Crypto custody models: MPC, Safe multisig, custodians and Swiss Clavi
Quote552 words
Funds use MPC, protocol treasuries Safe, regulated firms Coinbase or BitGo, each with a company in the signing path. He argues family offices want 2-of-3 keys across three places with no third party, citing Bybit's $1.5B frontend hack and a reseller Ledger implant. States it is not sponsored.
Key claims
Bybit lost $1.5B via a compromised Safe frontend
Reseller-sold Ledger units with LTE implant, $86M+ lost
Ledger's 2020 leak exposed 272k customer records
Good question by my fren @Route2FI.
Short answer: funds use MPC (Fireblocks, Fordefi, Utila), protocol treasuries use Safe (multisig), anyone with a compliance department uses Coinbase or BitGo.
It's basically all three versions of the same trade-off tho. A company sits somewhere in your signing path so one seed phrase isn't your whole security model.
Safe keeps the keys on your own Ledgers, but the transaction usually gets built in the Safe web app. Bybit lost $1.5B that way: the frontend got compromised and the signers approved what their screens showed them.
MPC adds a policy engine, limits, whitelists, second approvals. The vendor holds a key share and co-signs everything you do. Subscription, KYC, and if they pause you, you're paused.
Custodians go all the way: You own a claim, they own the keys. Works for an ETF. For a private person it mostly moves the subpoena to a different address.
What I'd actually want for a player with a lot of value at risk (e.g. family offices that we work with) is a 2-of-3 (at least) with the keys in three places and no third-party company in the loop.
@Clavi_AG, a self-sovereign custody hardware company building in Switzerland, is the first team I've seen design the whole stack around exactly that.
A biometric signing device (Rune), an air-gapped home server with your own BTC and ETH nodes, an OS the company has no remote path into.
The supply chain stays in Switzerland too. Production, assembly and shipping all happen under their own eyes, with no contract factory or regional distributor in between.
Sold directly only (no distributor maximization), so there's no reseller chain for someone to solder into.
Which is exactly how this week's Ledger implant got in: units sold through a reseller in SEA shipped with an LTE chip inside the case that read the 24 words off the screen. $86M+ gone at this point, and it looks like European resellers have also been targeted.
The answer to "why Clavi?" goes beyond that tho.
Swiss data protection law helps on the other end too. Data minimization is the default under the FADP, and a hardware vendor has no KYC file to keep. So what Clavi holds on you can be close to nothing, potentially a sheet of paper in an underground vault instead of an e-commerce database.
Ledger's 2020 leak put 272k names, home addresses and phone numbers online, and that list has fed phishing and extortion ever since.
And even if someone gets their hands on your data: Keep one Rune at home, one in a vault + one with your lawyer (or just someone you trust), and whoever shows up at your door is one signature short of moving anything.
Looks like the best/cleanest setup to me tho rn.
Why?
Bc we saw 2+ incidents in <20 months where the chip was fine and everything around it wasn't.
Imo the fix is moving trust out of one device and one company and into the places you choose.
That's what Clavi allows you to do.
NFA tho. DYOR.
@Route2FI Not a sponsored post btw, just appreciation for gud hardware tech being built in my country.
Recommend to reach out to my fren @0x1_0NE for more info and any questions you might have.
And check out the website here: clavi-one.com/
QUOTING @Route2FI
Been a lot of discussion about hardware wallets, opsec, and how to best protect your money lately. Just curious, but what is the most common way for DeFi protocol treasuries, bigger funds, VCs, institutions (that keep crypto)++ to secure their funds? Rethinking my whole setup
Been a lot of discussion about hardware wallets, opsec, and how to best protect your money lately. Just curious, but what is the most common way for DeFi protocol treasuries, bigger funds, VCs, institutions (that keep crypto)++ to secure their funds? Rethinking my whole setup
1 image on X