy all at once.

This piece breaks it down for you, step by step.

It’s a guide through how blockchain security works, how quantum algorithms can break it, what the advances in the paper mean, the risks the crypto ecosystem faces and how to deal with the coming threats.

Why do those things matter? Because underneath the technical complexity, this is the story of hundreds of billions of dollars in digital assets that will become accessible to whoever builds the machines that cracks the codes first.

The largest treasure hunt in human history is happening. Most people don’t know it yet.

2. The Lock

Every crypto wallet is protected by Elliptic Curve Cryptography (ECC), a type of mathematical problem that’s been considered so secure it’s used for securing almost everything critical, from internet traffic, to financial data, to personal data and much more.

It works by having two keys. A private key that only you know and a public key derived from it and shared openly. When you transact, you sign with your private key. The network verifies using your public key.

Think of it like a padlock. Your private key is the combination. Your public key is the closed lock. Snapping it shut takes a second. But if someone hands you the closed lock with no combination, the only way in is to try every number until one works.

For Bitcoin that’s 2²⁵⁶ possible keys, a number so large that even if you used every computer on earth, working through all the possible combinations would literally take longer than the age of the universe.1

That’s why ECC has been considered so safe. Because classical computers can’t find the answer without stepping through an impossibly large sequence. But quantum computers can.

3. The Codebreaker

Richard Feynman, one of the founding fathers of quantum physics, famously cracked classified safes at Los Alamos during the Manhattan Project.

He studied the Mosler safes and found that because of how they were manufactured, there was a hidden weakness. The mechanical structure allowed him to feel the mechanism responding as he turned the dial.2 Once he got enough information from that, the number of possible combinations collapsed and he could walk through them all in just a few minutes.

It looked like magic from the outside but was just a different technique that exploited structure the lock’s designers thought was inaccessible. A hidden door that was invisible until you knew how to look.

It turns out the lock behind cryptocurrencies has the same kind of weakness. The algebraic structure of the elliptic curve connects every public key to its private key.

It’s part of the structure of the underlying maths. The designers knew it was there. But because exploiting it with a classical computer would take longer than the age of the universe, it wasn’t considered a risk.

Until someone built a different kind of computer.

Subscribe now

Quantum Computers

A classical computer uses bits. Each bit is either 0 or 1. It works through possibilities one at a time.

A quantum computer uses qubits. A qubit it carries a blend of both 0 or 1, weighted by hidden numbers called amplitudes. You only get a definite answer when you measure it.

A single qubit in superposition isn’t useful. But string enough of them together and something emerges. Each qubit’s state becomes linked to the others, so the system as a whole holds far more information than any individual qubit holds.

Every qubit you add doubles the number of possibilities the system can represent. Scale that up and you quickly reach numbers that dwarf anything in the physical universe. This is what makes quantum computing fundamentally different.

But scale alone doesn't solve anything. If you measured this state, you'd get random noise. The breakthrough is in what you do between setting it up and measuring it.

Shor’s Algorithm

In 1994, mathematician Peter Shor found the breakthrough. He developed an algorithm to extract the private key directly from the public key.

It works in two steps.

Step 1: It recreates the same mathematical process that produced the public key from the private key but inside a quantum system. The private key leaves a hidden pattern in how that math behaves. The correct answer is in there, but it’s buried deep and indistinguishable from noise.

Step 2: It applies a calculation called the Quantum Fourier Transform. Think of it like Feynman being able to feel the mechanism responding as he turned the safe dial, it probes the hidden structure to extract otherwise invisible information. The wrong answers cancel each other out while the right answer reinforces itself. The noise turns into a single clear signal.

Once you measure this, the private key is whats left.

For thirty years, Shor’s algorithm has been a theoretical curiosity. A proof that quantum computers could break public key cryptography, if they ever became powerful enough.

That if is what Google’s paper is now closing.

Share

4. Theory to Practice

Shor’s algorithm has existed since 1994. The reason it hasn’t broken Bitcoin yet is simple: nobody has built a machine powerful enough to run it.

To run Shor’s algorithm you need large numbers of qubits working together. The problem is that qubits are extraordinarily fragile. The slightest interference, such as heat or vibration, causes them to collapse and destroys the calculation.

To compensate, engineers combine many physical qubits together to produce one reliable logical qubit, an approach called quantum error correction. It works, but it’s expensive and is the reason why the qubit requirements seem so impossibly large.

Google’s most advanced processor, the Willow chip, has 105 physical qubits. The previous best estimate for the number needed to break Bitcoin’s cryptography was 9 million,3 almost 5 orders of magnitude larger. Thats why it seemed like a distant threat.

Exponential Progress

That distance is closing faster than people are expecting. Over the last fifteen years, the estimate of how many qubits a quantum computer would need to break widely used encryption has dropped exponentially. Figure 3 from the paper shows this trend for RSA-2048, another widely deployed cryptographic system. The trend for ECC protecting Bitcoin is similar.

Those drops don’t come smoothly. The paper uses the car industry as an analogy. The late 19th century saw rapid innovation across steam, electric, and internal combustion engines all competing simultaneously. Progress came in sudden jumps as each architecture hit breakthroughs. Eventually combustion became the dominant design and progress shifted to gradual improvement.

Quantum computing is still in that first stage. There are multiple hardware architectures competing and progress is coming in sudden jumps as scaling challenges are overcome.

This paper is about one of those jumps.

The Finish Line Moves Closer

The previous best estimate for breaking Bitcoin’s elliptic curve cryptography, the 2²⁵⁶ combination lock we explored in Section 2, put the physical qubit requirement at around 9 million. The breakthrough here is that Google’s team brought that down to fewer than 500,000.

They got there by finding a more efficient way to compile the quantum circuits that run Shor’s algorithm. Prior work had optimised either for fewer qubits or for fewer operations, but not both together. This paper found configurations that kept both low simultaneously, leading to a ~20x reduction in estimated difficulty.

That 500,000 qubits figure is the output of several compounding engineering assumptions; a specific hardware architecture, qubit connectivity, error rates consistent with hardware Google has already demonstrated, and a particular error correction approach.

More aggressive assumptions could push the number lower. The researchers assert they chose assumptions that are reasonable to try to demonstrate the most credible near-term engineering path, not the most alarming one.

How Google Published It

One of the most interesting parts of the paper is what is absent. Google didn’t publish the actual circuits behind their result.

They used a zero-knowledge proof instead, a cryptographic technique that lets anyone verify the claim exists without being able to replicate it. That allows them to prove their result but not reveal exactly how they did it.

This breaks the academic tradition of full transparency. The reason they give is that publishing full attack details is now a public safety risk.

It’s a significant change to recognize that this cutting edge of research is now at a point where it’s of such importance and has such monetary incentives attached to it that we can’t rely on public channels to really know where the edge is. What is public information from now on will likely lag behind what is private.

5. From Sci-Fi to Science to Engineering

My read of the core idea that the researchers are trying to transmit from this paper is that right now many people treat the possibility of a quantum attack as hand-wavy science fiction. Maybe one day there will be a machine powerful enough to crack the encryption protecting everything we think is valuable. But it’s so far away that you don’t have to think about it.

That’s a view the researchers think is dangerous.

The Shift

Shor’s algorithm has existed since 1994. Bitcoin was built knowing the theoretical vulnerability was there. For decades, the gap between theory and practice was so large that the threat could be safely ignored as the engineering seemed impossibly far away.

A cryptographically relevant quantum computer (CRQC) is the term used to describe a machine powerful enough to run these attacks at scale.

What this paper actively showcases is that the engineering behind a CRQC is no longer impossibly far away. It’s becoming a clear problem with specifications, components in development, and multiple independent tracks of progress converging simultaneously.

When multiple components of an engineering challenge can improve independently, progress compounds. Papers announcing better algorithms, better hardware, better error correction are becoming more frequent as each improvement enables the next.

Acceleration

The number of qubits we can build is rising and the number of qubits we need to run these algorithms is dropping by orders of magnitude. Those two curves are converging, and the main point the authors of the paper is that they will meet sooner than most of the world is expecting.

Humans tend to think in straight lines. When progress compounds exponentially, human intuition fails. We consistently underestimate how quickly things can change as the curve accelerates.

Using a zero-knowledge proof to publish the results explicitly announces this danger.

A CRQC is becoming an engineering problem. Quantum attacks could come sooner than almost anyone expects.

Share

6. What’s Actually at Risk

So we now know a CRQC is closer to being built than anyone expected and we know what it can do. The next question is what it could actually take.

6A. Bitcoin

Bitcoin’s quantum security comes down to one question. Is your public key visible?

For every Bitcoin wallet this depends on something called a script type, a format that determines how funds are locked and how they can be spent. Different script types handle public key visibility differently. Some expose the public key permanently from the moment funds are received. Others keep it hidden entirely until a transaction is broadcast.

The chart below maps the full Bitcoin supply against each script type, with vulnerable portions shaded. Around 6.9 million BTC across all script types are currently vulnerable, about a third of all Bitcoin ever mined. At current prices that’s roughly $460 billion.

At-Rest Attacks

At-rest attacks target addresses whose public keys are already known or visible on chain. This is the 6.9m BTC mentioned earlier. An attacker with a CRQC has as much time as they want to derive the private key. There are three ways this exposure happens:

1. Weak address vulnerability. Certain script types record the public key directly on chain from the moment funds are received. The oldest of these, P2PK, secures around 1.7 million BTC which has had its public key visible since it was first mined, including Satoshi’s original mining rewards. The bitcoin remains vulnerable until it is spent.

2. Address reuse vulnerability. Script types that normally hide the public key behind a cryptographic hash become vulnerable when some but not all of the bitcoin at an address is spent. The spending transaction reveals the public key, defeating the protection the hash normally provides. Any remaining bitcoin at that address is now permanently exposed. The vulnerability arises entirely from reusing the same address to receive funds multiple times. Avoiding address reuse already is considered best practice in Bitcoin. Under quantum, it moves from recommendation to critical defence.

3. Offchain exposure. A public key can be revealed through activity elsewhere. Spending from the same key on another chain like Bitcoin Cash, or sharing a public key with third party service permanently exposes it. The attacker doesn’t need to wait for a transaction as the key is already out there.

At-rest attacks are serious but mitigable. Move funds to an address that hasn’t exposed its public key and the vulnerability disappears.

Unfortunately, there’s another type of attack category which is harder to escape.

On-Spend Attacks

On-spend attacks target every wallet, not just exposed ones.

When you broadcast a transaction, there’s brief window when a public key becomes visible in the mempool, the waiting area for transactions before they get confirmed and settled on-chain.

Every single Bitcoin transaction, regardless of script type, exposes the public key in the mempool. The moment you hit send, a vulnerability window opens. If an attacker with a CRQC can derive your private key before the transaction is confirmed, they can steal the funds.

Headline Number

Bitcoin’s average block confirmation time is 10 minutes. The paper models, under several compounding assumptions, that a CRQC could complete the derivation in around 9 minutes. Under those same assumptions, they estimate a roughly 41% probability of success per transaction.

Those specific numbers are illustrative rather than predictive as they’re built on a stack of assumptions about hardware architecture, gate speed, and error rates. What matters is what they demonstrate: once a machine of this scale exists, the mempool window becomes an active vulnerability for every transaction on the network.

Blockchains with shorter confirmation windows look safer today. Litecoin’s 2.5-minute block time drops the current probability below 3% according to the paper.

But that safety is a temporary illusion. Bitcoin will be first in the crosshairs because of its 10-minute window. Everything else will follow as the hardware improves and by then it will happen quickly.

Proof of Work: Safe for Now

Bitcoin’s mining mechanism is not meaningfully threatened by current quantum advancements. Mining relies on hash functions, which quantum computers can attack using a different algorithm that provides a much more limited speedup than Shor’s. At current estimates, this doesn’t pose a practical threat to Bitcoin’s PoW security.

The paper does note an indirect risk. A quantum attack on wallets that caused significant market disruption could reduce mining profitability, causing hashrate to drop and then making the network more vulnerable to attack to reorganisation attacks from a well-resourced actor.

6B. Ethereum and RWA

Ethereum can run programs using smart contracts alongside acting as a ledger.

These programs govern lending, trading, stablecoins, and an increasing share of real-world financial assets. That makes Ethereum’s attack surface much wider. In Bitcoin, a quantum attack compromises a wallet. In Ethereum, it can compromise infrastructure with dependencies that ripple out across the entire ecosystem.

Accounts

From your first transaction, your public key is permanently tied to your account address on chain. Every active Ethereum account with a transaction history is an at-rest target.

Admin Keys

Most major smart contracts are controlled by admin keys. They exist because protocols need to be managed. And because they’ve been used in past transactions, their public keys are on chain.

Deriving an admin key can compromise everything that key controls.

I’ll use USDT and USDC to illustrate a clear example. Together they powered the majority of the trillions of stablecoin volume in 2025. A quantum attacker who derives their admin keys could mint as many tokens as they wanted, backed by nothing. An unlimited mint would cause the $1 peg to break. That broken peg cascades across every protocol that holds, prices, or settles against those assets. What starts as a cryptographic attack ends as a market collapse.

Beyond stablecoins, the combined value of assets locked across Ethereum’s ecosystem is around $200 billion4 and is continuing to grow.

As more real-world assets move on chain, more tokenized bonds, funds, and financial instruments come under the same vulnerability. Every asset that moves on chain before a solution is in place expands the surface that a CRQC could reach.

Consensus Vulnerability

Ethereum uses Proof of Stake, where validators secure the network by locking up their own ETH as collateral. There are currently around 37 million ETH staked. Validators authenticate their work using BLS signatures, a type of digital signature vulnerable to Shor’s algorithm.

A CRQC that derives a validator’s signing key can not only steal their stake but also impersonate them. Done at scale, this could enable reorganisations of the Ethereum chain itself. This validator risk threatens Ethereum’s ability to agree on what’s true. When you lose the ability to agree on whats true, trust disappears.

On-Setup Attacks

Ethereum’s complexity also opens an additional attack category which isn’t present on Bitcoin.

Many protocols are initialised using a one-time ceremony that produces fixed public parameters baked into the protocol’s foundation.

A CRQC only needs to attack those parameters once. After that, the backdoor is permanent and can be exploited by a classical computer.

Tornado Cash is the clearest example. It’s a privacy protocol that processes transactions anonymously. Its anonymity guarantee rests entirely on parameters set during a one-time initialisation ceremony.

A single quantum computation against those parameters would permanently break the anonymity of every transaction ever processed through it and allow the protocol to be drained.

7. The Migration Problem

Post-quantum cryptography (PQC) exists. Algorithms that are believed to be resistant to quantum attacks have been developed, standardised, and in some cases deployed. NIST finalised its first PQC standards in 2024.

Getting them into widespread use is a different problem.

The Technical Problems

The leading post-quantum replacements produces signatures significantly larger than existing signatures.

Larger signatures mean fewer transactions per block, slower throughput, and significantly higher costs across the entire network. The performance tradeoff matters at scale.

PQC signatures are also relatively new. The algorithms exist, but their deployment in blockchain systems is still early. Performance, software implementation, and edge cases are still being worked through in real time.

The Consensus Problems

Even if the technical solution were mature, decentralised networks can’t be as easily updated as centralised systems can. Bitcoin requires consensus across developers, miners, exchanges, wallet providers, and millions of individual users before any changes can be made.

Bitcoin has hard-forked over smaller disagreements. The 2017 block size war took years, split the community, and produced Bitcoin Cash. A migration to PQC would be one of the most consequential changes in Bitcoin’s history.

BIP-360, the current proposal for a quantum-resistant script type, has a testnet, and has serious support. It also has serious opposition as introducing larger signatures would reduce the number of transactions that could fit in a block, slowing the future transaction rate.

The Migration Window

For active wallets, in principle the path is straightforward: migrate to a quantum-resistant address before a CRQC arrives.

The problem is timing. Migration requires network consensus, protocol upgrades, wallet software updates, and individual user action across millions of addresses. That process can take years.

For Bitcoin specifically, the migration would take months even using all available blockspace for just these transactions. 5

The window is still open but is narrowing, and the governance process required doesn’t move at the speed the threat is moving.

What’s Already Happening

Some chains have moved. The Quantum Resistant Ledger was built on PQC from the start. Algorand, Solana, and the XRP Ledger have made early experimental deployments. Ethereum has an active post-quantum roadmap. These are proof points that migration is technically possible.

But these are all early. The chains with the most to protect are the ones with the least ability to move quickly.

8. The World’s Largest Treasure Hunt

ECC doesn’t only protect crypto wallets. It protects internet traffic, banking systems, secure messaging, electronic passports, and government communications. Everything digital that matters. All have the same lock with the same vulnerability.

The treasure hunt is about the entire digital security architecture of modern society. Crypto is just the most visible and most immediately quantifiable target.

The hunt is already underway. Nation states and sophisticated actors are harvesting encrypted data today, intercepting and storing communications and financial records they cannot yet read. When the machine is built, they will decrypt everything they have collected. The CRQC doesn’t need to exist yet for the collection to start.

Subscribe now

The Permanent Problem

Migration only works for active wallets. For a significant portion of the assets at risk, there is no migration path at all.

Around ~2.3 million BTC cannot be migrated.This includes wallets whose owners are gone or where the keys are almost certainly lost. The coins cannot be moved to safety.

These are fixed targets. Whoever is first to build a CRQC can be the first gets to collect.

The Geopolitical Dimension

The stakes are now large enough that governments have started paying attention.

The race to build a CRQC also involves nation states with active classified quantum programmes that don’t publish their progress. The paper explicitly highlights this: the first CRQC may never be announced, it’s existence may only first be detected on the blockchain.

The paper recommends governments treat this as a national security issue. An adversarial state can quietly drain hundreds of billions in digital assets into permissionless wallets, evading any sanctions that may exist in the traditional financial system

But as discussed, the problem is even bigger. Once a CRQC capable of attacking Bitcoin is built, the blast radius is much larger. The same encryption underpins every secure communication a government has sent, every classified document it protects and every financial system it governs. That’s why this is a national security issue.

What the Crypto Community is Debating

The Bitcoin community knows the problem. Agreeing on what to do about it is another matter.

Three positions have emerged, and none has won.

Do nothing: Property rights are inviolable, and the protocol should not confiscate assets under any circumstances. The issue is that the price will likely be impacted negatively.

Burn: Destroy the vulnerable coins before a quantum attacker can take them. Remove the incentive, protect the network, prevent the shock. The objection is that burning coins with possible living owners is confiscation, and it sets a precedent for what the protocol can do to assets it decides are inconvenient.

Hourglass: Rate-limit spending from vulnerable addresses and create a managed migration window. Owners race to move their coins within the allowed rate, fees flow to miners, and the attack surface shrinks gradually. The dynamics are messy and the window may not be long enough, but it avoids both the supply shock and the confiscation question.

An informal poll at the 2025 Presidio Bitcoin Quantum Summit recorded roughly equal support for all three. If nothing changes, the protocol won’t move.

The Bad Sidechain

The paper proposes a fourth option.

It maps it directly against the bad bank mechanism used during financial crises. When toxic assets threaten the whole system, you quarantine them.

Applied to Bitcoin, the proposal is a recovery sidechain where claims on dormant assets can be submitted and verified. Ownership would be established and verified offchain, with coins returned to rightful owners in an orderly way rather than lost to whoever builds the machine first.

The paper calls this digital salvage. Regulated recovery, like maritime salvage law, that brings the assets into the formal economy rather than letting them fall to an adversarial actor. Governments create the rules and let regulated entities run the recovery. The gains come back into the taxable economy.

It is technically hard and politically contentious. It asks the Bitcoin community to accept something that looks, from certain angles, like exactly the kind of intervention Bitcoin was designed to prevent.

But doing nothing is also a choice. Without a framework, whoever gets there first keeps everything.

9. What Happens Next

We started with a teaser, that underneath the technical complexity of Google’s paper is a story about hundreds of billions of dollars in digital assets that will become accessible to whoever builds a specific machine first.

Having walked through the paper, you can now see the full shape of that story.

The lock protecting every crypto wallet has a hidden mathematical structure. Shor’s algorithm finds it and extract the private key. Google’s paper showed a major advance that brought forward our estimates of when that could happen by an enormous amount, a ~20x reduction in the resources required.

Google's paper didn't arrive alone. Oratomic published results on the same day showing parallel advances on a completely different hardware architecture.6 Multiple research groups are converging on the same destination.

That is what major jumps in progress look like.

Two curves are closing simultaneously, our ability to build more qubits rising while the number required to break our encryption keeps falling. Building a machine powerful enough to perform quantum attacks is moving from sci-fi to an engineering problem.

The targets are already publicly visible on chain and the prize grows with every asset that moves onto these rails. This is now a race that includes nation states with classified programmes, and their progress isn’t public. The paper warns the first CRQC may never be announced and we may not know the race has been won until the coins start moving.

This is a window of existential threat for the entire existing crypto ecosystem. How it responds will define whether digital assets can be the future of financial infrastructure.

The largest treasure hunt in human history is already underway. The map is drawn. The machines are being built. The actors shaping what happens next include some of the most powerful entities on earth.

It’s a race against time that most people still don’t know is happening. Now you do.

A note on Circuit

We’ve been thinking about private key compromise as an operational risk long before this paper was published. Quantum accelerates the timeline, but the underlying problem, that when a key is compromised, the window to respond is shorter than any human process can match, isn’t new.

Circuit builds infrastructure for that scenario. Pre-approved and pre-signed transactions that automatically move funds to safety when a key is at risk, without waiting for manual intervention. It addresses one of the most immediate problems.

Circuit is backed by Lloyd’s of London and recognised by 10+ major insurers as an enterprise risk control that reduces premiums. If you’re thinking about how to protect digital assets against key compromise, we’re here to talk.

Thanks to Jean-Phillippe Aumasson, Dave Schwed, Gowtham Nagesha and Matthew James for reviewing drafts of this piece and providing feedback. Claude Opus 4.6 was used to help put together the piece.

The form of value kept changing. Ships full of gold bars gave way to paper securities representing ownership, then electronic records in databases. Each evolution created new risks. Each time, the Lloyd’s market figured out how to handle them.

Now value is moving between wallets on blockchains. And Lloyd’s just made their first strategic investment in digital assets to ensure it moves safely.

What We Learned Inside the Market

Eight months ago, Circuit was invited to participate in the Lloyd’s Lab. We embedded with underwriters, had many coffees and beers with brokers in Leadenhall Market, and asked one question over and over: what’s stopping this market from developing?

The answer wasn’t capital. Insurers have money. It wasn’t demand. Institutions are desperate for coverage.

The problem was the tail risk.

Digital asset insurance is catastrophe-driven, like hurricane insurance. A single event can wipe out years of premiums. Bybit lost $1.5 billion in one attack. When losses cluster like that, the math breaks. One failure can become existential. Insurers look to protect themselves: Premiums become unaffordable. Coverage limits shrink. Exclusions are introduced. The market stops in its tracks.

To make digital assets insurable at scale, you have to mitigate the impact of a catastrophe. Better pricing cannot exist without reducing the frequency and size of losses.

Subscribe now

Building for the Gap

We sat down with the best underwriters in the market to understand what was missing. Then we built products to plug those gaps.

Circuit’s technology stops losses that were previously unstoppable. When a system is breached and an attack begins, our systems move assets to safety in seconds, automatically. No waiting for humans to respond. Automated response at blockchain speed.

We worked with Lloyd’s to validate this technology and embed it into underwriting processes. It’s now materially changing how top insurers approach these risks.

But don’t take our word for it. Look at the prices.

Circuit customers can now unlock substantial premium discounts from some of the biggest insurers in the market. Insurance has skin in the game. Those discounts exist because Circuit’s technology meaningfully reduces risk.

Why This Matters Beyond Crypto

My fundamental belief: In the next three years, every bank, every payments network, every financial institution will interact with blockchain rails. Eventually all assets will become tokenised and stablecoins will become the dominant medium of exchange. All of it will need protection that can keep pace.

Cyber insurance grew from a niche to a $16 billion market as every business moved online. Digital asset insurance will be even bigger, even quicker. Cyber protects data. This protects value itself.

Lloyd’s has made their first investment in digital assets. They’re not betting on crypto prices. They’re betting that the infrastructure to unlock this market is finally being built.

We’re building it. And now they’re building it with us.

Share

On November 3rd, 2025, $128 million vanished from Balancer across eight blockchains in under two hours.

In the immediate aftermath, explanations flooded in. An access control bug. A missing permission check. Something simple that had slipped through the cracks.

They were wrong.

What emerged was something far more sophisticated. Someone who understood Balancer’s mathematics, and how to exploit it.

The irony? Buried in Balancer’s code, right above the vulnerable function, sat a developer comment: “the impact of this rounding is expected to be minimal.”

They were wrong by $128 million.

This wasn’t bypassing security. This was finding the exact boundaries where precision breaks down, then exploiting those boundaries through calculated iteration, using maths as a weapon.

To understand how it happened, we need to start with what everyone got wrong.

2. How Balancer Works

Balancer is an automated market maker that has processed billions in volume since 2020.

Think of it like a bank vault holding multiple types of assets (ETH, stablecoins, wrapped Bitcoin etc) that users can swap between whenever they want.

When you deposit assets into a Balancer pool, you get a receipt token called BPT (Balancer Pool Token). If you own 1% of all BPT, you own 1% of everything in the vault. When you want your assets back, you return your BPT and withdraw your share.

The Price Calculation

Balancer always needs to be able to answer the question: what’s each BPT worth?

The price formula is simple:

BPT price = D / totalSupply

D is a mathematical constant called the invariant. This number must stay balanced across all swaps and satisfy the following formula (you don’t need to understand it):

Think of D as a number representing the total value in the vault when everything is balanced.

The problem: if you manipulate D, then you can manipulate the price of the BPT tokens.

Example:

• If D = $100 million and there are 100 million BPT tokens, each BPT is worth $1

• If you make D drop to $90 million (while the vault still holds $100 million in real assets), each BPT gets priced at $0.90

• You could buy BPT cheap, burn it for real assets, and pocket the difference

But how do you manipulate D?

The Decimal Problem

Calculating D requires a technical challenge: tokens have different decimal places. USDC has 6 decimals, Ethereum has 18, Wrapped Bitcoin has 8. Before Balancer can do any math, it needs everything in the same format.

The process Balancer follows:

1. Scale all tokens to 18 decimals (_upscale() function)

2. Calculate D using the scaled numbers (multiple division operations, each rounding down)

3. Use D to determine swap amounts

4. Scale results back to native decimals

The problem: the specific function _upscale() always rounds down. When calculating D, multiple rounding-down operations compound. Under normal conditions, these losses are negligible.

Because BPT price depends on D (BPT price = D / totalSupply), if you can deflate D through accumulated rounding errors, you deflate the price of BPT.

The developers knew. They documented this: “This is the only place where we round in the same direction for all amounts, as the impact of this rounding is expected to be minimal.”

For normal trading, they were right. But Balancer wasn’t built for just normal swaps.

Three Features That Became Weapons

Balancer was designed for capital efficiency through three features:

Composability: You can trade BPT within the pool itself. You can swap your receipt token for underlying assets in the same transaction, without actually withdrawing first.

Deferred Settlement: Multiple swaps in one transaction don’t settle until the end. You can have temporary negative balances as long as everything sums to zero by the end.

Flash Operations: By combining these two features, you can briefly use more liquidity than you actually own. Within a single transaction, it works almost like having a momentary loan, as long as everything balances out by the end.

These features made Balancer incredibly efficient for sophisticated users.

They also made it possible to manipulate the conditions under which D was calculated, and therefore manipulate BPT’s price.

Subscribe now

3. The Attack

Links to Primary Attack Transaction here, Withdrawal Transaction here1

On November 3rd, 2025, someone executed one of the most mathematically sophisticated attacks in DeFi history.

The insight: those “minimal” rounding errors compound dramatically under specific conditions. The attacker discovered how to create those conditions.

Phase 1: Create the Conditions

Using Balancer’s three features in combination, the attacker drained pool liquidity to extreme lows.

They used Balancer’s ability to trade BPT inside the pool, combined with the fact that nothing settles until the end of a batch swap, to shuffle assets around in a way that pushed some token balances extremely low, all within a single transaction.

Balancer had safeguards: a minimum pool supply limit designed to prevent exactly this scenario. In practice, the combination of composable BPT and the rounding behavior let the attacker sidestep those protections and push certain balances to extreme lows.

Why Low Liquidity Matters

Consider what happens when Balancer’s code rounds down during calculations:

Example

• With a pool holding 1,000,000 tokens, rounding down by 1 token = 0.0001% error. Negligible.

• With a pool holding 10 tokens, rounding down by 1 token = 10% error. Catastrophic.

The rounding operation itself doesn’t change, it’s still rounding down by roughly the same absolute amount. But when the pool is nearly empty, that same rounding becomes a bigger percentage of the total.

This matters because D (the invariant) is calculated using the token balances in the pool. When those balances are small, every division operation in the calculation takes a larger percentage bite. The accumulated rounding errors cause D to be significantly underestimated.

Phase 2: Compound the Errors

With liquidity reduced, the attacker executed dozens of micro-swaps in alternating patterns, all within a single transaction.

Remember the swap process in section 2: scale up (rounding down), calculate D (multiple rounding-down operations), scale back (rounding down again). At normal liquidity, these losses are negligible.

At the reduced liquidity levels the attacker created, each iteration compounded the rounding errors as large percentage losses. Each new calculation of D used the deflated result from the previous iteration, building accumulated errors with every swap.

The attacker wasn’t guessing. They deployed a “math helper2” contract that searched for rounding boundaries, the exact token amounts where precision breaks down most severely, testing parameters to find the point of maximum exploitation.

Phase 3: Extract the Value

After dozens of iterations, D had been deflated significantly through accumulated rounding errors.

Going back to our formula: BPT price = D / totalSupply

With D artificially low, BPT was now dramatically undervalued. The attacker burned BPT to withdraw real assets. The pools calculated payouts based on the deflated D, giving them far more value than the BPT was worth.

Everything settled to zero at transaction end. Every swap was mathematically valid according to Balancer’s code. But the accumulated precision loss meant pools across multiple chains were drained of millions.

The Sophistication

This wasn’t discovered by accident. The attacker deployed custom smart contracts that executed the attack with precision, optimizing parameters to be able to extract as much value as possible. This required detailed understanding of StableSwap mathematics, Balancer’s rounding functions, and how to combine Balancer’s features atomically within a single transaction.

They deployed it across eight blockchains with the following results:

• Ethereum: $99M

• Berachain: $12.86M

• Arbitrum: $6.86M

• Base: $3.9M

• Sonic: $3.44M

• Optimism: $1.58M

• Polygon: $232K

Same vulnerability everywhere. Same method. Two hours. $128 million total.

Share

4. The Aftermath

The attack hit eight blockchains simultaneously. Same vulnerability, same method, different responses.

Every chain running Balancer V2 was vulnerable. 25+ protocols that had forked Balancer’s code inherited the same flaw. When Balancer broke, they all broke simultaneously.

The Whitehat Response

Not everyone was looting.

StakeWise executed emergency multisig calls, recovering $20.7M, roughly 73% of what was stolen from their pools. BitFinding bots intercepted $600K. Base MEV bots recovered $150K. Whitehats secured $4.1M from vulnerable pools before attackers could reach them.

Blockchain Response

Different chains made different choices about how to respond. Smaller chains went to extraordinary lengths to stop the attacker:

Ethereum: No changes. Transactions stood. Immutability over recovery. The original blockchain philosophy held firm even at $99M cost.

Berachain: Validators halted the entire chain. Executed an emergency hard fork. Rolled back the $12.86M theft completely.

Sonic: Deployed emergency freeze functionality mid-attack. Zeroed out attacker addresses on-chain, preventing fund movement.

Polygon: Validators censored the attacker’s transactions. Coordinated to freeze stolen assets without code changes.

Gnosis: Restricted outbound bridge activity to trap funds before they could escape to other chains.

DeFi’s composability, the beauty of money Legos that allows protocols building on protocols, code forking code, amplifies both innovation and vulnerability. A single flaw doesn’t stay contained. When one Lego block breaks in DeFi, you discover how many towers were built on top of it.

Subscribe now

5. Why Wasn’t It Discovered Earlier?

Balancer had elite security credentials: Trail of Bits, Certora, OpenZeppelin, ABDK. Over a dozen audits across four years. Billions in volume processed.

The gap: audits tested normal conditions. They didn’t test the adversarial rounding boundaries where precision breaks down under extreme low liquidity and repeated iteration.

6. Conclusion

This wasn’t a missing permission check or forgotten access control. This was mathematics weaponized at the boundaries where precision breaks down, by an attacker with incredible sophistication.

The Broader Pattern

DeFi’s composability amplifies both innovation and risk. When 25+ protocols fork the same code, they fork the same vulnerabilities. A flaw can hide for years, audited, battle-tested, processing billions in volume, then cascade across chains simultaneously once discovered.

Balancer had years of audits from elite firms. It didn’t matter. The code comment said impact “expected to be minimal.” For four years, it was. Until someone engineered the exact conditions where minimal became catastrophic.

Harry Donnelly is CEO & Founder of Circuit. Circuit’s platform protects against catastrophic digital asset losses and unlocks significant discounts on digital asset crime insurance from Lloyds of London underwriters. Reach out to learn more.

Credit to the great articles from Coinspect and Rekt below which I used to help gain a better picture of what happened during the exploit.

I was there.

After years of enforcement-by-litigation, the SEC is now engaging. They invited founders too early to afford lobbyists, companies innovating while navigating legal gray zones. If you only talk to players big enough to survive regulatory uncertainty, you miss what’s actually being built.

No policy came out of the meeting. Just questions that kept revealing the same challenge: crypto’s design principles conflict with the assumptions underlying financial regulation. That’s not a problem you solve with clearer definitions. It requires rethinking what regulation looks like.

The Reputation Problem

Someone noted that people working in crypto won’t put it on their dating profiles. They write “fintech” instead.

The room laughed. But it reflected a deeper point. Crypto has a reputation problem, and everyone in the room knew it would affect every discussion that followed.

Here were the questions on the table.

1. SHARED STANDARDS

Stablecoins, tokenized bonds, and crypto assets use the same blockchain rails. Regulators treat them like different species.

Should universal safety standards apply regardless of classification?

Cybersecurity already solved a similar problem. Traditional physical security wasn’t enough, so the industry developed shared frameworks. The NIST framework - Identify, Protect, Detect, Respond, Recover - works across all systems regardless of what you’re securing.

Could that approach work here?

Instead of debating what each token is, agree on baseline protections. Identify risks. Protect through custody standards. Detect threats. Respond to incidents. Recover from failures. Apply them universally, then layer specific rules by asset type.

Views split on who would set these standards and how they’d be enforced. But the point held: classification debates shouldn’t block basic safety measures.

The real question isn’t what to call things. It’s what protections should exist regardless.

2. SECURITIES LAWS AND TOKENS

Are all tokens securities? Should tokens that are sufficiently decentralized still be treated as securities? Can something graduate from being a security to not being a security over time?

If a project starts with founders controlling everything but gradually distributes governance and eliminates information asymmetry, does it stop being a security? Who decides? What’s the test?

Then someone cut through the theoretical debate with a practical question: even if definitions were clarified, would anyone actually want to register as a security?

Right now “utility token” often means regulatory arbitrage, avoiding SEC jurisdiction entirely. Everyone in the room knew this.

One view: clear rules drive compliance. The pushback: securities registration is expensive and restrictive. The costs and ongoing obligations weren’t designed for small teams launching with limited capital.

If the definition of what constitutes a security changed, would that make registration more attractive?

The conversation kept returning to this tension. Issuers want flexibility to build and adapt quickly. Investors need protection from fraud. Regulators need the authority to enforce rules. Those goals don’t naturally align.

You can clarify definitions all day. If compliance means giving up control and speed, people will engineer around it.

3. CENTRALIZED VS. DECENTRALIZED VENUES

Centralized exchanges can enforce rules and prevent manipulation. They also charge listing fees, often hundreds of thousands of dollars or sometimes 5-10% of a token’s total supply.

Decentralized venues spread across dozens of chains. No central authority. No KYC. Nearly impossible to oversee.

The tradeoff is fundamental: enforcement requires chokepoints. Chokepoints enable extraction.

Regulating frontends was raised, the interfaces users access to interact with decentralized venues. Pushback came quickly. Frontends are easily replaced or circumvented, and making user interfaces the enforcement layer sets problematic precedent.

Someone pointed out that liquidity naturally attracts more liquidity. Network effects concentrate activity over time. If you engage with the largest platforms, you reach the majority of activity without having to regulate every possible access point.

The question: in markets designed to resist oversight, where does regulation actually have leverage?

4. RETAIL PROTECTION

When retail access came up, heads nodded around the table.

Current rules bar Americans from most crypto investments unless they’re already wealthy. Accredited investor status requires $200,000 income or $1 million net worth.

Someone framed it bluntly: “We trust people with hundreds of thousands in mortgage debt and six-figure student loans. But won’t let them invest $100 in a token.”

Some of the greatest wealth-building investments of the past 25 years, venture capital, private markets, early-stage companies, are reserved for people already rich. The accredited investor framework doesn’t just assume incompetence; it blocks social mobility.

The practical result? Retail investors turn on a VPN and go offshore to exchanges with less oversight and fewer protections. The rules meant to protect them create greater danger.

America was founded on people taking charge of their own safety, security, and ownership. The regulatory approach has swung toward paternalism. The conversation explored whether returning closer to those roots makes sense, not abandoning protection, but trusting informed consent over blanket prohibition.

We built a system to protect retail investors. Instead, we pushed them to places with no protection at all.

Share

5. INFRASTRUCTURE & TRUST

Two connected problems: can you trust what you see, and who gets to see it?

Data Quality: If blockchain data isn’t accurate and verifiable, nothing built on it can be trusted. Right now participants choose between incomplete datasets, anonymous contributors, or dashboards with no methodology. Trillions trade on DEXs with price divergences of 2-3%, sometimes 50%+.

Traditional markets have verified data feeds. Crypto has competing unverifiable sources. Institutions can’t deploy capital into markets they can’t audit. Regulators can’t oversee what they can’t measure.

Privacy: New technologies like zero-knowledge proofs and fully homomorphic encryption are deployed now. They enable building applications on top of private information on encrypted data without exposing the underlying data.

But when law enforcement needs access, what happens?

Both reveal the same tension: markets need transparency to function, privacy needs opacity to exist. Building systems that satisfy both requires rethinking regulatory oversight.

6. BEARER ASSETS

One stat framed the problem: less than 5% of stolen crypto gets recovered.

Traditional finance assumes reversibility. Chargebacks. Clawbacks. Freezes. Insurance funds that make investors whole.

Crypto’s bearer asset nature breaks all of that. Transactions can’t be reversed or seized. That’s the point. But it creates a protection problem traditional tools weren’t designed for.

Prevention becomes everything. You can’t fix it after the fact.

Traditional insurance models, like SIPC for broker-dealers, FDIC for banks, don’t work for catastrophic losses where everything can be lost at once. The scale of potential crypto losses overwhelms these mechanisms.

This requires fundamentally different thinking. Not “how do we make investors whole after fraud?” but “how do we prevent fraud entirely?”

Traditional finance operates on “we can fix it later.” Crypto doesn’t allow that luxury.

That changes what protection means.

Subscribe now

Conclusion

Two hours of questions. No easy answers. But a pattern emerged.

Crypto’s core design choices - decentralization, immutability, privacy - collide head-on with assumptions that underpin modern financial regulation: intermediaries to police, transactions that can be reversed, surveillance to enforce rules. Those assumptions break when the system is borderless and trustless by design.

That’s why this conversation mattered. Not because it produced policy, but because it forced recognition of how deep the mismatch runs. Early-stage builders offered regulators something enforcement actions and public hearings can’t: unfiltered insight into where today’s rules break.

You can’t effectively regulate crypto by tweaking securities laws written for centralized issuers or by stretching 1930s securities law around blockchains. You need different frameworks. The SEC is starting to understand that. This roundtable was evidence.

For years the SEC filed lawsuits. Today they’re asking questions. That difference matters.

On September 8, 2025, SwissBorg lost 192,600 SOL (~$41 million) when part of its Solana staking infrastructure, operated through Kiln, was compromised.

This wasn’t a smash-and-grab. Eight days earlier, on August 31, a transaction that looked like a routine unstake of 975 SOL quietly reassigned authority over multiple staking accounts to attacker-controlled addresses. From that moment, effective control of the wallets had been handed over to the attacker.

Eight days later, in just three minutes, the attacker drained everything.

2. SwissBorg and Kiln

SwissBorg is a Swiss wealth management app with more than $2 billion in assets under management, known for simplifying crypto investing through its Earn products.

For Solana Earn, SwissBorg outsourced part of its staking operations to Kiln, a professional validator operator. This is common practice: wealth and custody platforms usually rely on specialist operators whose sole focus is validator uptime, efficiency, and staking infrastructure.

But outsourcing shifts risk. Once Kiln’s API was compromised, SwissBorg’s users were directly exposed.

3. The Setup: Authority Delegation

To understand this attack, we first need to understand how authority delegation works on Solana.

On Solana, every stake account has two forms of authority:

• Staker Authority: decides which validator the tokens are delegated to.

• Withdrawer Authority: decides who can withdraw the funds.

These authorities can be reassigned as part of normal operations. For example, if you switch validators, you might transfer the staker authority.

The attacker exploited this flexibility.

Think of it like the fine print in a contract: what looked like an ordinary transaction reassigned withdrawer authority to the attacker, giving them the ability to move funds directly.

The result was an account takeover. As seen in the Bybit exploit, the attacker first seized control of the account itself, and only later moved the funds.

4. The Transaction

On August 31, 2025, Kiln executed what appeared to be a routine unstake of 975 SOL.

Hidden inside, however, were eight instructions that reassigned control of different stake accounts to an attacker-controlled address.

From that point forward, the attacker had on-chain authority. They no longer needed to rely on Kiln’s API, they could withdraw funds directly, bypassing any of the transaction policies that had been put in place.

Share

5. The Blind Spot

Why wasn’t this caught?

Though not officially confirmed, the most likely explanation comes down to two factors:

• Kiln’s API policies only validated withdrawals, checking whitelisted addresses and amounts and did not parse authority changes and/or

• Blind signing allowed the transaction to slip through.

Blind signing is when a user or system approves a raw hexadecimal transaction without understanding its contents. On Solana, that might look like a long string such as 0x4f3cb2b… with no human-readable breakdown.

This should be decoded to make it human-readable, however there is always a risk it might be “blindly” approved by a human who “signs” without checking and realizing hidden authority changes were embedded. An API might auto-sign because authority instructions didn’t alter the destination of the unstake itself.

Either way, the result was the same: the transaction bypassed the checks in place, was signed, and instantly granted the attacker control of the stake accounts.

Analogy: It’s like approving a contract that you couldn’t read properly in order to process it quickly or a bank checking every wire transfer’s destination but ignoring the line where a new co-owner is added to the account.

There is also a more remote possibility that, similar to the Bybit exploit, the software decoding the raw transaction was manipulated to hide authority change instructions. However, no evidence or reporting has surfaced to suggest this occurred.

6. The Attack

Eight days later, on September 8 at 12:02 UTC, the attacker executed.

Over three minutes and eight transactions, they drained 192,600 SOL (~$41.5M) from the compromised stake accounts into the attackers wallet.

Subscribe now

7. The Aftermath

SwissBorg froze Solana Earn immediately and promised to reimburse all affected users. Kiln acknowledged the API breach, shut down affected services, and even exited its Ethereum validators as a precaution.

In the days following the theft:

• 189,524 SOL (now ~$44M) was transferred out to a single wallet and remains parked there.

• 3,000 SOL (~$0.6M) was transferred out via 3 transactions (here, here, here) and began multiple intermediate hops before being tested through exchanges, including a 100 SOL probe into Bitget.

Financially, the damage was containable. Reputationally, it was not. To customers, trust had been shaken in both SwissBorg and Kiln.

8. Why This Happened

Transaction policies by themselves are not enough. In this case, they failed to catch authority changes.

Once the attacker reassigned authorities, all other safeguards became irrelevant. Future filters may block this specific tactic, but attackers will always find new ways around static rules.

It isn’t just about where funds are going. It’s about who controls the account. When that shifted, silently, every transaction check could be bypassed.

9. The Last Line of Defense

The SwissBorg exploit shows why systems like Automatic Asset Extraction (AAE) are necessary. Human intervention cannot move at blockchain speed.

• If defenders had been able to automatically detect anomalous authority changes, the Aug 31 transaction could have been blocked.

Automated defences like AAE don’t eliminate risk entirely, but they ensure that even when attackers find gaps in transaction policies, assets can still be rescued.

10. Conclusion

The SwissBorg / Kiln exploit shows how $41.5M can vanish in minutes, not because security was absent, but because there are always gaps policies can miss.

On August 31, authority over accounts was handed to the attacker. Eight days later, that control became a full drain. The pattern echoes other exploits like the Bybit hack: attackers don’t just drain accounts, they can take control first, then move the funds rapidly.

At that speed, humans cannot react. Only automated defenses can protect funds at blockchain speed. That’s why Circuit is pioneering Automatic Asset Extraction (AAE): a last line of defense that safeguards assets even when attackers weaponize normal operations into takeovers.

Harry Donnelly is the CEO & Founder of Circuit. Circuit protects against catastrophic digital asset losses, whether from hacks, stolen keys, or key mismanagement. Circuit is pioneering Automatic Asset Extraction (AAE) technology which enables you to instantly sweep assets to safety the moment a threat is detected, without altering your existing wallet infrastructure. Reach out to learn more.

Thanks to TJ Connolly for reviewing drafts of this piece and providing feedback.

Two weeks ago, Arkham Intelligence announced the largest crypto theft in history. Not the $1.4bn Bybit hack, but something far bigger that's been hiding for five years.

Today, $15.7 billion sits untouched in the hacker's wallets. The theft happened in December 2020, but LuBian Mining Pool never told anyone. The crypto world assumed they'd shut down due to regulatory pressure. They were wrong.

It wasn't a sophisticated social engineering attack or cutting-edge malware. It was something far simpler. From the moment they were created, LuBian’s wallets were doomed. Their “random” generator produced private keys that could be recreated by anyone willing to look closely enough. When someone figured this out and was able to guess all the combinations, $3.5 billion vanished overnight.

The Bigger Picture

This mining pool's catastrophic security failure previews crypto's quantum future.

LuBian's theft shows exactly how crypto's quantum apocalypse could unfold: systematic encryption weakness, mass preparation by attackers, then coordinated execution that drains everything in hours before anyone can react. When quantum computers break current cryptography, the same attack methodology will scale to the entire crypto ecosystem.

History doesn't repeat, but it rhymes. Understanding what happened to LuBian isn't just crypto history, it's a warning about how tomorrow's attacks will unfold if we don't prepare today.

2. Setup

LuBian was a Chinese mining giant that at its peak controlled nearly 6% of Bitcoin's total hash rate; the computational power that secures the entire network. Their mining operations spanned China and Iran, managing billions of dollars in Bitcoin across hundreds of wallets.

Their mining rewards were visible on the blockchain, tagged with identifiers like "lubian.com" and "Buffett." At their peak in late 2020, LuBian's wallets held over 136,000 Bitcoin worth approximately $3.7 billion. Then it suddenly stopped.

LuBian's mining operations went silent in March 2021. No more blocks mined, no more public communications, no explanation. Their website remained online, but the mining pool that had controlled 6% of Bitcoin's security simply vanished.

The crypto community had a ready explanation: China was cracking down on Bitcoin mining. By May 2021, Chinese authorities had banned crypto mining entirely, forcing operations to shut down or relocate. LuBian's disappearance fit perfectly into this narrative.

Most didn't look closer. When a major mining pool goes dark during a regulatory purge, the default assumption is compliance, not catastrophe. And so the largest theft in Bitcoin's history went completely unnoticed.

3. Technical: What Actually Happened

Credit to the Milk Sad security research team who deserve recognition for the systematic cryptographic investigation that uncovered this vulnerability pattern. They go into granular detail across multiple posts: here, here and here.

They published this over a year before the Arkham announcement. Their forensic work revealed a flaw so fundamental it didn't just weaken wallets but made them predictable from birth.

The Random Number Generator That Wasn't Random

LuBian's wallet generation process used a pseudorandom number generator called Mersenne Twister MT19937 to create private keys. In secure systems, this should be seeded with a truly unpredictable number. Instead, the vulnerable implementation seeded MT19937 with a single 32-bit integer from the system clock: a Unix timestamp counting seconds since January 1, 1970.

The "random" sequence was fully determined by the exact moment the wallet was created. Same timestamp in → identical "random" output out.

The Mathematical Catastrophe

A Bitcoin private key should have 256 bits of entropy: 2^256 possibilities, more than the estimated number of atoms in the observable universe. LuBian's keys had just 32 bits of effective entropy from the timestamp: 2^32, roughly 4.3 billion possibilities.

Billions of possibilities sounds like a lot until you realize a gaming PC can crack them in hours.

It’s like the difference between a safe that would take longer than the age of the universe to crack and a suitcase lock you can try every combination on during a long layover.

Why These Wallets Were Born Broken

This wasn't a hack in the traditional sense. No breach, no malware, no insider theft. The private keys could be recreated entirely offline by anyone who knew the approximate creation time and replicated the flawed generation process.

It's like a bank vault where the combination is always the same if you know what time the lock was installed. If you can figure out the installation timestamp, you can open any vault using that system.

For LuBian, it meant every wallet created with this process was a ticking time bomb, waiting for someone to spot the pattern, rewind the clock to the creation moment, and recreate the private keys to empty the funds.

And in December 2020, someone finally did.

4. Execution

The Preparation Phase

The attack that drained LuBian didn’t begin on December 28, 2020. It likely started weeks or months earlier, unfolding entirely out of sight.

The first step was mapping the target. LuBian’s mining operations were highly visible on-chain, with block rewards flowing into easily identifiable addresses tagged with lubian.com and Buffett. From there, the attackers could isolate which addresses had been generated by the flawed wallet process.

The attackers built a complete database: every vulnerable LuBian address and its corresponding private key and balance. They pre-built automated scripts to execute hundreds of transactions, all using the same 75,000 satoshi fee.

The Coordinated Strike

December 28, 2020 began like any other day for LuBian. Over $3.7 billion in Bitcoin sat in what they believed were secure wallets.

Then the sweep began.

Hundreds of LuBian's wallets began emptying. Transaction after transaction, each signed with the perfectly replicated private keys, systematically swept funds to attacker-controlled addresses. The identical fees across hundreds of transactions made it obvious: this was a preloaded, automated execution, not a manual theft.

The attack lasted approximately two hours. By the end, 127,426 Bitcoin (about $3.5B at the time) had been drained to attacker addresses, while the remaining funds were moved to other LuBian wallets that the attackers hadn't compromised.

The Numbers

• Total BTC stolen: 127,426 Bitcoin

• Value at time of theft: ~$3.5 billion (2020 prices)

• Today's value: ~$15.7 billion

• Attack duration: ~2 hours

Subscribe now

5. Aftermath

The stolen funds weren't laundered or mixed through complex schemes. Instead, they were consolidated into large addresses. Today, those addresses still hold the Bitcoin, making the unknown attacker the 13th largest Bitcoin holder globally. For reasons unknown, they've never attempted to cash out this massive fortune.

The Realization

By the time LuBian’s operators grasped what was happening, $3.5 billion in Bitcoin was already gone. The human reality of a systematic crypto failure would have hit instantly: panic, confusion, and complete helplessness. These weren’t suspicious logins they could block or pending transfers they could freeze. Every transaction was cryptographically valid, signed with private keys the attackers had recreated. There was nothing to stop.

Mysterious Messages

Afterward, messages appeared on the blockchain using OP_RETURN transactions:

"MSG from LB. To the whitehat who is saving our asset, you can contact us through 1228btc@gmail.com to discuss the return of asset and your reward."

We have no way to know if these desperate pleas came from LuBian themselves or from the attackers who now controlled the same private keys. Both parties had identical access to send transactions from the compromised wallets.

Either way, no one ever responded.

The Cover-Up

LuBian never disclosed the $3.5 billion theft. They quietly shut down operations by March 2021 and moved on.

When the crypto industry noticed 6% of Bitcoin's hash rate had disappeared, the explanation seemed obvious: China's intensifying crackdown on crypto mining was forcing operations to close. LuBian's shutdown fit perfectly into this narrative. And so the largest theft in Bitcoin’s history vanished into the noise.

Subscribe now

6. Quantum Blueprint

LuBian’s hack is a preview of crypto’s quantum endgame.

For LuBian, the flaw was a pseudorandom number generator seeded with predictable timestamps. In the quantum future, the flaw will be universal: elliptic curve cryptography broken by Shor’s algorithm. The sequence is the same; a vulnerability hiding in plain sight, months or years of invisible preparation, and then a coordinated strike that empties everything before anyone can react.

The Preparation Advantage

This is the most chilling parallel. Quantum attackers won’t announce their breakthrough. They’ll work in total secrecy, quietly deriving private keys for every major wallet and exchange while the industry operates in blissful ignorance, convinced its cryptography still holds.

From Local to Global Scale

LuBian was one mining pool. One software flaw. 127,426 Bitcoin gone in two hours. Quantum will be different only in scope: every wallet, every chain, every protocol, all vulnerable at the same time. From retail wallets to institutional cold storage, nothing will be outside the blast radius.

Intelligence About the Future

LuBian’s story is a blueprint. It shows that when cryptography fails, the collapse is instant, irreversible, and total. The only difference between 2020 and the quantum future will be scale.

LuBian reveals the terrifying reality of cryptographic failure, what seems mathematically secure can become mathematically trivial.

7. Solutions: Building Defenses for Both Timelines

The Speed Problem

LuBian's theft exposed a fundamental flaw in crypto security. When private keys are compromised at scale, humans are powerless to respond in time.

From the moment the drainage began to complete emptiness: two hours. No emergency board meeting, or manual human coordination could have stopped the systematic sweeping of funds.

Attack timelines are compressing to machine speed while human response time remains frustratingly analog.

Immediate Protection: Automatic Asset Extraction

The solution isn't faster humans: it's removing humans from the critical path entirely.

Automatic Asset Extraction (AAE) continuously monitors for funds going to unauthorized destinations and immediately sweeps those assets to safety ahead of attackers. No human decision-making delays, just automatic response.

If AAE had been monitoring LuBian's systems, the system would have been able to respond to the systematic outflows in real-time and move funds to safety instead of watching $3.5 billion drain away.

Long-Term Preparation: Post-Quantum Cryptography

Automatic extraction buys time, but it’s not enough. Current elliptic curve cryptography has a mathematical expiration date. Once quantum computers cross the threshold, today’s keys will be obsolete overnight.

NIST has already published quantum-resistant algorithms, but full migration will take years. Quantum progress is moving faster than our defenses and the window for an orderly transition is closing fast.

Waiting for the first attack is waiting for a LuBian-scale disaster, only this time at global scale.

8. Conclusion

The Pattern

LuBian's collapse was a glimpse of what could come for everyone in crypto. Attackers will find the weakest link, quietly map it, and strike at machine speed to systematically drain funds faster than humans can respond.

Quantum computing will follow the same playbook: vulnerability → preparation → execution, everywhere at once.

The Choice

The lessons are simple but urgent: match the speed of defense to the speed of attack, and cryptography must stay ahead of computation. Automatic Asset Extraction can close the speed gap today. Post-quantum migration can close the cryptographic gap for tomorrow.

Final Thought

LuBian trusted the system clock, those predictable Unix timestamps that turned their "random" private keys into a countdown to disaster. Crypto can’t afford to make the same mistake with today's encryption. The clock is ticking.

Share

Thank you to the Milk Sad and Ledger teams who's references I relied on to piece this together. If you want to go deeper, I’d suggest reading their work:

https://milksad.info/disclosure.html#commercial-work

https://milksad.info/posts/research-update-7/

https://milksad.info/posts/research-update-14/

https://www.ledger.com/blog/Funds-of-every-wallet-created-with-the-Trust-Wallet-browser-extension-could-have-been-stolen

For major corporations and financial institutions that have been waiting on the sidelines, this regulatory clarity is the green light they have been waiting for.

In the report, the White House also acknowledged another reality: institutions still face major risks with digital assets. But beyond financial regulation and custody frameworks, it is recognition that digital asset cybersecurity is no longer just a subset of general cybersecurity, but a rapidly advancing discipline in its own right.

From Regulatory Clarity to Operational Risk

With regulatory barriers now falling away, operational security becomes the critical frontier. The focus shifts from "can we use digital assets?" to "how do we secure them at enterprise scale?"

The White House explicitly called for technical standards in digital assets to create “industry norms" and solve coordination problems (pages 39-41). The NIST Cybersecurity Framework has been the gold standard for cybersecurity for over a decade, and recent technological advances now make comprehensive application to digital assets possible.

What we're going to do is answer that call by showing how to apply the NIST CSF framework to address the institutional risks the White House identified, demonstrating how emerging digital asset security technologies provide systematic coverage across all five pillars.

For executives and risk managers evaluating digital asset strategies, understanding these developments is essential for implementing security that matches the sophistication of the threats.

Note: The White House report addressed both key management and smart contract security. This piece focuses on key management and custody, the foundational layer institutions need to establish first. Smart contract security represents a separate, specialized domain deserving its own analysis.

1. What They Got Right

Risk Analysis

The White House identified multiple risk categories for digital assets, including custody, fraud, privacy, and operational risks. Among these, key loss and key compromise stand out as the most fundamental threats; “loss or theft of a private key generally results in the loss of digital assets” (page 38).

The Scale of the Problem

The numbers validate their concerns. Approximately $350 billion in Bitcoin has been permanently lost due to key mismanagement. Unlike traditional finance where account access can be restored through identity verification, lost private keys mean lost assets forever.

Key theft presents equally devastating consequences. Private key compromises were the single most damaging attack vector in 2024, causing $930 million in losses (48% of total hack value), making it the most persistent threat facing institutions.

Unlike traditional financial systems where fraudulent transactions can often be reversed, blockchain transactions are immutable. Once funds transfer to an attacker's wallet, recovery through conventional means becomes extremely difficult, with only 4.2% of stolen assets recovered after loss in the first half of 2025.

The speed of these attacks makes traditional response effectively impossible. Hackers can move funds in as little as 4 seconds, while the fastest full laundering process takes under 3 minutes. The window for action closes almost instantly.

These represent existential operational risks that would be unacceptable for any institutional operation. The scale of historical losses demonstrates that digital asset security failures can be company-ending events.

These risks primarily apply to institutions operating on public blockchains with bearer digital assets. Permissioned networks, tokenized securities with traditional clearing mechanisms, and assets with built-in controls (like USDC's freeze functionality) may have different risk profiles and recovery mechanisms. However, institutions operating on public networks or with truly decentralized assets face these immutability constraints directly.

The White House deserves recognition for highlighting these risks with appropriate gravity. They understand the stakes and correctly identify what institutions need to protect against.

2. What They Recommended: Solid Foundation, Incomplete Picture

The White House recommendations focus on proven custody approaches (Page 33):

• Cold storage systems keeping assets offline and disconnected from networks

• Multi-signature wallets requiring multiple approvals for transactions

• Multi-party computation (MPC) distributing key generation and signing across multiple parties

These technologies form a solid foundation and belong in any institutional digital asset security setup. The recommendations align well with established cybersecurity principles.

Here's how we approached analyzing their coverage. The NIST CSF recognizes five essential functions for comprehensive cybersecurity:

• Identify: Understanding assets and risks

• Protect: Implementing safeguards and access controls

• Detect: Monitoring for security events and anomalies

• Respond: Taking action when threats are detected

• Recover: Restoring capabilities after incidents

The NIST CSF is intentionally principle-based rather than prescriptive; it defines what security functions institutions need but doesn't specify how to implement them. For digital assets, this means institutions must identify which specific technologies deliver each capability.

When mapped against the framework, the White House recommendations excel in two areas: Identify (risk assessment and asset categorization) and Protect (safeguards and access controls).

However, while the report mentions some detection capabilities like transaction simulation tools (page 121), it provides limited coverage beyond that and virtually ignores response and recovery entirely. This represents the gap that recent technological advances in digital asset security have been designed to address.

3. What's Evolved: Modern Digital Asset Security

Digital asset cybersecurity has rapidly evolved beyond traditional custody thinking. New technologies have emerged that directly address the key loss and key compromise risks the White House identified.

Here's what complete institutional coverage looks like today:

Identify & Protect (White House Covered)

• Risk assessment and threat landscape mapping

• Multi-signature wallets

• Multi-party computation (MPC)

• Cold storage systems

Modern protection capabilities have expanded to include:

• Hardware security modules (HSMs) for tamper-resistant key storage

• Advanced secure enclave technologies

• Distributed key management systems

Detect

Digital assets operate in an always-on, globally accessible environment requiring continuous monitoring:

• Real-time transaction monitoring systems scan for suspicious patterns, unusual destinations, or policy violations across multiple blockchain networks simultaneously.

• Transaction simulation technology analyzes proposed transactions before execution to identify potential risks, malicious contracts, or unexpected outcomes.

• Compliance monitoring systems that screen transactions against sanctions lists and regulatory requirements in real-time.

Unlike traditional banking systems that operate during business hours, blockchain networks never sleep. Detection systems must provide 24/7 coverage across multiple networks and asset types.

Respond

When threats are detected, institutions need immediate response capabilities:

• Automatic asset extraction systems (AAE) can instantly move assets to safety when threats are detected, without waiting for human intervention or complex approval processes.

Response speed is critical in digital assets. Unlike traditional fraud scenarios where banks can halt suspicious transactions, blockchain transactions are irreversible once confirmed. The window for effective response is often measured in seconds, not minutes.

Recover

Even with comprehensive protection, detection, and response, institutions need guaranteed recovery capabilities:

• Automatic asset extraction (AAE) can reclaim assets even in scenarios involving compromised keys or system failures, restoring operations immediately.

• Key backup and recovery (KBR) systems provide secure backup mechanisms that ensure key material can be restored even after catastrophic system failures.

Recovery serves as the final technology safety net. While traditional finance offers transaction reversals and deposit insurance, digital assets require recovery mechanisms designed specifically for immutable blockchain systems.

4. Why Complete Coverage Matters

Each capability addresses different failure modes that institutions will inevitably encounter:

• Protection prevents the majority of routine threats but cannot stop all sophisticated attacks or account for human error.

• Detection provides early warning when protection measures are being probed or compromised, buying crucial time for response.

• Response minimizes damage when threats break through protective measures, potentially saving institutions from the catastrophic losses identified.

• Recovery ensures business continuity even after worst-case scenarios, providing the safety net for institutional operations.

These capabilities work together. Weakness in any single area undermines the entire security posture. An institution with excellent key management but no threat detection might not realize they're under attack until assets are already gone. Similarly, sophisticated monitoring without automated response capabilities leaves institutions watching helplessly as attacks unfold in real-time.

As adoption accelerates, institutions with incomplete coverage will face higher insurance costs, regulatory scrutiny, and potential exclusion from digital asset opportunities

The White House correctly identified that digital assets require new security thinking. The specialized field has developed that thinking and built the technologies to implement it.

The Complete Picture

As Wayne Gretzky said, you need to skate to where the puck is going, not where it's been. The White House explicitly called for applying frameworks and standards to digital asset security and these may well become regulatory requirements in the future.

Smart institutions are getting ahead of these potential requirements by evaluating their current position. How well does your organization rank in terms of NIST framework implementation across all five pillars?

As regulatory clarity accelerates adoption, operational security excellence becomes the differentiator between organizations that capitalize on digital assets and those that become cautionary tales.

What This Means for Institutions

As regulatory clarity accelerates institutional adoption, operational security excellence becomes the differentiator between organizations that successfully capitalize on digital assets and those that become the cautionary tales the White house is trying to prevent.

Moving Forward

We're mapping how existing technologies and vendors measure against the complete NIST framework. Subscribe for our upcoming analysis showing exactly where different solutions fall, helping institutions evaluate their security options systematically.

Subscribe now

Harry Donnelly is the CEO & Founder of Circuit. Circuit protects against catastrophic digital asset losses, whether from hacks, stolen keys, or key mismanagement. Circuit is pioneering Automatic Asset Extraction (AAE) technology which enables you to instantly sweep assets to safety the moment a threat is detected, without altering your existing wallet infrastructure.

Thanks to David Schwed, Cristina Dolan, Yelena Osin and Chi Zhao for reviewing drafts of this piece and providing feedback.

The biggest hack in crypto history unfolded just weeks ago, $1.4 billion stolen from Bybit in a single attack. Even if they had an insurance policy, it wouldn’t have helped. As institutional money floods in, this gap between digital asset risks and insurance coverage is widening.

This final piece in our 4 part series (read part 1, part 2, part 3 here) examines what's holding the digital asset insurance market back, and where it's headed.

This article examines both current hurdles and future developments. You'll learn:

• The critical technical and regulatory challenges limit market growth

• How new solutions are addressing key problems

• Where institutional demand is driving rapid change

• What the next phase of digital asset insurance could look like

Current Market Challenges

Technical Limitations

While traditional insurers understand physical security and custody risks, most areas beyond that are challenging to assess due to either a lack of historical data or technical knowledge. Many new risks such as smart contract vulnerabilities or slashing don't have perfect parallels in traditional finance or cybersecurity. Without specialized technical knowledge, insurers struggle to evaluate these risks and new solutions emerging to address them.

Limited Historical Data

At its core, insurance is about converting historical data into future risk predictions. Traditional lines of insurance have decades of claims data to analyze. Digital assets present a challenge: limited history, rapidly evolving technology, and new types of risks. Without sufficient data to build accurate actuarial models, insurers either avoid coverage entirely or price in significant uncertainty premiums.

Regulatory Uncertainty

Regulation is becoming both a catalyst and a complication. Hong Kong, Singapore, the EU and Dubai’s VARA require licensed digital asset firms to maintain specific insurance coverage. For multi-jurisdiction firms, these varying mandates create compliance challenges and increase operational complexity. This makes writing global policies challenging.

But the real problem regulation poses is the amount of insurance some regulators require and the available capacity in the market. We touch more on this below.

Capacity Constraints

Combined together, all these challenges create severe capacity limitations. There is only a finite amount of capacity an insurer can underwrite against annually. Once it’s done for the year, they aren’t able to take on any more risk. Traditional insurers remain cautious about deploying significant capital into the digital asset space without better data and risk assessment tools. As a result, capacity remains concentrated among a few providers, particularly for technical risks, leading to high premiums and limited coverage options for institutions.

However, innovation is emerging to address these challenges, and market tailwinds are creating new opportunities for expansion.

Emerging Innovation

New solutions are addressing these core challenges, fundamentally reshaping what's possible in digital asset insurance:

Technology-Enabled Coverage

Innovation is transforming what's insurable in digital assets by shifting from compensation after loss to active prevention.

Circuit’s asset extraction technology automatically moves assets from danger to safety without taking custody of the assets. This makes it easier for insurers to underwrite policies like crime coverage because they can actively prevent loss events from occurring. This technology-first approach to insurance will eventually enable real-time, automated coverage adjustments based on actual risk levels. This shift from compensation to prevention represents a fundamental evolution in digital asset insurance.

Hybrid Market Structure

The insurance market itself is evolving beyond traditional models. New capital structures are being built directly on-chain, creating additional capacity through innovative risk-sharing models.

Native is a new insurance broker that understands both traditional insurance and crypto technology, bridging a crucial expertise gap. Hybrid approaches like this, combining traditional insurance expertise with crypto-native technology, are creating more flexible and comprehensive coverage options. For example, Native is able to layer in cover provided by discretionary mutuals like Nexus Mutual into regulated insurance programs, they are also able to create new cover products from scratch with policy limits denominated in digital assets.

Institutional Infrastructure

Institutional adoption is accelerating, with Bitcoin ETFs on track to hold over $100bn in the first year of trading. The institutional infrastructure in place which supports this, from custody solutions to trading platforms, is establishing the standardized risk frameworks that insurers require for efficient underwriting

This clear institutional demand is pushing major carriers who previously avoided the sector entirely to create specialized teams, recognizing digital assets as a permanent addition to the financial landscape. Reinsurance markets are starting to provide additional capacity, helping to reduce premium costs. A virtuous cycle, where increased institutional participation drives better insurance options, which enables further institutional adoption, will start to transform the market.

Looking Forward

Digital asset insurance is poised for rapid evolution over the next few years. These are key trends that are emerging and are worth watching:

1. From Specie to Technology Enabled Crime Coverage

The digital asset custody market is moving from headline insurance numbers to practical risk protection. Currently, custodians choose between two coverage types:

• Specie insurance: Treats digital assets like physical valuables in a vault, covering primarily cold storage with narrow terms but high limits

• Crime insurance: Provides broader protection against theft, fraud and social engineering but with historically lower limits

World renown names have marketed high levels of insurance coverage, sometimes in the range of $1bn. These policies often feature narrow coverage and substantial exclusions, functioning more as marketing tools than comprehensive risk transfer.

We believe this will change as more capital enters into the market. Companies will start demanding that their insurance premiums reflect the safety of their organisations and if not given, will either non-renew or buy lower limits. The most likely outcome will be for custodians to shift to wallet-specific coverage limits rather than maintaining blanket billion-dollar policies. Since no single event typically threatens their entire asset base, properly segregated wallet infrastructure enables more efficient, targeted insurance aligned with actual exposure

The coverage would also broaden to be more akin to crime to cover wallets connected to the internet. Embedding preventative technology will enable insurers to confidently offer this expanded coverage at lower premiums. This will create a more efficient solution that better reflects actual risk while still providing marketing value.

2. Real-Time, Usage-Based Insurance Models

The first wave of "blockchain in insurance" initiatives from 2017 is effectively dead. Those efforts failed because they focused primarily on transitioning insurance company operations to blockchain technology without delivering tangible benefits to end users.

The fundamental insight remains valid: distributed ledgers can transform insurance, but only if they provide what customers actually care about: better coverage, lower prices, or improved service, not just backend efficiency for insurers.

The true opportunity lies in creating entirely new business models that blockchain rails can unlock. As an example, insurers could now offer something unprecedented: real-time, usage-based insurance for digital assets.

Imagine "streaming insurance" that protects hot wallets only during the minutes assets are actually at risk. A trading firm could activate coverage the moment assets enter a high-risk environment and deactivate it when they move to cold storage. If assets are compromised during that window, the policy pays out automatically. This approach aligns cost directly with exposure and could reduce premiums dramatically compared to traditional annual policies.

These models represent a fundamental shift from time-based to activity-based coverage, similar to how streaming transformed entertainment from cable packages to pay-for-what-you-watch.

3. Balance Sheet Innovations

A structural innovation is emerging in how insurers manage their capital reserves. New providers like Soter and Tabit are building balance sheets denominated in Bitcoin, creating a powerful hedge against inflation.

This strategy mirrors what we've seen with public companies like MicroStrategy and Tesla adding Bitcoin to their treasuries. For the insurance industry specifically, this innovation addresses a core business challenge, the eroding purchasing power of premium reserves held in fiat currencies over the multi-year lifecycle of policies. We believe other insurers will start following suit.

4. The Convergence of Traditional and Decentralized Insurance

DeFi insurance (which isn’t technically insurance but discretionary cover) started out with ex-insurance professionals replicating an insurance company with smart contracts. Several companies have tried their hand at this, unfortunately, most have not survived past two years. This is for a number of reasons:

1. Distribution. Many of these startups didn’t understand insurance distribution. Most people hate buying insurance, which means it must be sold rather than bought. The fundamental principle of insurance; ‘the claims of the few are paid by the many’ must have the many to pay for the few. Without the many, the insurance provider goes bust. With established players in the space hoovering up the vast majority of the market, the smaller players couldn’t get to the critical threshold needed to support the business model.

2. Lack of Aggregation. Coverage was sold without understanding the impact of what one industry wide event could have on multiple clients. When the Terra Luna crash occurred, this one event wiped out a number of smaller providers which sold depeg insurance for Terra Luna.

3. Pricing Issues. These startups have historically been limited to onchain cover (depegs, slashing and smart contract risk), which is not easy to price given a lack of data. Coverage was sold cheap which didn’t protect the startup’s capital pool in the event of claims.

4. Difficulty. The insurance business model is harder than people give it credit for!

It’s important to analyse the early failures of these pioneers to understand what’s to come, because the market is now entering a second phase which will be where the game really changes.

In phase two, players with experience in traditional insurance will come in to bridge the gap. These insurers will operate smart contracts and regulated balance sheets to instantly bridge capital requirements. This would be as simple as a Lloyd’s underwriter switching her stamp from syndicate to company paper. Phase two will blur the lines between old and new and, we think, will be the upcoming challengers of the established incumbents.

5. Beyond Human Markets: AI as the Next Insurance Frontier

A longer-term opportunity is emerging that could dwarf today's market: autonomous AI agents as insurance customers.

As AI systems become increasingly sophisticated, they're already beginning to interact with blockchain networks. AI agents today can deploy smart contracts, manage digital wallets, and execute transactions with limited human oversight. The next logical evolution will be AI systems that autonomously manage digital assets, enter into contracts of their own volition, and require protection against operational risks.

Traditional financial infrastructure isn't designed for non-human economic actors, but blockchain networks inherently are. Their permissionless nature, programmable smart contracts, and ability to interact without human intermediaries make them the natural foundation for AI financial services.

By building on blockchain rails you’re not only building for the human population of today but for the millions of sentient AIs that need risk transfer solutions in the future. This could quite possibly be the biggest insurance opportunity ever.

Subscribe now

Conclusion: The Future of Insurance

Over this series, we've traced insurance from ancient merchants, to today's digital asset landscape, to its future frontiers. Let’s quickly recap:

Where We Started (Part 1)

The intersection of traditional finance and cyber insurance created something new. Early digital asset coverage focused mainly on physical security, treating cold storage like gold in a vault. But the industry needed more.

The industry evolved to incorporate smart contracts, blockchain and digital assets into risk transference to provide businesses a more fit for purpose product for managing these emerging threats.

Where We Are (Part 2)

Today's market shows stark contrasts. Some risks, like cold storage, attract hundreds of millions in coverage at reasonable rates. Others, like smart contracts, remain challenging to insure at any price. The market is fragmented, with capacity concentrated among few providers.

What's Changing

Several forces are reshaping the landscape:

• Institutional adoption driving demand for comprehensive coverage

• Regulatory frameworks creating clear operating environments

• New technology enabling previously uninsurable risks

• Traditional insurers building crypto expertise and balance sheets

• Innovative capital structures expanding capacity

What's Next

2025 looks set to be a breakthrough year. As standardization increases, capacity expands, and technology becomes embedded in coverage, we expect:

• More standardized policy terms

• Lower premiums as competition increases

• Technology risk mitigation providers becoming a requirement for coverage

For institutions entering digital assets, the message is clear: insurance is evolving from a barrier to an enabler. Those who understand both traditional frameworks and emerging solutions will be best positioned to protect their assets in this new frontier.

If you're looking to better understand your digital asset insurance options or how new technology can help protect your assets, reach out to Circuit or Native to learn more.

The first months of 2025 have marked two watershed moments in the digital evolution of US banks. Suddenly, crypto custody is possible.

The SEC's release of SAB 122 in January removed one of the largest barriers to digital asset custody, eliminating the punitive capital requirements that kept many institutions on the sidelines.

Today, just two months later, the OCC (the primary federal regulator overseeing national banks in the U.S) released Interpretive Letter 1183, further streamlining the regulatory path by removing supervisory pre-approval requirements for crypto custody activities. This one-two punch of regulatory clarity creates unprecedented opportunity for banks.

Golden Opportunity

The timing couldn't be better. Institutional demand for digital assets is surging, as evidenced by over $100bn flowing into US based Bitcoin ETFs. But ETFs represent just one piece of the opportunity. Digital asset custody services currently offer banks significantly higher margins than traditional assets and allow deeper client relationships for future products. And if Larry Fink and others are right that the future of finance is tokenized, digital asset custody is a logical first step for banks that want to do more than just stay relevant in the midst of technological change, but also benefit from new opportunities.

Until now, regulatory barriers made digital asset custody impractical for banks. Those barriers are now gone. This opens a huge opportunity to be taken advantage of. Banks have mastered custody over centuries, digital assets simply introduce new technical challenges to solve.

Smart institutions are already moving. They're building capabilities and setting up infrastructure now. The playbook is clear: Use traditional custody principles as foundation, leverage existing technology and apply proven security frameworks.

In this guide, we'll:

1. Break down the current regulatory landscape

2. Outline essential operational requirements

3. Provide practical steps for implementation

4. Show how institutions can prepare their infrastructure now

Regulatory Evolution

SEC - SAB121

Issued in March 2022, SAB 121 created a fatal problem for banks subject to SEC oversight who wanted to custody digital assets: they had to record custodied assets as liabilities on their balance sheet, requiring matching assets as an offset.

The math killed the business case. Custody $1bn in client’s crypto? You needed $1bn in capital on your books. No bank could justify tying up that much capital for a custody business. Meanwhile, crypto-native custodians not subject to SEC oversight faced no such requirements, creating an uneven playing field in the custody market.

SAB 122 removes this barrier. Banks subject to SEC oversight no longer need matching assets against custodied crypto. The accounting treatment now aligns more closely with traditional custody models, making the business viable for banks.

OCC - Interpretive Letter 1179

Issued in November 2021, OCC Interpretive Letter 1179 put a hard barrier in place for banks wanting to engage in crypto activities. It required a written supervisory non-objection from the OCC before being able to do so. We are not aware of the OCC having actually issued any such letters, effectively shutting down an entire business line for banks.

Under the prior administration, non-objections were effectively impossible to get, preventing banks from engaging with digital assets.

Letter 1183 effectively removes this requirement. Banks no longer need explicit pre-approval to move forward with digital asset custody, provided they have strong risk controls internally. However, the letter also notes that "as with any activity, banks must conduct all crypto-asset activities in a safe, sound, and fair manner and in compliance with applicable law." While the path to operating this space is now easier, banks must still demonstrate they can effectively manage the risks associated with digital assets.

Path Forward

With these major barriers removed, we expect banks to swiftly enter the space to capture first mover advantage. They will need to set up operations and develop risk management approaches that clearly demonstrate institutional-grade security, resilience, and compliance from day one.

Building Secure Custody Operations

Digital asset custody presents unique considerations for banks. In traditional banking, if someone accidentally wires $100m to the wrong account, you can usually fix that. Call up the receiving bank, explain the error, reverse the transaction. The money hasn't really gone anywhere, it's just database entries.

But in digital assets? If someone sends $100m to the wrong blockchain address, that's it. Game over. The assets are gone forever. You can't call the blockchain manager and explain the mistake. There is no blockchain manager.

Fortunately, even if regulatory clarity is still new, the fundamentals of digital asset custody are already well established. As detailed in "Demystifying Digital Asset Custody," securing digital assets requires multiple layers of digital and physical protection wrapped around a blockchain address. For a deeper understanding of how these security layers work together, see Circuit’s detailed breakdown here.

Each layer in the model serves a specific purpose, basically a different way of making sure nobody can accidentally (or intentionally) send assets to the wrong place, building outward from the blockchain address where assets live.

From the inside out, each layer serves a critical purpose:

• Blockchain Address: Where assets actually live

• Key Management: Securing private keys through advanced cryptography

• Physical Security: Protecting hardware and infrastructure

• Transaction Policies: Controlling how assets move

• Access Control: Managing who can do what

• Logging and Attestation: Tracking every action

• Audit and Compliance: Ensuring oversight

But security layers alone aren't enough - banks also need operational resilience. If your primary infrastructure fails, can you still serve clients? If key systems freeze, do you have alternate paths?

Building Resilient Custody Operations

Backup providers and wallets are a start but they’re not the full solution on their own. Having a fallback is one thing. Reaching it when everything else is failing is another. If your custody infrastructure provider locks up, how do you actually access and move assets quickly? Without a way to extract funds independently, even the best backups can become ineffective.

Best practice in digital asset custody isn’t relying on a single provider; it’s having multiple independent custody tech providers. This ensures operational redundancy, allowing institutions to maintain control regardless of which infrastructure provider they use.

But redundancy alone isn’t enough. The real challenge is execution. What happens if a custody tech provider fails - freezing transactions, becoming unresponsive, or suffering a security breach? How do you recover assets quickly even in the worst-case scenario, without relying on an unresponsive provider?

This is where Automatic Asset Extraction (AAE) comes in.

AAE enables institutions to withdraw assets directly from provider-supplied wallets and move them to an alternative provider, even if the failing infrastructure provider is completely unresponsive.

Crucially, this must be done without exposing sensitive private key material. Traditional solutions often rely on trust assumptions that require custodians or intermediaries to coordinate asset recovery. Asset extraction eliminates this dependency, ensuring that institutions maintain direct, independent control over their assets.

Circuit enables this capability by providing:

• Immediate asset recovery: Even if your custody tech provider fails

• Seamless fund migration: Move assets between providers with minimal third-party risk

• Continuous operations: Ensure assets remain accessible under any conditions

Custody isn’t just about storage, it’s about ensuring that institutions always retain the ability to move assets, regardless of failures.

With asset extraction, institutions achieve true operational resilience, ensuring that assets remain secure and always under control.

Subscribe now

Conclusion: Strategic Decisions

The digital asset custody landscape is transforming. SAB 122 has removed the key accounting barrier, and Letter 1183 eases the supervisory blocker. Now is the time to prepare and get ahead of competitors before the race begins. The firms that move thoughtfully now will shape this market.

Buy vs. Build – What to Consider

For institutions preparing custody operations, the key decision is whether to build infrastructure in-house or leverage external providers.

• Building offers control but demands deep security expertise and 18-24 months of development time alongside significant capital investment.

• Buying accelerates time to market but means integrating with third-party infrastructure.

A Layered Approach to Custody Security & Resilience

Whatever approach you take, a resilient custody setup requires multiple layers of protection. Institutions should ensure they have:

• Core Custody Infrastructure: Access controls, transaction policies, secure signing

• Backup Custody Tech Solutions: Secondary provider capabilities

• Asset Extraction: Business continuity protection designed to safely sweep assets between custody providers

• Backup and Recovery Mechanisms: Disaster scenario planning and/or trusted third parties to recover keys

The key is maintaining control of assets regardless of which providers you use. If primary systems fail, you need clear paths to maintain operations and protect client assets.

Looking Ahead

The digital asset custody market won't wait for perfect regulatory clarity. The institutions that build robust, resilient operations now will define industry standards and capture market share.

Success requires more than just secure storage, it demands operational resilience. The winners will be those who can maintain continuous operations and asset control under any conditions.

Circuit enables institutions to extract assets from any custody provider or wallet infrastructure, regardless of an incident or unforeseen failure. Utilizing Circuit’s proprietary Automatic Asset Extraction technology, institutions are able to bypass legal or tech related downtime to maintain operational continuity.

I’ll be at DAS NYC from March 17-20th. Reach out if you’d like to speak more about anything related to security, tech or custody!

Thanks to James Chartouni for reviewing drafts of this piece and providing feedback.

Yesterday, ~$1.4bn was stolen from Bybit. This is the largest hack in crypto history, completed by Lazarus Group, North Korea’s state sponsored cyber-crime unit.

It wasn't a hack of keys or passwords, it was something much more sophisticated. Attackers tricked multiple employees into approving a legitimate blockchain transaction. This seemingly routine transaction had a hidden flaw. A single parameter, buried in the transaction data, flipped from 0 to 1. That tiny change transferred full control of Bybit’s wallet to the attackers.

2. The Setup – How Crypto Exchanges Protect Funds

Exchange Operations

Crypto exchanges don’t store all funds in a single wallet. Instead, they separate them into many different cold and hot wallets for security, with the majority of assets kept in cold storage.

• Cold storage is like a bank vault. It generally involves a physical device kept offline which requires multiple layers of approval to move funds. You can learn more about the multiple layers of protection in digital asset security here.

• Hot wallets are like a cash register. They are connected to the internet for faster transactions.

When an exchange wants to perform day-to-day activities they transfer assets from cold storage to a hot wallet. Think of it like moving funds from the secure vault to a tellers drawer.

This is the routine operation Bybit was doing, something they had done countless times before. But this time it didn’t go to plan.

Bybit’s Set-Up

To reduce single points of failure, Bybit used Safe smart contract wallets instead of relying on a single private key.

Smart contract wallets are controlled by pre-programmed rules rather than a single owner. Safe’s code is public and audited, allowing anyone to view and verify how it works.

Safe requires multiple people to approve any transaction, just like a bank vault needing three different keys to open. This prevents any single person or compromised key from moving funds.

However, while this setup removed private key risks, it introduced complexity which the attackers exploited.

3. The Hidden Detail That Changed Everything

To understand the attack, we first need to break down how Safe transactions work.

Blockchain Transaction

A standard blockchain transaction is straightforward. When setting one up, you have to specify:

• from: Who is sending funds

• to: Who receives them

• value: How much is being sent

• data: Additional instructions if interacting with a smart contract

Safe Transaction

Safe transactions introduce extra parameters you have to specify. One critical parameter is operation.

When operation = 0 it executes a normal transfer of funds.

Setting operation = 1 it flicks a switch to allow an action called delegatecall. This allows the Safe wallet to run a different smart contract’s code as if it were it’s own.

Think of it like this:

• You sign off on a bank transfer. But a hidden checkbox in the fine print also adds someone else as a joint account holder with limited permissions.

• But because they now exist inside your account, they could escalate their permissions and take full control.

This is exactly how delegatecall was exploited in the Bybit hack.

Share

4. The Attack

On February 18th and 19th, the attacker deployed 2 malicious contracts, designed to be executed later. These contracts contained hidden code to allow the attacker to drain funds when executed. More details here.

On Feb 21st, when Bybit employees went to approve what looked like a routine transfer, they all checked the same user interface. According to Bybit, everything appeared normal.

But unknown to them the interface had been compromised, replacing the seemingly routine transaction with a new one. And hidden in that transaction were critical changes that reprogrammed the Safe wallet’s rules.

The Details

The approvers unknowingly approved a different transaction which included:

• operation = 1, enabling delegatecall

• to: set to the attackers first malicious contract address

• data: containing the address for the second malicious contract, which included the code to drain the funds

These attackers were sophisticated. They knew that the limited permissions of delegatecall alone wouldn’t let them steal the funds. So they executed a two-step takeover.

1. The first malicious contract was used to change the Safe wallet’s settings, swapping out its original code for their own

2. The second malicious contract became the new Safe’s code, giving the attackers control.

The attackers then swept all the funds to their own wallet.

Going back to our bank transfer analogy:

• After the hidden fine print added someone as a joint account holder, they then used the limited access to replace the instructions controlling your account settings with their own.

• After that they were able to withdraw everything.

  ---

Why Was The New Transaction Signed?

The exact method used to compromise the interface remains unconfirmed, and it is unclear whether it was due to a phishing attack, device compromise, or manipulation of Bybit’s signing process.

Regardless of what occurred, the malicious transaction was signed, enabling the attackers to access Bybit’s wallet using their own malicious contract.

Within minutes, the attackers started sweeping the funds to their own addresses, draining ~$1.4 billion.

5. The Aftermath

Immediately after the attack, blockchain analysts began tracking the stolen funds. The attribution to North Korea’s state-backed Lazarus Group was quickly confirmed, with their wallet addresses linked to previous large-scale exchange hacks.

The $1.4bn in stolen assets were quickly dispersed, with the attacker’s wallet initially splitting the funds across over 50 different addresses to obfuscate the trail. There are now over 900 address connected with the hack.

Where the Funds Are Going Next

The attackers’ next step will be to erase their tracks before cashing out, using tactics like:

• Bridging: Moving assets across blockchains to break transaction history and make them harder to trace. Lazarus has used this method in the $625m Axie Infinity hack to escape detection.

• Mixers: Blending funds with others to erase ownership trails. Lazarus has previously used mixers like Sinbad.io to disguise transactions.

Bybit’s Response

Bybit’s responded quickly and transparently. CEO Ben Zhou issued an immediate public statement, confirming the attack and ensuring withdrawals remained open.

Despite the severity of the attack, Bybit processed over 350,000 withdrawal requests in a short period, ensuring customers were not locked out of their funds.

The exchange also coordinated with industry partners to trace and freeze stolen assets. Some of the funds have already been flagged and frozen, with efforts ongoing to recover more.

What Happens Next

Law enforcement agencies and blockchain analytics firms are actively tracking the attacker’s wallets, monitoring for any attempts to convert funds into fiat. Their goal: freeze assets before they disappear into laundering networks.

This attack is still unfolding. As I write this, the stolen funds are bouncing across multiple wallets and networks, and security teams are racing to freeze them.

6. Conclusion

Was the Bybit hack preventable? Yes.

Additional levels of control and external verification could have flagged the malicious transaction, even if Bybit’s signing interface was compromised.

However, the real lesson from the Bybit hack isn’t just about one exchange and what went wrong. It’s about the broader operational risks in crypto.

Shifting from the frame of mind of “don’t get hacked” to “when an attack happens, how do we mitigate damage and respond effectively” is important as an industry to embrace going forward.

Traditional finance operates on “assume failure” mode. It builds layers of risk management, reserves, and response plans to minimize damage when things go wrong. Crypto needs to adopt the same practices industry wide.

No system is ever hack-proof. Attackers will always adapt, and once one vulnerability is fixed, another will be found. The real goal isn’t perfect security, it’s making exploits so difficult, costly, and detectable that they become impractical.

Security now means layering protections, enforcing stricter controls, and preparing to respond rapidly to events as they occur in real time.

With regulatory clarity on the horizon, operational risks will become the biggest challenge to digital assets to gain mass adoption. Lets work together to prevent that from happening.

Attacks like this won’t stop. But with better security controls, they don’t have to win.

At Circuit, we help businesses prevent operational risks like this - before they happen. Our tools are designed to safeguard digital assets, protect against worst-case scenarios, and reduce trust concerns in crypto security.

Want to understand what went wrong or explore ways to strengthen your security? Please reach out, we’re here to help.

Thanks to Dave Schwed and Gowtham Nagesha for reviewing drafts of this piece and providing feedback.

Today’s market has stark contrasts: cold storage coverage can reach hundreds of millions at reasonable rates, while smart contract coverage remains scarce even at premium prices. Understanding these dynamics and how claims actually work is essential for institutions managing digital asset risk.

This article breaks down two critical areas: the claims process and market economics.

You'll learn:

• How digital asset claims unfold, from detection to recovery

• What different types of coverage actually cost

• Why capacity varies from millions to billions by risk type

• Where gaps remain and opportunities in today's market

The Claims Journey

To help to take a deep dive into the claims journey and process, we looped in one of the world’s foremost experts in adjusting digital asset claims. Will Gow, Director and Head of Cyber and Technology Risks UK at Crawford & Company.

Digital asset claims combine traditional insurance processes with the more nuanced risks associated with blockchain capabilities. While physical insurance relies on tangible evidence of loss and cyber insurance on system/network logs, digital asset claims benefit from something unique; an immutable transaction record that can be crucial for both investigation and recovery.

The majority of claims in the digital assets industry presently fall into five broad categories of loss:

1. External compromise to the insured’s systems via threat actor hacking, which can cause system interruption, data compromise and restoration issues (very similar to a traditional cyber loss).

2. Theft of digital assets as a result of system compromise or compromise of physical security systems (including kidnap and ransom).

3. Suits arising from trading in crypto, issuing a token or providing services in the digital asset industry where a third party allegedly suffered a financial loss.

4. Collusion, private key backup loss or other cold storage loss.

5. Property damage to digital asset mining businesses.

As the field matures, this will expand and there are claim sub-categories that may fall within each of these broader categories. Some claims may also involve multiple loss issues or attack vectors. One area that has been drawing more attention due to recent press is kidnap and ransom in the industry, a growing problem within digital assets where transactions and holdings are in public domain.

Understanding the Process

A digital asset insurance claim typically follows these key steps:

1. Preparation/Mitigation: Before any incident occurs, having proper documentation, response plans, and risk mitigation tools in place. It is essential to regularly test and scenario plan, for example via table-top exercises.

2. Detection: Discovering the incident through monitoring systems, alerts, or observed anomalies. This must be proactive and include staff training, awareness raising, along with set key responsibilities for individuals.

3. Initial Response: The critical first 48 hours - containment, notification, and evidence preservation. It’s necessary to get the experts in fast and to have a coordination strategy, including the appointment of an Incident Response Manager to manage the various different vendors and parties.

4. Investigation: Piecing together what happened through system logs, blockchain analysis, and security audits. This takes specific expertise, as it’s necessary to understand the type of crypto asset involved, the systems concerned, and how the business operates. It differs from traditional cyber claims, in that often the ‘thing of value’ is what has been stolen (i.e., the intangible asset), whereas in mainstream cyber it largely concerns compromised data.

5. Verification: Proving the claim's validity to insurers through documented evidence. This includes understanding the more nuanced policy terminology when assessing not only whether there is coverage but also to what extent and over which period.

6. Recovery Attempts: Efforts to trace and potentially recover lost assets. To increase the chance of a potential recovery, this should be built into the coordination strategy from the initial investigation, otherwise it will be too late- funds become moved, mixed and placed out of jurisdiction very quickly. Early intervention is required, utilising the unique nature of blockchain public records to track origin and prove the movement of assets to obtain the relevant freezing orders/applications to the Court to the concerned financial institution (receiving account) or intervention via law enforcement.

7. Settlement: Final claim documentation, loss calculation, and payment. Understanding quantum is key and how to calculate in accordance with the policy terms, due to the sometimes volatile nature of particular crypto assets. Any settlement must be reached having managed the expectations of the parties and assessed as a reasonable outcome that is fair and in line with the policy wording.

Each step requires different expertise and tools, but all must work together for successful claim resolution.

Now let's examine each step in detail, we’ve used the example of a cyber breach that resulted in either compromised data or theft of digital assets. Each of the above steps have been broken down into bullet points that touch on the most important parts.

1. Preparation - Success starts long before any incident. Well prepared businesses maintain:

• Detailed documentation of security controls/internal procedures

• Clear incident response plans (stored offline and only accessed via limited staff)

• Business continuity procedures, to minimise the impact of Business Interruption

• Communication protocols/PR management strategy both internally and externally

• Recovery tools, risk mitigation software and partnerships, strategically managed and reviewed periodically

Like a fire drill, every stakeholder needs to know their role and have the right tools ready before an incident occurs.

2. Detection - Claims require rapid identification through multiple channels:

• System/network logs and alerts

• On-chain transaction monitoring

• Blockchain analytics

• Behavioral analysis

• Staff observations

• Customer reports

• Dark web monitoring

• Threat Intelligence assessments

3. Initial Response - The first 48 hours are crucial:

• Immediate containment of affected systems

• Urgent patching

• Notification of key stakeholders

• Preservation of evidence

• Engagement with insurers

• Activation of response teams and Incident Response Plan

• Threat actor engagement/negotiation

• Initial asset tracing / sanction checking

• Mitigation of Business Interruption

4. Investigation - Once immediate response measures are in place, detailed investigation begins:

• Analysis of system logs, audit trails, processes and procedures

• Blockchain transaction tracing

• Review of security footage and access logs

• Staff interviews

• IT Forensics Root Cause Analysis Report

• Legal assessment of any potential breach/regulatory issues

• Consultation with PR on comms strategy

• Determination of quantum and early policy assessment

• Timeline reconstruction/chronology of events

• Engaging with law enforcement, NCSC, where appropriate

5. Verification - Insurers need clear evidence to validate claims:

• Proof of security controls in place, in line with the Statement of Fact or application form

• Documentation of procedures followed

• Evidence of breach method/causation

• Quantification of losses and adjustment

• Compliance with policy conditions

• Expert analysis reports / supporting documentation

6. Recovery Attempts - Multiple paths to potential asset recovery:

• Asset tracing through blockchain analysis

• Law enforcement cooperation

• Legal proceedings if perpetrators identified

• Negotiation with threat actors (in some cases)

• Technical recovery solutions (blocking on-chain transfers/freezing funds)

• Emergency response and recovery services

7. Settlement - The final phase involves:

• Complete claim documentation/ final reporting

• Loss amount verification

• Coverage confirmation

• Payment/Indemnity processing

• Lesson implementation/security improvement plan

• Risk Consultancy

• Policy adjustments

While no institution wants to file a claim, understanding and being prepared for this journey is crucial for any serious digital asset operation. It's also useful to understand that most insurers and their appointed adjusters are there to support you and try to mitigate further risk or exposure. The key is having the right expert in place to coordinate the initial efforts within that first 48-hour window.

As the market matures and more claims are processed, these procedures will standardise and uniformity increases along with knowledge of best practices. For now, the best protection comes from thorough preparation and working with experienced partners who understand both traditional insurance and digital asset complexities. A joint-up approach is pivotal to a successful response and for the organisation to return to business as usual as quickly as possible.

And remember, when in doubt, notify! It’s much better to notify your broker of the circumstance than try to sort it out yourself and use insurance retroactively. This is key as the policy could deny coverage for late/no notification.

Market Analysis: Understanding Coverage Economics

With the claims process mapped, let's examine what this protection actually costs and why capacity varies so dramatically by risk type.

We'll focus on four core coverage types that highlight the market's evolution:

• Cold storage/specie coverage (the traditional approach)

• Hot wallet protection (where cyber meets crypto)

• Smart contract coverage (the new frontier)

• Cyber insurance coverage (cyber without crypto loss)

For each, we'll examine available capacity, premium ranges, and what drives these economics.

1. Cold Storage/Specie Coverage

Specie coverage, traditionally used for protecting physical valuables like gold and cash in vaults, has been adapted for digital assets held in cold storage - essentially, private keys stored in secure, offline facilities (this is covered in detail in Part 1). This segment represents the most mature segment of digital asset insurance.

Traditional insurers understand it - protecting private keys in secure facilities isn't fundamentally different from protecting gold bars in those same facilities.

Some wordings are written on a Named Perils basis, this means that only the risks that are specifically named in the policy are covered, rather than being written on an All Perils basis and then excluding the risks that the insurer doesn’t want covered. Whichever way the policy is written the same principle applies, the definition of what is covered is narrow (as compared to a crime policy) which allows the rate to be less expensive than a crime policy with limits many multiples higher.

Capacity

This segment has the deepest capacity in digital asset insurance. Individual policies can reach $1bn, with multiple traditional insurers actively participating. Lloyd's syndicates typically lead these programs. Because traditional insurers are more comfortable with these risks, capacity is larger than other areas - and this competition helps keep prices lower.

Premium Economics

Rates will start close to 1% of insured values and then drop as the limit increases. We typically see rates between the 0.5-0.8% range for custodians with good security and proper duty segmentation in place. While physical security might keep external threats at bay, the biggest risk remains “trusted” employees working together to compromise assets. This "insider threat" challenge remains one of the problems that is hard to completely mitigate away from custodians.

2. Crime Coverage

Crime coverage is similar to cold storage in that it covers a company for the loss or theft of a digital asset, but it differs greatly in the coverage offered. While cold storage or specie coverage has a narrow policy language but can offer large insurance limits, crime coverage does the opposite. It offers lower limits (typically between $2m-$10m) but a much broader policy wording to cover more attack vectors to the company. For example, a typical ‘hacking’ style attack where an attacker compromises an API co-signer or manipulates an internal system to allow for a fraudulent transfer of assets is covered under a standard crime policy but excluded in a cold storage policy.

Capacity

This area can fluctuate more than cold storage but total/ maximum capacity for any one risk would be in the area of $100m with markets typically taking max lines of $5-10m per risk.

Premium Economics

Rates will be between 1%-2% depending on security of the system, duty segregation, cyber security and how much value is sitting in the wallets. We also closely analyse Transaction Authorisation Protocols (TAP) to understand who has access to the assets, under what circumstances and what each user’s role is for any given transaction or function.

3. Smart Contract Coverage

Smart Contracts are open source programs which run on blockchains. Digital assets can be held in these contracts, allowing them to be used for financial functions like lending, borrowing etc. This coverage covers companies for theft or loss of digital assets being held in a smart contract.

Unfortunately, smart contract coverage in the regulated insurance market has been incredibly limited with only one or two markets offering affirmative coverage for them. This is due to the following:

• More education needed by insurers to understand smart contracts, attack vectors and adequate pricing

• High premium relative to limit

• Low capacity relative to Total Value Locked (TVL)

Although the first point is important, it’s really the last two that have constrained the industry. Smart contract developers who want insurance face rates upwards of 5% (i.e. $50k per $1m in cover) and can only buy a small amount of the cover they need. To really understand this, we’ve put together the following scenario:

Smart Contract Company Ltd (SCC) has developed a smart contract and has amassed $50m of value locked to the protocol. SCC has paid for 2 independent third-party auditors to review the code, which has been completed and any recommendations have been implemented. SCC now wants to buy an insurance policy for the full value of the TVL ($50m) and so turns to the regulated insurance market. SCC contacts their broker who finds them a $20m policy (with all options exhausted) that costs $1m in premium. The premium has to be payable in USD and in order for the policy to pay out SCC needs to be sued by a third-party that has suffered a financial loss (standard Technology Errors & Omissions language).

It is now a business decision for SCC to either put the policy in place or not. They need to weigh up the benefits against the costs and sign off on a large premium cheque. If you were on the board of directors, what would you do?

Capacity

Total capacity is hard to put a figure on as companies can access discretionary cover for smart contract risks via Nexus Mutual and potentially layer on traditional cover over top of the discretionary cover or use it as a primary policy for Nexus to write excess. Although it’s hard to put a total cap on available coverage, this is in the area of $50m for any one risk using a mix of regulated insurance and discretionary cover.

Premium Economics

Businesses looking for coverage for their own smart contracts should be prepared to pay at least a 5% rate for their risk via regulated insurance. If discretionary cover is chosen the premium paid can be less than regulated insurance but will rely on the mutual participants (or the company’s own wallet) for the amount of capacity that can be granted.

4. Cyber insurance Coverage

Cyber insurance covers the insured companies for a number of potential loss scenarios:

• The loss or compromise of client data

• Restoration costs if an attacker is able to encrypt their systems and ransom payment

• System business interruption costs for the downtime and lost revenue a company faces if a cyber event does occur

• Liability (coverage for lawsuits) for any breach of duty that the company owes their clients

It’s a misnomer that cyber coverage includes coverage for the loss or theft of digital assets by hacking, this isn’t the case as this risk is covered off by the Crime markets. Cyber insurance is therefore only for the pure cyber risk the company faces outside their on-chain operations (data privacy, legal support, PR, ransomware, business interruption etc..). Although cyber liability doesn’t cover theft of digital assets, it does cover some very important threat vectors that attackers can exploit to damage the company. For example, a white label exchange operator who developed the backend exchange stack for third-party companies to use and white label to run their own exchanges was hit with ransomware. Not only did the ransomware encrypt all the company’s systems but also meant that their clients could no longer operate their exchanges as well, leading to very high business interruption costs and lawsuits from their clients.

Another prominent case involved a cold storage hardware wallet manufacturer who had a data breach of one of their suppliers. The supplier to the company leaked client lists including name and email addresses to the dark web. This information was bought and harassment then ensued from the attackers to the individuals on the client list in the form of scam emails and calls. The attackers knew these individuals had digital assets they were custodying and so tried various means to scam them into exposing their private key information.

Capacity

Cyber capacity is limited by the type of risk and domicile of the companies that are looking for this coverage. For example, London markets would have limited appetite for a crypto exchange operator with poor cyber controls located in the USA than they would a custodian with strong cyber controls domiciled in Singapore. Most of the capacity largely comes down to how robust their cyber security is, the impact a hack could have and the jurisdiction the insured company operates in.

In London, there are approximately a handful of companies offering cyber coverage. But if we had to imagine the perfect risk with the most robust cyber security controls in the centre of the insurer’s appetite, total capacity could get to around $25m-$35m.

Premium Economics

Premium for small companies can be in the 2%-3% range ($20k-$30k) with larger companies rarely below 5% ($50k).

Coverage Limitations

Coverage limitations will change and vary depending on your policy wording so it’s best to have a thorough read and understanding of it to understand what you’re covered for and your obligations in the event of a potential claim.

Here are some common coverage limitations for the covers we highlighted above:

Cold Storage:

Cover is limited to the private key material of the company, this means that there needs to be a transaction signed by the private key of the company for there to be coverage in place. This means that there would have to be theft or collusion in order for a valid claim to be made. Another limitation to this coverage is that each cold storage policy has an associated Risk Management Protocol (RMP) for the particular client which outlines exactly how a transaction is signed and the people required in the signing process. If there is a deviation or a change of the RMP and it’s not notified to the insurer and there’s a loss as a result of it, there could be no coverage.

Crime Coverage:

Crime policies do not cover risks related to kidnap and ransom of the insured or the insured’s employees and family. Kidnap and ransom risks are particularly important for companies in the digital asset space due to the price appreciation of the underlying asset. It is important to know about this limitation and seek specialist kidnap and ransom cover for your company.

Smart Contract Coverage:

It’s important to understand how the policy gets triggered when a company buys a smart contract policy. For example, if your coverage is written on a ‘Claims Made’ basis, a lawsuit needs to be levied against the company in order for the coverage to trigger. That means even if a loss of assets occurs during the policy period as a result of a hack (or other covered claim) coverage doesn’t yet apply until the company has been named in a lawsuit. This is called ‘third-party liability’ cover which comes to the rescue once a lawsuit (or threat of a lawsuit) is made against the company. This is different to ‘first-party’ coverage which is what discretionary coverage is written on, this means that once a hack has been verified a claim can be paid out, regardless if there has been a lawsuit or not.

Cyber Insurance:

For coverage to apply to a company buying cyber insurance the claim has to be brought against the company and not have been excluded by the policy conditions. The exclusions will typically exclude coverage for theft of digital assets as well as the fluctuation of the currency which means if there is a theft of the assets there won’t be any coverage under the cyber policy for the restoration of the assets or the lost revenue as a result of the hack.

Conclusion

The world of digital asset insurance is complex and even professionals who have spent their entire careers in the insurance industry struggle to understand the nuance that digital assets bring to coverage. By exhibiting characteristics of many different asset types and also exhibiting some only reserved for itself, digital assets are both redefining policy coverage and enabling forward thinking insurers to capitalize on an incredible opportunity. Companies in the digital asset economy are pushing the world forward by their innovations in value transfer, accounting and accrual and only by a liquid insurance market can they realise the extent of their ambitions.

In our final instalment we’re going to be looking at some of the current challenges in the market and what the future holds for this incredibly important space of insuring the new economy.

Subscribe now

In Part 1, we traced insurance's evolution from ancient merchants through cyber coverage. Now let's examine who's actually protecting digital assets today.

The market has three main segments: traditional insurers adapting old models, crypto-native solutions building new ones, and tech providers bridging the gap. Each approaches digital asset risk differently. Understanding these differences - and the gaps between them - is crucial for institutions entering the space.

This article maps today's landscape: the providers, what they cover, and how they assess risk. You'll learn:

• Who the key players are in each market segment

• What coverage types actually exist

• How providers evaluate and price risk

• What a typical day looks like for an underwriter

The Players

Insurance involves two roles, regardless of asset type:

1. Underwriters: assess risks and provide capital to cover them. They determine what risks they'll accept, set premiums, and pay claims when losses occur. Most people think that insurance companies make money from insurance, whereas they actually make a large portion of their money from investments. Insurers are measured on loss ratios which are the difference between the premium paid to them and claims paid out. Most insurers want to run a sub-90% combined loss ratio, which includes claims payments, broker commissions and operational expenditure. In this scenario, the insurer would make 10% profit for the year of account. In bad years, carriers can run 120% or even 200% in combined loss ratios which would mean for every $1 they took in they paid out $2.

2. Brokers: connect clients with underwriters. They understand client needs, find appropriate coverage, and help structure solutions. Think of them as insurance matchmakers. Brokers make money by taking a commission from every account they place with insurance companies. The premium that is quoted to the end client incorporates the commission that the insurance company pays, this generally ranges from 15%- 35%. Brokers can also be remunerated by something called Contingent Profit Commission (CPCs) which is payable by the carrier to the broker for writing profitable business. In this model, insurers pay the broker a bonus for business that doesn’t have a claim with the carrier over a period of time. This CPC can be very lucrative for brokers and incentivises them to place a large amount of low risk business with carriers that offer this structure.

Digital Asset Structure

In digital assets, this traditional structure has evolved into three categories:

1. Traditional Players: Established insurers and brokers adapting their models to digital assets. They bring deep capacity but often limit coverage to familiar risks like cold storage.

   1. Underwriters: Lloyd's syndicates lead specie coverage, focusing on cold storage where risks mirror traditional custody. Major carriers like Arch and Canopius provide significant capacity but maintain strict risk controls.

   2. Brokers: Marsh, Aon and other global brokers leverage institutional relationships to arrange coverage. They excel at larger multinational programs but often lack deep crypto expertise, agility and technology integrations.

2. Crypto-Native Solutions: New providers built specifically for digital asset risks. They understand technical complexities but typically lack the financial strength rating or the brand power that the established insurance companies have..

   1. Underwriters: Focus on technical risks traditional insurers avoid - smart contracts, D&O liability, hot wallets, mining operations. Underwriters like Relm, Evertas and Soter have emerged over the past few years to take on risks that traditional underwriters haven’t been ready to assess.

   2. Brokers: Specialized firms combining insurance, onchain capabilities and crypto expertise. These firms help structure coverage for novel risks and navigate technical requirements in both the traditional insurance market and the onchain one. Native is a new broker that combines their broking experience and relationships with onchain capital and capabilities.

   3. Marketplaces: Crypto native companies grew tired of traditional insurance recognising and responding to novel risks in the DeFi space, so they went out and built their own. The largest and best known of these companies is Nexus Mutual. Risks tend to revolve around smart contract hacking and slashing.

3. Tech Providers: Build tools both sides need to make digital assets insurable at scale - from risk monitoring, to marketplace infrastructure, to claims verification. Circuit is a tech company that provides keyless recovery services to ensure companies never lose access to their private keys, this in turn improves the risk profile and allows companies to get a discount on their insurance or help make them insurable in the first place.

Current Market State

Today's market remains heavily skewed toward traditional players, but also remains fractured. Most capacity sits with established insurers and brokers, focusing mainly on cold storage risks they understand well. However most insurers are certain they have the correct wording and risk framework over their competitors. This has led to some markets preferring to not work with others who have different wordings, ratings or underwriting rationale than them. Acknowledging the nascent nature of crypto along with the promise of growth in the space, each player is keen to protect their competitive advantage which can sometimes mean not collaborating or sharing risk with each other, which comes at the disadvantage of the client.

Crypto-native solutions (specifically onchain insurance solutions for smart contract hacks and slashing), while growing, represent a small fraction of available coverage. This imbalance creates challenges - traditional players hesitate on technical risks, while crypto-native providers lack the financial strength rating and capacity major institutions need for contracts or their own risk management appetite.

Even with the fractured state of the market, there has never been more insurance companies writing digital asset risk. With the maturation of the digital asset industry, new insurers are starting to take notice and write policy wordings that they’re familiar with.

Subscribe now

Types of Coverage

Specie Insurance is like a high-tech version of traditional vault insurance, specifically designed for cryptocurrency cold storage. Think of it as protecting crypto assets when they're stored offline in secure facilities. It kicks in if private keys or hardware devices are physically stolen, and importantly, it also protects against insider threats - like if employees or authorized signers try to collude to steal assets.

Hot Wallet Coverage is essential for any crypto business keeping assets in internet-connected wallets. It's similar to having insurance for an online bank account, protecting against various digital threats. Whether it's hackers breaking in, dishonest employees stealing funds, or simply human mistakes in operations, this coverage helps manage those risks.

Smart Contract Coverage is particularly interesting because it protects against the unique risks of blockchain technology itself. If there's a flaw in the code that powers a blockchain application, or if someone finds a way to exploit the economic mechanics of a protocol, or if the protocol itself fails in some way, this insurance helps recover those losses.

Miner Insurance is more traditional in nature - it's essentially business insurance for crypto mining operations. It covers physical damage to mining equipment which is crucial given the significant investment in mining hardware and facilities.

Insured Wallets represent an innovative approach to crypto security. Rather than just compensating for losses, these solutions actively help recover access to digital assets if private keys are lost or if the wallet provider fails. It's like having both insurance and a backup system in one.

Directors & Officers (D&O) insurance is vital for anyone in leadership positions at crypto companies. Running a digital asset company involves making complex decisions in a rapidly evolving space. This coverage protects executives if their business decisions result in legal challenges or claims against them personally.

Errors & Omissions (E&O) insurance protects crypto businesses that provide services to clients. If a custody service accidentally loses client funds, or if a trading platform makes a serious mistake that costs clients money, this insurance helps cover those losses.

Risk Assessment Framework

Risk assessment frameworks change depending on what type of coverage a company is looking for, however, we posit that there is more interconnection between risk factors than historical underwriting takes into account. As a starting point, let’s go through what underwriters take into account when underwriting some of the above products:

Hot Wallet Coverage:

As hot wallet coverage protects the clients against crime attacks (mostly cyber attacks and social engineering) underwriting this risk comes down to the cyber security the company has in place. This is also coupled with how the client is safeguarding their private keys and how a transaction can be authorised. There is also underwriting around the types of people that are working at the company, even going so far as to understand how background checks are done and who has ultimate authority when things go wrong.

Here is a non-exhaustive look at what underwriting questions could be asked when assessing Hot Wallet risk:

Directors and Officers Liability (D&O) insurance

D&O is the most commonly sought after policy that a company can take out when operating in the digital asset space. Unlike the other policies in this list, D&O policies pay out on behalf of the personal assets of the directors which means it provides an important layer of protection for directors of the company.

Here is a non-exhaustive look at what underwriting questions could be asked when assessing D&O risk:

Miner insurance

Miner insurance is a fascinating area of the insurance industry and is one of the most rapidly growing sector out of the entire digital assets ecosystem. Mining insurance protects Bitcoin miners against physical loss of their miners, this could be from fire, flood, earthquake, theft, lightning and hurricane or windstorm. As the value of Bitcoin increases, so does the need for miners to offset their risk onto a balance sheet to enable effective use of their funds and free up operating cash flow.

Here is a non-exhaustive look at what underwriting questions could be asked when assessing mining infrastructure risk:

As seen in the three examples, the underwriting employed is diverse depending on what types of risk is being transferred to the insurer. Although all three risks are different (cyber, physical and liability), we believe that asking some questions from other lines of coverage can enhance the underwriting of another. For example:

• Understanding the financial health of the company can lower cyber risk. If the company is healthy, they are more likely to spend money on cyber risk management and mitigation.

• If the company has robust cybersecurity frameworks in place, there is less of a chance for attackers to compromise the physical security around a mining location that could be used in a multi-step attack.

• If the company has invested in physical security and proper building practices, the directors and officers are less likely to be held liable should an attacker succeed in stealing valuable computing hardware.

So although each of these covers are distinct, a good underwriter takes into consideration other factors that are outside of their typical underwriting framework. Having a holistic approach to the risk enables the underwriter to charge the appropriate rate and for the client to get the right coverage, tailored to their needs.

We’ve taken a look at the risk analysis that an underwriter would do for a risk in the digital asset industry. But what would a day in the life of an underwriter look like?

A Day in the Life of an Underwriter:

Underwriters typically start their day with a mix of underwriting new and renewal accounts. New accounts will be sent to them from brokers and the risk will be their specific area of expertise (D&O, Professional Indemnity, Cyber, Crime etc.). Underwriters will prioritise the urgent accounts that need terms for a deadline or high value accounts. Underwriters can have anywhere from 1 to 30+ accounts to work on in a day (depending on the complexity, size and urgency), in addition to this they also have other tasks:

• Book analysis (business plans, projections and loss ratios)

• Managerial duties

• Mid-term changes on their current accounts

• Client and broker meetings

Most underwriters have a high workload and stringent underwriting authority guidelines that they have to work within. Underwriting authority is the amount of policy limit an underwriter can write without getting approval from their line manager, as well as the class of business. For example, an underwriter could put out a $2m limit without getting approval from their manager, but if the limit is $3m, they then need approval before terms could be released.

For most underwriters, crypto is an excluded class of business from their underwriting authority, due to their ultimate capacity provider or treaty reinsurance restrictions. This means that if a business with crypto exposure comes across their desk they’re already anticipating it’s going to be a headache from an approval standpoint which usually means it goes to the bottom of the pile or delayed until they have time. Couple this with a general lack of understanding of the risk and hesitancy around the industry and you start to understand why insuring digital assets has lagged behind every other tech industry in the world today. Underwriters live and die by their loss ratios and if they are nervous about something they tend to avoid it, or will charge a high rate to justify their underwriting. The thinking goes that at least if there’s a claim, they can justify it by the rate that’s being charged, which also is the main reason behind high premiums for crypto businesses.

This hesitancy coupled with internal hurdles are compounded by the broking of the risk into the underwriter. If the underwriter doesn’t get satisfactory responses to their questions or feels the broker doesn’t understand the risk themselves, it can create a very long and often frustrating process. This more often than not leads to a decline from the underwriter who isn’t already comfortable with digital asset risk.

Having a look into what a day looks like underwriting risks in the digital asset industry can help businesses understand how insurance companies look at their risk and what internal pressures they face and have to navigate. It also highlights the importance of going with a broker that truly understands your business in order to guide an otherwise busy underwriter through your application and hopefully, to quote.

Conclusion

The challenge is clear: digital assets create unique intersections of risk that don't fit traditional models. Cyber security affects physical security. Financial health impacts operational risk. Technical expertise influences everything.

The digital asset market needs robust insurance to backstop its risks. Underwriters who are innovating in this space often face internal pressures and knowledge gaps which make it even harder to protect emerging technologies.

Yet change is coming. As institutional adoption grows and regulation clarifies, 2025 looks set to be a breakthrough year. We expect more standardized coverage, increased capacity, and better integration of technical solutions. For institutions entering the space, success will depend on finding partners who understand both traditional insurance and emerging technology.

The digital asset market is surging. BlackRock's spot Bitcoin ETF recently recorded $5 billion in volume in one day. Fidelity, Franklin Templeton, Invesco, and State Street are diving in. JPMorgan is tokenizing money market funds, while KKR and Apollo are putting real-world assets on chain.

But there's a hidden problem that isn’t often talked about: Only 1-3% of digital assets are insured.

This matters because insurance isn't optional for institutions. It's a core part of risk management - required by regulators, boards, and basic business prudence. Without comprehensive coverage, many institutions simply won’t be able to enter the market, regardless of opportunity. 

But it goes even further. There is no mature market in the world that became that way without a liquid insurance market. Insurance helps people ship goods, sell services, fly planes and construct buildings. It’s a key part of any economy to allow companies to do business, providing important risk transfer to help the world function. Yet nearly 16 years on, crypto still remains the most excluded asset class in the world, stunting growth and leaving entrepreneurs self-insuring their risk more often than not. 

This means getting digital asset insurance right is hard. Traditional insurers struggle with novel technical risks. Crypto-native solutions to date have lacked capacity and aren’t regulated. And unfortunately, even when coverage exists, it often has critical gaps.

Take 2023’s $1.7B in crypto hacks1. Most victims had zero coverage. Those with insurance often discovered - too late - that their policy didn't cover the actual attack vector used. Like a homeowner discovering their policy doesn't cover floods only after the storm hits, crypto companies keep finding holes in their coverage the hard way.

The bigger problem? Digital asset insurance is a black box. There's no comprehensive resource explaining what coverage is available, what it actually protects against, how to get it or what it costs. Every week we speak with industry leaders facing the same challenge: they know they need insurance, but can't find clear information about their options. Ask five different brokers and you'll get five different answers about what's possible.

This piece is Part 1 of our guide to digital asset insurance. We'll explore:

• How the industry evolved from both traditional specie insurance and cyberinsurance

• The history of the digital asset insurance market

By the end, you'll understand the critical intersection of traditional insurance and cyber insurance that makes digital asset coverage unique. You'll know what questions to ask about different coverage types. And you'll have a clear map of who can actually help protect your assets.

Let's dive in.

How Insurance Evolved

Digital asset insurance emerged from a unique intersection: centuries-old traditional  insurance colliding with modern cyber coverage. Understanding today's landscape requires understanding both parents.

Insurance Evolution

Origins

Insurance began with merchants protecting trade. The first risk-sharing agreements were born in Ancient Babylon - if one trader's shipment was lost, the group would help cover the loss. Medieval Italian merchants formalized this further, creating contracts to spread the risk of maritime ventures across multiple investors.

Modern insurance took shape in London's coffeehouses. In 16882, Edward Lloyd's coffeehouse became the meeting point where merchants and shipowners connected with wealthy individuals willing to take on a portion of their risk. The principle was simple: instead of one person bearing the full risk of a voyage, many people would each take a small share. This coffee house evolved into Lloyd's of London - still one of the world's largest insurance markets and a key player in digital asset insurance today.

Global Growth

In the 1800s, the world grew increasingly connected. Steamships began crisscrossing the globe, trade expanded, and banks grew larger to finance it all. These growing financial institutions needed specialized coverage to match their scale and complexity. This gave rise to specie insurance - originally meant for "money in specie" (physical coins), but eventually expanding to cover all kinds of valuable physical assets. Today, specie insurance protects everything from gold bullion to fine art, anywhere these assets are stored or moved. This broad coverage of physical valuables is particularly relevant for digital asset custody, where cold storage still means protecting physical devices.

Modern Times 

By the 1960s, financial institutions had developed sophisticated coverage frameworks, many of which still form the backbone of asset protection today.

These frameworks started with custody chains. Every asset needed clear documentation of who controlled it, when, and where responsibility transferred. Like passing a baton in a relay race, each handoff had to be precise and recorded. This created a clear trail of liability - critical for when things went wrong.

Physical security evolved from simple locked doors to comprehensive systems. Banks developed detailed standards for everything from vault construction to guard protocols. More importantly, they created systematic ways to verify these standards were being followed through regular audits and inspections. Claims processes became equally systematic. When losses occurred, institutions knew exactly what to do - from initial incident reports to final settlement.

Regulators codified much of this into requirements. They set minimum coverage levels, spelled out reporting requirements, and specified what types of coverage different activities needed. This standardization helped the industry scale - insurers knew exactly what they were covering, and institutions knew exactly what protection they had. Because of this clarity, insurers were able to cover larger limits at cheaper prices. Specie insurers can cover limits in the $50m+ range and form consortia to insure losses in the hundreds of millions, if not billions. 

These frameworks were so effective at protecting physical assets that they're still largely in use. They're also why traditional insurers initially approached digital assets through a physical security lens - focusing first on cold storage coverage using existing specie frameworks. But as digital assets have evolved, protecting physical vaults isn’t enough. Securing purely digital value would require an entirely new kind of insurance - one that was evolving alongside the rise of computers.

Cyber Insurance Evolution

While financial insurance evolved over centuries, cyber insurance has evolved in a flash over the last few decades. As computers transformed from novelties to critical infrastructure, entirely new risks emerged - risks that traditional insurance never contemplated. As businesses went online, criminals didn't need guns or vault-cracking skills - just a keyboard and an internet connection.

Cyber insurance emerged in the late 1990s as businesses grappled with emerging risks from digital transformation. The coverage initially evolved from professional liability and errors & omissions policies, primarily serving technology firms that provided infrastructure and personal computing solutions to businesses.

As the internet transformed commerce during the dot-com boom, cyber insurance shifted its focus toward media liability coverage, particularly addressing concerns about intellectual property infringement through multimedia content on websites. This was driven by fears that unauthorised use of images and content could lead to expensive lawsuits, amplified by the unprecedented global reach of the internet.

Some early policies also addressed speculative risks that proved less impactful than feared, such as the Y2K bug, which helped shape underwriters' understanding of how to assess and price digital risks.

Open access to the internet changed everything, creating entirely new challenges for innovative insurers. Pioneers were building entire businesses online. Software started eating the world, and a single hack could now destroy a multi-national empire..

To address these evolving threats, insurers had to rethink their approach:

• Technical security audits replaced physical inspections

• Network monitoring became as important as guard patrols

• Digital forensics became critical for claims

• Policy wordings had to be invented to address the new nature of how companies could now suffer losses. New terminology was created and a standard underwriting framework started being developed.

By 2010, cyber insurance was its own distinct market. The scale and sophistication of attacks exploded. A single breach could now cost hundreds of millions. Insurers had to adapt again, focusing more on prevention and incident response. Those that didn’t had to either close their doors, lay-off their cyber teams or restructure their book to try to regain profitability. 

During the 2010s, numerous insurers tried their luck at underwriting cyber in a profitable way.. Companies like CFC Underwriting which started out as a cyber insurance player has one of the largest teams of cyber underwriters in the world, some 20 years from when they first started. Unfortunately, this wasn’t the case with all insurers, with some large names having to shut down their books entirely because of the increase in ransomware claims and the interconnected nature of cyber business interruption with managed service providers.

When COVID hit, everything accelerated. As the world shifted online practically overnight, attack surfaces exploded. Companies that had never worried about cyber risk suddenly found their entire business operating remotely. This forced digitization drove unprecedented demand for cyber insurance. Premiums soared and the market matured rapidly.

The impact was dramatic. In just a few decades, cyber insurance had grown from a niche offering to a $14 billion market, expected to reach $29 billion by 20273. While traditional insurance took centuries to mature, cyber insurance had to evolve at the speed of technology - creating crucial foundations for what was coming next: digital assets.

Subscribe now

Digital Asset Insurance

The story of digital asset insurance mirrors crypto itself: from stigma to institutional adoption.

Early Days 

In crypto's early days, most insurers wouldn't touch it. The market was retail-focused, and Bitcoin was widely seen as a tool for illicit activity. Few legitimate businesses needed coverage, and fewer insurers were willing to provide it.

First Steps 

Miners were among the first to need coverage. Companies like Marathon and Riot were running hundreds of millions in equipment, facing tangible risks like equipment damage and power failures. Insurers could understand these exposures - they looked similar to other industrial operations.

The Custody Evolution 

Then came digital asset custodians. These looked more like traditional financial institutions, with similar security needs and business models. Insurers found their comfort zone: treat a hardware wallet like a gold bar in a vault, and suddenly digital asset custody became insurable using traditional specie coverage frameworks.

However, looking at custody this way works for offline storage of digital assets, but what about assets locked in smart contracts? Well the traditional insurance market still doesn’t have a good response to this. To solve it, the crypto community created its own way of insuring itself.

Discretionary Cover aka Decentralized (or DeFi) Insurance

DeFi insurance is a decentralized alternative to traditional insurance that operates on blockchain networks, primarily designed to protect users against risks specific to decentralized finance protocols. It allows users to purchase coverage against various crypto-related risks such as smart contract failures, exchange hacks, or stablecoin depegging events. 

When users buy DeFi insurance, they pay premiums in cryptocurrency or stablecoins, and if a covered event occurs (like a protocol hack), they can submit a claim that's typically assessed by a community of token holders rather than a traditional insurance company. The entire process — from purchasing coverage to filing claims and receiving payouts — is automated through smart contracts, making it transparent and largely eliminating the need for traditional intermediaries.

Although it’s called DeFi insurance, it actually isn’t ‘insurance’ as insurance can only be provided by a regulated insurance company. DeFi insurance should go by the phrase ‘discretionary cover’ and just like how insurance started out by having many individuals pooling their money together to protect against risks, discretionary cover is bringing it back. From hereon out, we’ll refer to DeFi insurance by its correct terminology - discretionary cover.

In a very poetic way, blockchain technology is breaking new ground by rewinding the clock and returning to the roots of insurance. So, how should you think about when to use discretionary cover or traditional insurance? We’ve created a handy table to help:

Insurance companies and discretionary cover have different strengths and can co-exist side by side providing complementary coverage. It’s essential to understand the strengths of each in order to navigate the different risk transfer mechanisms at your disposal.

New Frontiers, New Challenges 

Even with the advent of discretionary cover, today's digital asset landscape creates unique challenges. Unlike traditional cyber assets, crypto is a bearer instrument - possession equals ownership. A single breach can mean permanently lost assets. The 2022 Ronin bridge hack showed how devastating this can be - $620M gone in minutes, with virtually no chance of recovery.

The risks are also more complex:

• Smart contracts with open, exploitable code

• Hot wallets connected to the internet

• Cross-chain bridges creating new vulnerabilities

• DeFi protocols with interconnected risks

Like the risk and fall of cyber insurers, discretionary cover protocols have also gone bust. During the Terra Luna incident, several protocols were providing coverage for algorithmic stablecoin fluctuations. Once USDT lost it’s peg, the protocols effectively got liquidated. It’s not just traditional insurance that struggles with predicting new exposures and loss trends!

Current State and Future 

Today, capacity remains limited outside traditional custody and mining. A typical specie policy might offer $250M in cold storage coverage with coverage that can go up to $1bn, but hot wallet limits rarely exceed $100M - a huge gap for institutions managing billions in assets. Smart contract coverage is even scarcer.

But change is coming. Major regulators are mandating coverage - Singapore requires digital asset firms to maintain specific coverage levels and Hong Kong's licensing regime includes mandatory insurance requirements. Major insurers are taking notice - Munich Re has been expanding their digital asset team.

2025 looks set to be a breakthrough year. As institutional capital flows in and regulatory requirements firm up, insurers will have to adapt. The question isn't if digital asset insurance will scale, but how quickly.

Looking Ahead

Understanding this history will help in navigating today's digital asset insurance landscape. 

In Part 2, we'll examine the current market landscape: what coverage exists, who provides it, and how to think about protecting your digital assets. We'll map out the key players and break down the actual coverage types available today.

Subscribe below for direct access to the next parts in this series, where we'll help you navigate the complex world of digital asset insurance. 

Subscribe now

"The most valuable part of blockchain might be its unused capacity."

Today, the world's major blockchains are cumulatively operating at just 1% of their capacity1. But what if I told you the most valuable part of blockchain might be the other 99% - and unlocking it could create trillions in value?

Zombie Chains

Forbes recently highlighted an uncomfortable truth: many blockchains with multi-billion-dollar valuations are generating just tens of thousands in fees. They called it the 'zombie blockchain problem'.

They're right about the numbers - but they're missing something crucial. Instead of viewing these empty networks as failures, we should see them as part of a larger infrastructure wave being built for the future - economic highways purpose-built to securely carry and settle the world's wealth and data.

We've constructed information superhighways for value, but today most lanes remain empty. These unused roads might be exactly the foundation we need for tomorrow.

Infrastructure leads to Innovation

a16z’s Chris Dixon has drawn parallels between today's blockchain infrastructure boom and the over-investment in bandwidth during the dot-com era.

The main point he makes will be familiar to anyone who has read Perez’s Technological Revolutions and Financial Capital: that over-investment in infrastructure during a hype cycle lays the foundation for future innovations.

There is plenty of analysis comparing internet user adoption to crypto user adoption. However, a gap exists in looking at this through the lens of infrastructure.

I set out to address this void, to go under the hood and leverage historical reports and on-chain data to broadly quantify blockchain under-utilization and draw informed parallels with early internet infrastructure.

This piece aims to:

• Explain blockspace using clear analogies

• Draw parallels with the dot-com era's bandwidth boom

• Quantify the current state of blockchain utilization

• Explore the possibilities of this excess capacity for future innovation

By looking at historical patterns and current data, we'll provide a roadmap for understanding where we are and the potential that lies ahead.

2. What is Blockspace?

Before we dive in, it’ll be helpful to have an idea of what blockspace is.

Blockspace refers to the capacity of each block in a blockchain to contain transaction data. Simply put, blockspace tells us how much information can be transmitted in each block that gets added to a blockchain.

It represents the limited resource of transaction processing capacity in a blockchain network, analogous to bandwidth in traditional data transfer. This capacity directly impacts the network's throughput, fees, and ability to handle various types of transactions or smart contract operations.

Digital Value Highways

To intuitively understand blockspace, think of blockchains as digital value highways. Just as highways carry vehicles of different sizes - from motorcycles to large trucks - blockchains carry different types of instructions, from simple payment transfers to complex smart contract interactions. To get onto the highway, all traffic must pass through and pay a fee to a toll booth, which checks their registration number.

In order to add a block to a blockchain, all the instructions must pay a fee to the network which checks if the instruction is valid. Certain instructions take more space, like smart contract deployments. Like trucks, these will take up more room at the toll booth, leaving less available space for other instructions trying to get processed.

Just as highways have a maximum number of vehicles they can handle, blockchains have a theoretical maximum throughput. This capacity - how much transaction "traffic" can flow onto the highway in a given time - is what we call blockspace.

Non-Fungible Highways

On a blockchain, the data needed to transfer a billion dollars will take up roughly the same space as transferring a single dollar. But if you’re the one sending a billion dollars, how do you make sure it stays safe?

This is where an important distinction comes in: unlike traditional bandwidth, blockspace is not fungible across different networks. Think of different blockchain networks as different types of highways:

• Some are like multi-lane freeways, processing transactions quickly but with less security (a highway with many lanes but fewer checkpoints).

• Others are like secure single lane armored vehicle routes with heavy tolls (slower and more expensive, but more secure for high-value transfers).

Because blockspace isn’t fungible, it makes it more difficult to compare across networks. For instance, Ethereum's high-fee, high-economic security, low-throughput model contrasts sharply with Aptos’s lower-fee, lower-economic security, higher-throughput structure.

But now that you have the highway analogy in your head, you’ll be able to understand the issues that pop up when we start our comparison.

Before comparing across blockchain networks, let’s first draw lessons from the past and make a historic parallel. To gain deeper insights into blockchain’s current state and future potential, we’ll briefly visit the dot-com era infrastructure boom and understand how it played out.

3. Historical Parallel: The Dot-Com Bandwidth Boom

In the late 1990s, the internet was the new frontier, and bandwidth was a precious resource. Telecommunications companies, fueled by $1.6 trillion in equity capital raised from investors and another $600 billion in bonds, embarked on an epic infrastructure spending spree2:

• Between 1996 and 2001, over $500 billion was poured into new networks.

• More than 80 million miles of optical fiber were laid - enough to circle Earth 3,200 times.

This frenzy was fueled by wildly optimistic projections that internet traffic would double every 100 days (The source of those predictions appear to have come directly from telecom execs3. Talking your own book transcends industries and eras).

The result? A massive increase in capacity.

But then reality struck. The bubble burst and by 2002, an estimated 97% of laid fiber remained "dark" - unused and waiting4.

The parallels are striking. Just as the dot-com era saw massive investment in fiber optic infrastructure, we’ve been witnessing huge capital flows into blockchain Layer 1’s and Layer 2’s. According to Rootdata, over $12bn has been raised for L1’s and L2’s to date5. But how much actual usage is there today?

4. Blockspace: The New Frontier

To answer this question let's examine the current state of our blockchain highways.

To quantify the current state of blockchain utilization, I focused on a sample of 21 major blockchain networks6, selected based on the overlap of data from two independent sources7, comparing different blockchain networks’ theoretical capacity to actual usage.

It's important to note that the resulting figures should be viewed as directionally accurate rather than precise measurements. This sample provides a helpful benchmark for understanding the current state of blockchain utilization but aren’t truly accurate figures, as there are estimated to be over 1000 different blockchains.

If you are interested in the methodology, I’ve made a footnote with more details8.

Blockspace Growth9

Great! We have lots more capacity than before, with a 300x increase since 2017. But now let’s look at how much of that is being used.

Blockspace Usage10

Most of the theoretical capacity that is being added is sitting idle, with actual usage at 1% of cumulative capacity.

Armored Vehicle Lanes vs Multi-Lane Highways11

Let's revisit our highway analogy. The established secure lanes - networks like Bitcoin and Ethereum - see heavy traffic. Meanwhile, newer high-speed highways built for massive throughput sit largely empty, their lanes ready but waiting for traffic.

This concentration of activity on established networks, despite faster alternatives, highlights a key difference from the early internet era: in blockchain, security and network effects often outweigh raw speed. Just because new networks are available doesn’t mean they are yet trusted. Like any critical infrastructure, these new highways must prove their reliability before wide-spread use.

Comparison With Dot-Com

Comparing this data to internet bandwidth utilization from the late 90s and early 2000s reveals a striking similarity:

• 2000: Usage dropped to ~3% after massive infrastructure buildout12.

• 2024: Most blockchains operating below 5% capacity.

These low utilization rates across most blockchain networks suggest we're in a phase of overbuilding similar to the early internet.

The roads have been laid, we’re now waiting for the drivers.

5. The Value of Unused Capacity

At first glance, all this unused capacity might seem wasteful. Are the critics right? Have we created elaborate castles in the sky whose halls will remain forever empty?

Before judging, it’s helpful to look at the aftermath of the dot-com bandwidth boom and think about what rhymes history might reveal to us.

Web2: The Phoenix from the Dot-Com Ashes

We left the dot-com era as it collapsed, with millions of miles of newly laid fiber optic cable lying dark. But it didn’t stay that way forever.

The surplus capacity and the fall in costs allowed the next wave of entrepreneurs and developers to create transformative new industries, enabled by abundant, cheap bandwidth.

Some Examples:

• Social Media: Platforms like Facebook leveraged excess capacity to allow easy photo and media sharing. Today Facebook has over 3bn monthly active users13.

• Video Streaming: Netflix and YouTube now account for a significant portion of global internet traffic. Today video accounts for 65% of all internet traffic14.

• Cloud Computing: Services like Amazon Web Services, built on excess capacity, now store most of the world's data. As of March 2023, AWS S3 holds more than 280 trillion objects in storage15.

The internet highways are now filled with traffic, its vehicles essential to our daily lives. Today we couldn’t imagine living without these innovations which only became possible because of the huge investment in internet infrastructure.

Blockchain’s Future

In the blockchain world, this unused capacity could enable similarly transformative applications. Just as excess bandwidth enabled Web2, excess blockspace could catalyze innovations we can't yet imagine.

This capacity can open up blue ocean territory, where old industries are ripe for disruption and new ones can be created from scratch.

However, challenges remain. While infrastructure is necessary, it's not sufficient alone. The early internet benefited from little initial regulatory oversight as it primarily dealt with communication and media. The blockchain world has found initial market fit with financial applications which have strict regulation and oversight. Existing regulation often doesn’t quite fit this new technology and regulators have been slow to adapt, preventing major institutional players from fully adopting it. This regulatory uncertainty prevents movement and stifles innovation.

This uncertainty is starting to resolve, with different regions around the world bringing in new regulations that address it head on. Clarity will allow institutional and enterprise adoption, which will allow many more resources to pour into the sector, sparking innovation which now has much higher blockspace capacity to work with.

6. Paving the Digital Highways of Tomorrow

“The bear case for blockchain is better settlement rails for finance. The bull case is new design space, entirely new industries being created we hadn’t even thought of before.”

- paraphrased from Hart Lambur16

We’ve been building blockchain highways at a breakneck pace, but most lanes are sitting empty. It's easy to criticize and decry ‘zombie chains’. But remember - we've seen a similar story play out before, and it led to a revolution in how we communicate, work, and live.

Just as excess bandwidth paved the way for streaming and social media, today's abundant, cheap blockspace is quietly laying the foundation for Web3's future “killer apps”. We can't predict exactly what they'll be - it would have been difficult in 1999 to forecast TikTok. But the potential is enormous.

Tying it up

Let’s revisit the statement made at the start of the article.

What if I told you the most valuable part of blockchain might be its unused capacity.

Hopefully this seemingly counterintuitive idea now makes sense. We’re still in the early days of an industry which is laying a new financial backbone for the digital economy. Just as the internet's unused capacity in the late '90s held the seeds of today's digital giants, blockchain's current excess capacity represents vast, untapped potential.

Looking at the historic parallel, the value created from what came after the dot-com era dwarfed what came before.

The unused capacity of blockchains, if harnessed effectively, has the potential to create value that far exceeds the current crypto industry - from streaming salaries paid by the second to automatic micro-insurance claims, decentralized AI training markets, real-time supply chain verification and more.

The digital highways of tomorrow are being paved today. The future will belong to those who build on them.

Share

Thanks to David Schwed, Alex LaBossiere, Felix Stocker, Robert Martin and Charlie Curnin for reviewing drafts of this piece and providing feedback.

1. Introduction

Just 2 weeks ago, an Indian crypto exchange lost $271 million in a devastating attack, with North Korea’s state-sponsored Lazarus Group as the prime suspect. This isn't an isolated incident - over $5 billion has been stolen in crypto hacks in the last 2 years alone1. In this high stakes environment with state level threat actors, who can you trust to keep your digital assets safe?

Welcome to the critical yet often misunderstood world of digital asset custody.

What exactly is custody, and why does it matter?

At its core, custody is about keeping valuable assets safe.

We’ve built an incredibly complicated financial system that allows us to move billions of dollars at the push of a button. But it would all come crashing down if the assets at the base of the system disappeared. To avoid that, we rely on trusted parties whose role is to make sure that this doesn’t happen.

These are custodians. They’re incredibly important but few people understand how they really work, particularly in blockchain. This piece aims to change that.

We'll demystify digital asset custody by exploring:

• The role of custodians in the crypto ecosystem

• Distinctions between types of custody providers

• How custody blends traditional security with blockchain technology

• The step-by-step journey of a blockchain transaction through a custody system

• Key technical concepts and their place in the custody mental model

Why should you care?

If you believe that blockchain is the future of finance, then digital asset custody providers will form the backbone of security in this new landscape, making them the future of how businesses will keep their assets safe.

After reading this, you’ll have an understanding of how they work and be better equipped to understand this new future.

2. The Custodian's Role in the Blockchain World

Lightning Quick History of Custody

Throughout history, we've entrusted our wealth to increasingly sophisticated security systems:

As our world digitized, so did our assets (mostly). Paper certificates gave way to electronic records, and gold bars to strings of data. This brought new challenges, requiring cybersecurity on top of physical security.

Today, the next frontier in custody is blockchain technology. This tech has rewritten the rules, and shifted custody to revolve around the protection of cryptographic private keys – the sole proof of ownership in the blockchain world. Lose or compromise these keys, and you lose your assets - potentially forever.

This is where digital asset custodians come in, offering a combination of cryptography, cybersecurity, and physical security all meant to ensure your private keys - and therefore your assets - stay safe.

Why Custodians Matter in Crypto

Imagine losing billions of dollars in an instant, all because you forgot a password. With digital assets, this nightmare is a real possibility.

In the blockchain world, ownership boils down to one thing: private keys. These aren't physical keys you can hold; they're long strings of characters that prove you own your crypto assets.

This is where a major difference from traditional finance becomes clear. If you forget your bank account password, you can reset it. Lose your private key? There's no 'forgot password' button. Lose your private key, and you've lost your digital assets.

Enter digital asset custodians. They handle and abstract away security and blockchain technical details, basically saying, "Let us handle the complex security stuff so you can focus on running your blockchain based business.”

More specifically, they offer secure, enterprise-grade solutions for private key management, storage, and transaction signing.

We’ll go deeper into each of these aspects. But first, let's understand the custody landscape as not all crypto custody providers are the same.

Types of Digital Asset Custodians

As the demand for secure management grew, different types of custody solutions emerged to meet different needs. You can broadly bucket them into two main categories:

1. True Custodians: Hold private keys on behalf of users, taking direct control of the users' assets. They're similar to traditional banks in that they have full custody of your assets and are usually regulated. However, unlike with traditional banks, even if they are a Qualified Custodian, assets aren’t protected under FDIC.

2. Custody Tech Providers: Provide technology that allows users to sign transactions securely without fully relinquishing control of their private keys. They offer a middle ground between self-custody and full third-party custody.

   

Let’s pause on this for a second as it’s an interesting nuance that's easily missed.

In traditional finance, custody tech providers don’t exist. You have to entirely entrust custody to a third party if you are dealing with bits rather than atoms, otherwise your assets can’t operate in traditional siloed systems.

Blockchain allows us to have a shared ledger, a public record of your assets that everyone agrees on. Systems are more open, and if you are technically competent, it’s now possible to manage your own private keys and not entrust them to others.

But most people don’t want to deal with the technical complexity of full self-management, and many businesses deem it too risky. Custody tech providers rose to meet that challenge, providing software to abstract complexity and add enterprise controls, without taking full ownership over the private key.

And today there are lots of different custody providers offering these services.

So what do these custodians actually do? Let's dive deeper and create a mental model of custody to try and understand it.

3. Custody Mental Model:

Cyber Security Meets Blockchain Security

Imagine you're tasked with guarding the crown jewels, but instead of a physical crown, you're protecting an invisible asset that exists only as data. And if that data disappears, it’s almost impossible to get it back. How would you even get started keeping it safe?

Welcome to the world of digital asset custodians.

Blockchain Custody Onion Model

To understand how custodians operate, let's build a mental model.

Think of digital asset custody as a high-tech onion, with multiple layers of security wrapped around a core blockchain address.

Layer 1: The Blockchain Core At the core lies the blockchain itself. This is where your assets truly "live". Control of these assets comes down to one thing: the private keys.

Layer 2: Key Management The first protective layer surrounds the private keys. Key management and storage. Custodians use cryptographic techniques like Multi-Party Computation (MPC) or Hardware Security Modules (HSMs) to secure private keys. We dive deeper into these later in section 5.

Layer 3: Physical Security For true custodians, physical security is a crucial layer. This usually involves secure facilities, often with biometric access controls, 24/7 surveillance, and even armed guards. It's the fortress that protects the servers and hardware storing your digital assets. Custody tech providers indirectly provide physical security as their software relies on secure facilities to house their infrastructure. However there are additional obligations on the user to host their portion of the infrastructure securely, which for true custodians isn’t the case.

Layer 4: Transaction Policies This layer sets rules for transactions. It might include limits on transaction amounts, whitelisting of approved addresses, or time-locks on large transfers. It's like having a personal banker who double-checks every check you write, making sure it meets predefined criteria.

Layer 5: Access Control This layer determines who can initiate transactions and under what circumstances. Custodians will check credentials and require authentication to ensure the initiator has permission to sign the transaction. It might involve multi-signature schemes requiring multiple approvals, or sophisticated role-based access controls. Think of it as a high-tech version of the two-person rule used for launching nuclear weapons, ensuring no single person can unilaterally make critical decisions.

Layer 6: Logging and Attestation: This layer creates an unalterable record of all system activities and transactions. It allows for transparent auditing and third-party verification of assets. Think of it as a tamper-proof surveillance system for operations, ensuring accountability in the custodian's processes. While this is shown as a distinct layer, in reality the best custody providers will continuously verify and attest at each layer.

Layer 7: Audit and Compliance The outer layer involves continuous monitoring, regular audits, and adherence to regulatory requirements. This provides peace of mind to clients and satisfies the scrutiny of regulators.

There you have it. Digital asset custody really is just layers of web2 and physical security built on top of a blockchain address, with each successive layer adding more security.

Understanding this model is important because it highlights the complexity of what custodians do. They're not just storing digital assets; they're orchestrating a sophisticated dance of cybersecurity measures, cryptographic techniques, physical safeguards and regulatory compliance.

In the world of digital assets, custody is as much about managing information and processes as it is about safeguarding wealth. It's a new paradigm, where value can be moved (and lost!) as easily as information, reshaping how we think about asset security.

Now that we have that model in our mind, we can pretty easily understand the journey of a blockchain transaction through this system.

4. Step by Step Journey Through the Custody System

Let's look at what happens behind the scenes when you use a custody provider by walking through a real-world scenario: Alice wants to send $100 worth of crypto from her custody wallet to Bob's address. Here's how this transaction flows through the layers of our onion:

1. Initiating the Transaction (Layer 7: Audit and Compliance)

• Alice logs into her custody account and enters Bob's address and the amount: $100.

• Initial compliance checks kick in, verifying Alice's identity and checking if Bob's address is on a sanctioned list (AML checks).

2. Logging Begins (Layer 6: Logging and Attestation)

• The custodian's system begins logging this action, marking the start of the audit trail.

3. Access Control (Layer 5)

• The system authenticates Alice and determines who needs to approve this transaction.

• For this small $100 transaction, Alice's approval is sufficient. For larger amounts, multiple approvals might be required.

• Alice receives a push notification on her phone to confirm the transaction.

4. Policy Check (Layer 4: Transaction Policies)

• The system checks Alice's transaction against preset policies, for example:

  • Is $100 within Alice's daily transaction limit?

  • Is Bob's address on Alice's whitelist, or does it need additional verification?

  • Are there any time-based restrictions on Alice's account?

• If all checks pass, the transaction moves to the next layer.

5. Physical Security (Layer 3)

• The transaction triggers access to physically secured hardware. This might involve automated systems accessing cold storage (more on this in the next section) in a secure facility.

6. Key Management (Layer 2)

• Now, the custodian's systems need to sign the transaction with Alice's private key.

• Security measures like MPC (Multi-Party Computation) and HSMs (Hardware Security Modules) are used to sign these transactions securely.

7. Blockchain Interaction (Layer 1: The Blockchain Core)

• With the transaction signed, the custodian broadcasts it to the blockchain network.

• This marks the handoff from the custodian's controlled environment to the blockchain which processes and confirms the transaction.

8. Logging Update (Layer 6: Logging and Attestation)

• The system updates the transaction log with final details.

9. Confirmation and Completion (Layer 7: Audit and Compliance)

• The custodian's systems monitor the blockchain for confirmations.

• The entire process is logged for audit purposes, completing the circle back to the outer layer.

• Bob receives the $100, Alice receives a notification that her transfer is successful.

Journey to the Centre of the Onion

This journey shows how each layer plays a different role and highlights the complexity behind every transaction:

• Outer layers (5 and 6) ensure regulatory compliance and adherence to predefined rules.

• Middle layers (3 and 4) manage access and physical security.

• Inner layers (1 and 2) handle the cryptographic operations and blockchain interactions.

5. Key Concepts Simplified

Now that we have a mental model of how custodians are set up and how transactions flow through the system, let’s dive into some of the jargon and terminology we use.

1. Multi-Party Computation (MPC)

• What: A cryptographic technique that creates partial keys, used to make partial signatures. For instance, three servers might each hold a partial key, with at least two required to cooperate to sign any transaction.

• Where: Key Management (Layer 2)

• Why it matters: This enhances security by ensuring no single party holds the complete key, reducing the risk of theft or insider threats.

2. Secure Enclaves (TEE)

• What: Protected memory regions in computer processors, isolated from the main operating system.

• Where: Key Management (Layer 2)

• Why it matters: This offers a secure execution environment for signing, giving confidence that this won’t be affected even if the main system is compromised.

3. Hardware Security Modules (HSMs)

• What: Specialized, tamper-resistant hardware for cryptographic operations.

• Where: Key Management and Physical Security (Layer 2 and Layer 3)

• Why it matters: This provides a secure environment for key storage and signing, protecting against both physical and digital attacks.

4. Cold Storage

• What: Storing digital assets offline, unconnected to the internet.

• Where: Physical Security (Layer 3)

• Why it matters: This provides security against online threats which can’t access offline devices. If the device isn’t connected to the internet, the internet can’t hurt it.

5. Multi-Signature (Multi-sig)

• What: Requires multiple signers to coordinate to create a signature in order to authorize a transaction. Imagine a safety deposit box that requires two keys to open - one held by you, one by the bank. That's multi-sig in action.

• Where: Access Control (Layer 5)

• Why it matters: This distributes control and reduces single points of failure. Single points of failure are always best avoided as they will be targeted by attackers, removing them enhances overall security.

6. Whitelisting

• What: A pre-approved list of addresses allowed to receive funds.

• Where: Transaction Policies (Layer 6)

• Why it matters: This reduces the risk of funds being sent to unauthorized or malicious addresses. If an attacker were to gain access to the account and tried to send transactions to their own address, this would block the transactions before they went to any of the core layers for signing.

These concepts are not mutually exclusive (e.g. you can have multi-sig cold storage using secure enclaves). Each of these technologies (and many more!) come together to help make custody safe. The space is rapidly evolving and we’re constantly thinking of new ways to deal with threats. This means what is state of the art today will likely be out of date in 2-5 years time.

But now whenever you hear an acronym or a new piece of security from a custodian, you can try and map them to the different layers to understand the reason for why it’s been created.

6. Wrap-up

“Show me the incentive and I will show you the outcome” - Charlie Munger

Custodians are paid to strike the balance between security and convenience. They focus on the tricky problem of guarding valuable data that if lost, is almost always irrecoverable, while making that data accessible to allow transactions. Imagine a vault that needs to be impenetrable, yet accessible at a moment's notice. That's the custodian's daily challenge.

To try and solve this problem, custodians try to wrap as many layers of security as possible between the blockchain address where assets live and the ability to move assets from that address. Each layer added to the onion represents a new challenge for potential attackers, making the assets at the core increasingly secure.

However, this isn’t a fully solved problem.

Custodians and security firms that connect to them will continue to evolve with new security measures, new layers and new technologies (including what we are building at Circuit! Reach out if you want to learn how we can help you recover your assets even if private keys are lost).

The Future

As we've peeled back the layers of digital asset custody, hopefully something is becoming clearer: the future is being shaped right before our eyes.

As blockchain continues to reshape industries beyond finance - from supply chain management to digital identity - the principles of secure digital asset custody will become increasingly relevant. The lessons learned from protecting cryptocurrencies today will inform how we secure digital value of all kinds tomorrow. Imagine a world where your digital identity, health records, and financial assets are all secured using learnings from custody principles we use for crypto today.

Now you are better equipped to face this new frontier, with an intuitive understanding of how at its bedrock, we’re approaching keeping things safe.

Welcome to the future of finance. It's secure, it’s digital, and it's just getting started.

Share

If you found this article helpful, please share it :)

Thanks to Chris Grilhault de Fontaines, David Schwed, Hamza Adnan, King Tong Choo, Tom Kiddle and TJ Connolly for reviewing drafts of this piece and providing feedback.