Your Keys, Your Coins, Your Choice

Where is your custody solution hosted? And why it matters

The past few years have seen a steady stream of organizations moving their applications to the cloud, and for good reason. In the era of digital enablement, improved connectivity, application engineering, and remote work, organizations have been encouraged to opt for the convenience of digital collaboration and anywhere, anytime connectivity. However, taking advantage of cloud infrastructure is more than just moving data and applications from an onsite server to a third-party hosted server. 

Today many digital asset custody providers leverage the cloud for its many benefits. Theoretically, all cloud providers provide some level of security, uptime, and disaster recovery. However, not all cloud providers are made equal. As such, why let your tech stack dictate your operational considerations? 

We, at GK8, will not dictate which cloud provider to choose, we will of course make a recommendation based on your needs and our vast experience, but in the end, the choice is up to you. That said, allow us to explain the implications of cloud services on the custody solution so that you can make the decision best for your business.

We are ardent believers in: ‘Your Keys, Your Coins, Your Choice!’

Here are but a few considerations:

‘On cloud’ or ‘on prem’ or better yet a hybrid solution

In the case of custodying large amounts of digital assets, a true offline solution together with a dedicated insurance policy is highly recommended. Only a deep cold vault, one that doesn’t require an internet connection to create, sign, and send blockchain transactions, can prevent any cyberattack vectors. Cold wallets, like vaults, should primarily be used for custody or for low-frequency, high-risk transactions and interacting with smart contracts or staking functions.

Alongside them, warm MPC-based wallets are better suited for high-frequency, low-risk transactions. The benefits of warm wallets include remote operation and automation. However, by definition, warm wallets are connected to the internet and are, hence, vulnerable to attacks. 

Your best bet is to implement a hybrid solution. This type of solution will allow you to better balance security with automation, minimizing risk and any single point of failure.

Your cloud or mine? 

Another question that comes up with customers, is which cloud provider is best to work with. Some systems are built for, or work only on a specific cloud service stack. Buyer beware! These solutions limit your choices. You are limited to the SLA provided by the specific cloud service provider. You are also often limited to the cost structure negotiated between the cloud and custody provider. Sometimes this cost structure can double the total cost of the custody solution.

If your organization utilizes another private or public cloud for your other applications, you will likely need to forgo cost or operational efficiencies. At GK8, our solution can also utilize multiple cloud providers, allowing you to enjoy the benefits of all of them, like multi-cloud security.

A dedicated or multi-tenant environment? 

The pros and cons of the different types of solutions go far beyond the scope of this article. With regards to safeguarding your private keys, security is ultimately the most important. 

Dedicated environments provide the most flexible deployment. The benefits are meaningful in light of the recent market events, which will encourage updates to regulations that will require operational flexibility around the deployment of the custodian’s private keys management. In addition, there are meaningful advantages for security, privacy, and performance. 

With regard to private keys, we are big believers in a dedicated environment from a security perspective. Moreover, dedicated environments ensure the complete separation of private keys sometimes required from a regulatory point of view. Last, but not least, a dedicated environment ensures your organization a resource pool that allows you to easily scale your operations when needed.  

At the end of the day, only you can decide which of these benefits is most important for your organization. But know that cybersecurity is of utmost importance when safeguarding your private keys.

Who has access?

Did you know that often technology providers have a backdoor into your keys, policies, and wallets? Well, they do. While some providers offer clients what they call a ‘self-managed solution’ they still hold on to a backup key for you or are able to control your wallets’ permissions policy. With the backup, they can help you, guide you, regenerate your keys, and provide troubleshooting in times of need. However, this also gives them control of your digital assets.

These backdoors can be used by bad actors to change your policies, conduct transactions, and even sign transactions on your behalf. Of course, they are not meant for that, nor does any vendor intend to use their administrative privileges against their clients. That said, for customers, it opens up a new attack vector. One where hackers can use the admin key to manipulate your accounts.

Reliance on yet another vendor & how central are they for your needs?

Something that is rarely talked about, is the fact that in this way the company now becomes reliant on yet another third-party vendor for its operations. 

Centrality to the custody solution itself – It is not only a question of downtime. Sometimes, the custody vendor is reliant on third parties to store your automated cosigners or to support the cryptographic layer required to approve the transaction. What happens if the cloud vendor is hacked? What happens if the cloud vendor does not support specific cryptocurrency algorithms (i.e. ECDSA, EDDSA or BLS) or decides to delay their implementation?

– – – – – – – – – 

Of course, these are just some of the questions you should ask. 

That said, if we’ve learned anything during the last six months, it is that financial institutions should not rely on external vendors to secure their customer’s assets safely. Having an end-to-end solution that allows you to be in full control of your environment is highly valuable to institutions that sometimes manage billions of dollars in AUM. 

Most importantly, your choices should be based on institutional preference and what is best for your business – rather than technology limitations. Why not work with a vendor who respects that?

Want to learn more, contact us today for more information or click here.