Since I have no intention of letting anybody hold my bitcoin, I never bothered to think about how all the treasury companies and ETFs attempt to keep all that bitcoin safe and secure. Lately, though, many bitcoiners are choosing to trust financial institutions rather than themselves with their large stacks. I wanted to find out more about these custodians. I didn’t look into the various multisig companies like Unchained. I made some notes on what I am learning.
The big players in the field:
Omnibus Wallets
The following custodians use omnibus wallets:
Fidelity
Coinbase
Gemini
BNY Mellon
JP Morgan Chase
NYDIG
The term omnibus wallet refers to accounts where multiple user’s bitcoin are pooled together in a single account under the custodian’s name.
Use of these wallets is why the above institutions are sometimes referred to as “honeypots” for hackers. The SEC has addressed the issue:
Omnibus wallets also pose increased risks as compared to segregated wallets, such as exposing the assets to greater operational and external risks such as hacking and theft. Given that, should exchanges or broker-dealers be allowed to custody crypto asset securities in omnibus wallets at all?
Fidelity uses this language to describe its custody solution:
Assets are managed in an omnibus fashion while segregated at the books and record level to provide on-chain privacy and maximum liquidity and security.
Many of these entities, including Fidelity, use the phrase "Segregation at the books and records level"
This is no segregation at all. It just means that accountants will keep track of who owns the coins.
Fidelity defends its use of omnibus wallets:
The misconception is that the omnibus model results in a “honeypot” of assets because omnibus custodians store assets under a single master key pair. In practice, omnibus custodians may have more groups of master key pairs than clients on platform, where a group constitutes key pairs from the different storage environments (online to completely offline). For example, for simplicity’s sake, consider an omnibus custodian that has a single client with $2 billion in assets. The custodian may choose to distribute the assets in $100 million chunks over twenty key pair groups (and divide each $100 million chunk further across the separate storage environments). Because omnibus custodians do not need to tie key pairs to clients, they can more effectively manage risk by using their discretion to decide how many key pair groups to generate and how to distribute assets across them.
The wording scares me because it is vague and discretionary. There is no method.
In practice, omnibus custodians may have more groups of master key pairs than clients on platform.
Who decides this, and under what circumstances?
The custodian may choose to distribute the assets in $100 million chunks over twenty key pair groups (and divide each $100 million chunk further across the separate storage environments).
There are no mandates? Who decides this, and under what circumstances?
Because omnibus custodians do not need to tie key pairs to clients, they can more effectively manage risk by using their discretion to decide how many key pair groups to generate and how to distribute assets across them.
Who are the guys whose judgment we are trusting?
"Segregation at the books and records level" is no segregation at all. It just means that accountants will keep track of who owns the coins.
SOC 1 & SOC 2 Reports
SOC stands for service organization control. Here is a link that explains the reports:
These are just audits. Are they important? Yes, I guess so. It's better to have them than not.
Insurance
Most custody providers provide crime insurance coverage and disaster recovery in case of data center failure. You get fiat compensation for your bitcoin.
Bankruptcy Remote Custody
By definition, this term means the risks are remote, not eliminated. The only way to enjoy real protection from a custodian’s insolvency is a segregated wallet, and even then, the risk is not completely eliminated.
After doing some research, I’m at the point where I have to say "Not Your Keys, Not Your Coins" makes as much sense as ever. It might be scary to be solely responsible for your own net worth, but trusting these institutions is scarier. I find it unusual that experienced stackers, knowing that bitcoin is a revolutionary asset very different from anything that has existed before, will trust their stack with legacy, old school banks or firms whose decades of security experience is useless in protecting this new beast, and who’s record of trustworthiness is dismal. Either that, or they choose “crypto” exchanges whose track record for honesty and competence is questionable at best. Gemini’s troubles are well known, and Coinbase is downright terrifying.
The old school, “respectable banks” are worse. Imagine handing over your bitcoin to JP Morgan Chase or BNY Mellon.
I’ll stick to my coldcard for now.