Custody debate: 2 stories, 2 sides in the last 3 days...

[legiteum]

We've had the "custody debate" here about Bitcoin quite a bit, and many people seem to be interested in it, as they should be. How you secure your investment in Bitcoin is very important since it doesn't follow the same rules as traditional investments.

The debate breaks down, roughly, between two approaches: self-custody versus centralized custody. In other words, is your BTC guarded by yourself, or guarded by some other entity you trust to guard your BTC. Or more plainly, do you use a personal wallet, or a centralized broker like CoinBase, Robinhood, etc.

In the last few days we've seen two stories that I think perfectly illustrate both sides of the question, and I think it's helpful to contrast these stories, since they both demonstrate the "worst case scenario" of each approach.

First, an a major illustration of what can go wrong with centralized custody, was the Binance hack. (I won't link to it here, and the purpose of this thread is not to talk about the hack itself since there are other threads already in place for it). But this is an example of millions of people trusting Binance to guard their BTC for them, and Binance failing at that task and losing billions of dollars in crypto.

The second was this story:

A family in the US was taken hostage for cryptocurrency

This is an example of the "worst case scenario" of self-custody: somebody was physically attacked while guarding their crypto on their own physical person.

The question I would pose to people is, what worst-case scenario is... worse? The answer to that is likely where you come out on the question of self-custody vs. centralized.

[Aanuoluwatofunmi]

Snip

The first instance you made about the recent hack on Binance and other forms of attacks that might have happened recently, and not something that should be overlooked just like that; instead, anyone still having their assets on a centralized platform should make a move as soon as possible to non-custodial storage. This is not the first time the forum has been advising on this, even before incidents like this happened.

Secondly, talking about wrench attack, this is all about privacy and the moment you think you won't others to know your worth in Bitcoin, they know the possible risk that might follow, is the physical attack they may set by tracing you to your personal destination and targeting you to forcefully take your Bitcoin from you.

Now, what is expected of us to do? Everything still revolves around the need for us to be privacy-conscious and maintain security measures: don't use centralized storage for your assets, use the wallet that best suits your privacy, and don't complicate the security yourself.

[ovcijisir]

~

Honestly I am all in for self custody. In example that you provided - kidnaapping and extortion case, the victims could easily have all the funds on centralized exchange too. If they had funds on CEX, the only difference would be that they would give extortionists access to their account.

So I think that 5 dollar wrench attack is working for custodial wallet the same as for CEX account.

Also a little note, I wonder how did extortionists from Texas found out that guy from Minnesota has fortune in crypto? It seems to me that victim did not kept his funds private. If he did I am sure that nobody would know about it.

[Upgrade00]

Keeping your bitcoin in a centralised exchange does not protect you from a wrench attack. Same way you can make withdrawals to your address you can be forced to withdraw to an address owned by the criminal. The only protection you may have is if you set limits to withdrawals or if the request flags the exchange security system

The danger of self custody is you do not have the option to request password reset through email. If you forget your access keys there is no way to recover your bitcoins. This issue is solved with recovery phrases. When used well it safely backs up your access to your coins, like your 'forgotten password ' button.

Bitcoin was designed for self custody.

[legiteum]

Keeping your bitcoin in a centralised exchange does not protect you from a wrench attack. Same way you can make withdrawals to your address you can be forced to withdraw to an address owned by the criminal. The only protection you may have is if you set limits to withdrawals or if the request flags the exchange security system

The danger of self custody is you do not have the option to request password reset through email. If you forget your access keys there is no way to recover your bitcoins. This issue is solved with recovery phrases. When used well it safely backs up your access to your coins, like your 'forgotten password ' button.

Bitcoin was designed for self custody.

That's a very good point about the $5 wrench attack working for a CEX. I did a quick search and yes, these attacks have happened.

I guess the active ingredient here is the fact that crypto is instantly liquid and easy to launder, as opposed to, say, somebody using a $5 wrench to get access to a stock investment account.

[ovcijisir]

~
That's a very good point about the $5 wrench attack working for a CEX. I did a quick search and yes, these attacks have happened.

I guess the active ingredient here is the fact that crypto is instantly liquid and easy to launder, as opposed to, say, somebody using a $5 wrench to get access to a stock investment account.

That is another story. They are abusing one of things that make Bitcoin a great currency - speed and ease of transaction.

BTW. now that you mention stock investment account - I have much better experience with Bitcoin than with stocks - stocks are prone to manipulation, vulnerable to bad management and political decisions. Also new shares can be isued, and the value of previously issued stocks becomes smaller... That is why prefer BTC, it is muh more vulnerable.

[Accardo]

Centralized exchanges are banks, people who have their assets saved there are not holding Bitcoin, they're holding air until withdrawn. Self custody on the other hand is a two way thing; "the scary example you gave" and "losing your keys to a disaster". Lost keys can't be recovered, forgotten or lost passwords to an exchange can be restored, preferences differs, but matters. The debate you seek is endless, I'd rather summarize this, than go further, with a clear point, let people make their choices, and prepare for any worst possible outcome.

[shinratensei_]

What's stopping the robber from forcing you to withdraw your bitcoin from custody service like Binance if you're at gun point? I think wrench attack could happen to both sides, centralized custody or self custody unless you're buying a bitcoin ETF. A transfer from self custody address took probably about 3-5 minutes, and yet you can withdraw from Binance just within 1 minutes by scanning QR code and using passkey with faceID which the robber could advantage of. Physical coercion is a universal threat.

[Iranus]

The debate you seek is endless, I'd rather summarize this, than go further, with a clear point, let people make their choices, and prepare for any worst possible outcome.

Right on the money, this debate is basically endless. We have been over this a million time in the past decade. So there is probably no point in rehashing the same old argument.

Every custody method comes with its own set of trade offs, and nothing in this space is 100% safe. So let folks pick storage method that fits their need and risk tolerance.

We just need to understand the risk that come with our choice and prepare for worst case scenario.

[traderethereum]

Trusting the exchanges to guard our Bitcoin will be the worst because we don't know how secure their system even though they very confident with that. I still believe keeping Bitcoin in our wallet is the best, we can guard our Bitcoin and responsible with anything that could happen. If we don't tell others about Bitcoin we have, we will not be a target.

The key is don't sharing anything about your Bitcoin investment to others and keep it for yourself. Somehow telling about our Bitcoin investment to others could trigger suspicion to others. They will search for more info about that and that could lead us in trouble. But that is up to them whether keeping Bitcoin in their own wallets or trusting the exchanges.

[pooya87]

The question I would pose to people is, what worst-case scenario is... worse? The answer to that is likely where you come out on the question of self-custody vs. centralized.

Today when you step out the door and are walking in the sidewalk a truck may get its tire pop and the driver could lose control of that massive vehicle and crush you. If you stay at home hiding in the basement, there could be a gas leak and suffocate you. These are worse case scenarios and your answer to "which worse-case scenario is worse" will determine where you stand on going out or hiding in the basement LOL

If we start thinking with irrational phobia of everything, we cannot continue living any longer. Just because threats exist!
The real question is not thinking about what are worse case scenarios. The real question is why do they happen and an even more important question is what are pros and cons of each approach.

For example in case of thefts, they usually happen because the victims advertised and maybe even boasted about having bitcoin. It's like if you hang a lot of jewelry on yourself like a display and then start walking in the street! You would be mugged eventually. Does that mean "self-custody" or jewelry is bad?!!!

Same with exchanges. Does that mean people should never trade? That makes no sense. People shouldn't use exchanges as storage but when they are actively trading, that means they will have funds stored in their exchange account. That is inevitable and there is nothing wrong with it as long as they understand the pros and cons and are prepared for the risks (ie. only deposit what they can afford to lose).

[Darker45]

Between the two stories, it's obviously the hostage-taking and robbery that's far worse than the hack. The worst that could happen in the Binance hack is that you won't get back your funds. In the other story, it could be losing your life or any of your family's life.

But it's kind of unfair to have them as representatives of self-custodial and custodial. The robbery could have been avoided if information were kept private. Surely, the robbers knew that the man was keeping millions in crypto. There probably was a mistake somewhere that could be avoided. On the other hand, Binance users were completely helpless in avoiding or preventing the hack.

In any case, it's certainly a case-by-case basis. It's probably wrong to reduce the dilemma whether to trust a centralized custodian or be your own bank into just these two stories.

[tsaroz]

We've had the "custody debate" here about Bitcoin quite a bit, and many people seem to be interested in it, as they should be. How you secure your investment in Bitcoin is very important since it doesn't follow the same rules as traditional investments.

The debate breaks down, roughly, between two approaches: self-custody versus centralized custody. In other words, is your BTC guarded by yourself, or guarded by some other entity you trust to guard your BTC. Or more plainly, do you use a personal wallet, or a centralized broker like CoinBase, Robinhood, etc.

In the last few days we've seen two stories that I think perfectly illustrate both sides of the question, and I think it's helpful to contrast these stories, since they both demonstrate the "worst case scenario" of each approach.

First, an a major illustration of what can go wrong with centralized custody, was the Binance hack. (I won't link to it here, and the purpose of this thread is not to talk about the hack itself since there are other threads already in place for it). But this is an example of millions of people trusting Binance to guard their BTC for them, and Binance failing at that task and losing billions of dollars in crypto.

The second was this story:

A family in the US was taken hostage for cryptocurrency

This is an example of the "worst case scenario" of self-custody: somebody was physically attacked while guarding their crypto on their own physical person.

The question I would pose to people is, what worst-case scenario is... worse? The answer to that is likely where you come out on the question of self-custody vs. centralized.

Repeated hack of crypto exchanges are indeed a reminder that we should be holding the coins we intend to hold longer with ourself. The security has gone strong for sure but we can never fully get rid of social engineering or direct confrontation with people responsible with holding the funds. Even though binance is a big profitable exchange and would cover all loss, it doesn't mean we would always be that lucky.
The second case is most probably the fault of the holder itself, they should not have told people about where and what they hold to minimize the risk of being held hostage. It is also the failure of the UK security. If people are physically attacked, they could also attack different people involved with the exchanges which indeed is much easier to track than individuals and do the same with exchange held users fund.
In short, for both case, its about personal discipline, personal security, cyber security and national security. Both custodial and non custodial use are useful for everyone one way or other.

[Outhue]

There is no debate, both self custody Ways and that of centralised custody are getting hit pretty hard, one mistake is all it takes, one vulnerability is all it takes, but the difference here is that losing your Bitcoin through self custody bis complete goodbye while losing your Bitcoin through centralised custody produces two results.

1. You get reimbursed.
2. You have someone to blame.

This is why many people still choose centralised custody over anything else, and it's what people are really good at, avoiding blames and taking it on someone else.

[Upgrade00]

I guess the active ingredient here is the fact that crypto is instantly liquid and easy to launder, as opposed to, say, somebody using a $5 wrench to get access to a stock investment account.

It is easy to move around yes. Similar to holding cash in your pockets which someone can just take from you (except with cash there is little trace). This is why self custody is encouraged along with personal security. You do not walk around with a stack of cash, you should not walk around with access to your bitcoins holding a significant amount. I do not think you should even walk around with a device that has access to your stocks or other investment portfolios.

[OsaiEmma]

We've had the "custody debate" here about Bitcoin quite a bit, and many people seem to be interested in it, as they should be. How you secure your investment in Bitcoin is very important since it doesn't follow the same rules as traditional investments.

The debate breaks down, roughly, between two approaches: self-custody versus centralized custody. In other words, is your BTC guarded by yourself, or guarded by some other entity you trust to guard your BTC. Or more plainly, do you use a personal wallet, or a centralized broker like CoinBase, Robinhood, etc.

In the last few days we've seen two stories that I think perfectly illustrate both sides of the question, and I think it's helpful to contrast these stories, since they both demonstrate the "worst case scenario" of each approach.

First, an a major illustration of what can go wrong with centralized custody, was the Binance hack. (I won't link to it here, and the purpose of this thread is not to talk about the hack itself since there are other threads already in place for it). But this is an example of millions of people trusting Binance to guard their BTC for them, and Binance failing at that task and losing billions of dollars in crypto.

The second was this story:

A family in the US was taken hostage for cryptocurrency

This is an example of the "worst case scenario" of self-custody: somebody was physically attacked while guarding their crypto on their own physical person.

The question I would pose to people is, what worst-case scenario is... worse? The answer to that is likely where you come out on the question of self-custody vs. centralized.

Honestly, I don't necessarily see much debate here if you ask me. Take a close comparison to a custodian and non-custodian wallet. While some of the modern non-custodian wallets provides some DeFi perks like staking, cross-bridge exchange, DEXs, etc, the traditional, more secured, and cold wallets don't do these. It's just for receiving, storing, and transferring of Bitcoin/coins.

Meanwhile, CEXs provides different infrastructure and investment schemes within a closed system for your Bitcoin/coin hodlings. Ranging from trading, staking, exchanging, even DeFi investment infrastructures are there.

I see the both as tools providing different opportunities around Bitcoin's utility, ranging from just hodling to lending and borrowing your Bitcoin.

If we want to talk about security, we can't say both cases haven't recorded significant losses in that regard.

So, I won't make my distinction and place importance based on worst-case scenarios; I'll do that based on utility at the moment. I'll ask myself these, do I want a more secure wallet for just hodling my coins, or do I want to participate in different investment programs with my coins?

Because, every worst-case scenario can (has the potential to) happen in both cases; they may or may not even be due to OpSec.

[Hypnotizer]

~
The debate breaks down, roughly, between two approaches: self-custody versus centralized custody. In other words, is your BTC guarded by yourself, or guarded by some other entity you trust to guard your BTC. Or more plainly, do you use a personal wallet, or a centralized broker like CoinBase, Robinhood, etc.

In both cases, you’re still going to be the one “guarding” your bitcoin just that the other option has insurance.. 

Think of it this way, in a Self-Custody wallet you’ll do anything to secure your seed phrase and avoid getting scammed through the various means available but something like the ColdCard drain or the recent Ledger drain might happen (if you happen to be using a hardware wallet) which you have no control over and you might lose your bitcoin forever.

Whereas depending on Centralized Exchanges or Custodians to store your bitcoins, you’d still need to protect your password by all means and avoid phishing attacks and other means of scams available (you can reset the password though). Also if something like the Binance hack happens, you might get your funds back if the platform has enough to cover the loses or lose it forever if they can’t cover the loss.

So I don’t see this as a debate.. let anyone choose whichever he/she considers best for themselves after all it’s all about “taking risks”.

[Multani Boy]

For example in case of thefts, they usually happen because the victims advertised and maybe even boasted about having bitcoin.

This is true in many cases but not always. In Jameson Lopp's public database of wrench attacks there are numerous examples of victims who didn't post or boast but were found out due to KYC data leaks from the exchanges they have used, or due to wealth address identification via on chain clustering and then cross referencing with real life identities. Not boasting will help but does not fully protect you if you had an exchange breach at an exchange you used years ago and your KYC documents were leaked, or if you are well known in this industry (founders, popular forum members with high activity in trading sections etc.) without mentioning a number at all.

People shouldn't use exchanges as storage but when they are actively trading, that means they will have funds stored in their exchange account. That is inevitable and there is nothing wrong with it as long as they understand the pros and cons and are prepared for the risks

100% agree. I would also recommend to have a "trading float" mentality rather than a savings account. So only keep funds that you are actively trading with in your exchange account. Withdraw all remaining funds immediately once a trade has been closed. This way even if you are an active trader (which will require you to hold funds on the exchange) your exposure will be limited to only your working capital. It does not completely mitigate the risk you mentioned but reduces the impact of the hack/KYC leak etc.

[Merit.s]

Whether, you use an exchange or noncustodial wallet, you can still be forced to transfer your funds under torture/durex. This doesn't mean that self custody isn't the best way to store your bitcoin because you are in full control of your funds regardless the challenges and risks that comes with self custody.

All the hacks happening this year is a wake up call for us to be at alert and secure your wallet properly to avoid any little mistakes that can lead to your wallet being compromised. Split up your funds and don't put it all in one place.

[Jaycoinz]

All the hacks happening this year is a wake-up call for us to be alert and secure your wallet properly to avoid any little mistakes that can lead to your wallet being compromised. Split up your funds and don't put it all in one place.

Before all these recent happenings and hacks, many people would also agree that self-custody was one of the best way of actually making sure your funds are safe, but now it's starting to look like even cold wallets are not safe because the hacks are getting upgraded and I don't really what changed, is it that the hackers evolved or introduction of quantum computers made it more easy? But that said, I completely agree that diversifying your funds and splitting it across different wallets give us an edge to encounter these hacks.