Exclusive: Why are Independent Third Party Crypto Custodians so Important?

Exclusive interview with Alexandre Kech: Part 1

The needs of crypto custodians caught public attention again with the recent hack of 250 million Japanese Yen from Bitpoint exchange in Japan. While certain exchanges such as Coinbase launched their own custodian services, to what extent they can safeguard the assets at the exchange?

Alexandre Kech, CEO of Onchain Custodian shares with us the importance of independent third-party custodial solutions. He identifies three grey areas for assets under custody by the exchanges and how Onchain Custodian identified the custodial needs for crypto players and traditional financial giants.

Prior to being the CEO at Onchain Custodian, you have been working at SWIFT for 17 years. Which pain points does SWIFT have in the system? What are the reasons that inspire you to enter into the blockchain industry?

I believe think SWIFT does not have any major pain points in terms of what they do in the banking space, they might have some challenges for the retail type of payments. Because in that space, the banks using SWIFT realize that it is not necessarily the most agile, easy, and cheapest to use.

“Most of the domestic as well as cross border retail remittance payments in the future will be off-bank.”

It will be done either by crypto companies or other means than banks.

The reason why I left SWIFT to join Onchain Custodian is that I believe in the tokenization of the economy.

“I think that, in the future, everything will be tokenized on blockchain. As I mentioned during the panel in Next Block Asia, Bangkok, real estate, fine arts, traditional equity – like private but also public investments – will be tokenized on blockchain, and I want to be a part of it.”

Can you share with us how you met Da Hongfei, founder of NEO on the journey of Onchain Custodian?

Da Hongfei wanted to create a custody business here in Singapore, Onchain Custodian. He was clearly looking for someone from the traditional capital market space who knows about the traditional custodian business. I went through a series of interviews, with him and Raymond Cheong our CSO, first via video, then I had the opportunity to meet them in Singapore in October. We had an hour discussion on the strategy and how we wanted to see this business going. In November 2018, I was hired as CEO of Onchain Custodian.

Crypto exchanges are starting to explore custodial solutions. Most of them are developing custodial solutions themselves. As a third party independent custodian solution, how would you compare Onchain Custodian against them? Why are independent third party custodial solutions so important?

I think what we bring to the industry is focus and dedication with regards to custody. Crypto exchanges can develop custody solutions by themselves. Nevertheless, their business focus will always be on the exchange itself and the custody business will be their second choice. That’s a challenge for them because history has proven that exchanges are the most hacked players in the industry. This is because many do not focus on custody as it is not part of their core business.

What we want to do as a third-party custodian is to build infrastructure, an operational environment that is secure and evolves with technology. Our R&D is dedicated to custody because that is our core business. That is what we offer to crypto exchanges but also investors who do not want to leave their assets in exchanges and prefer them in a separate third-party custodian.

What we also bring is transparency and neutrality. When you have your assets in an exchange, there are three transparency issues:

1) Whether those assets are in segregated accounts or commingled;

2) What part of the assets is in cold versus hot storage;

3) How easy is it to transfer those assets to another exchange for trading.

What we bring as a custodian is complete neutrality as we are independent of exchanges. If our customers want to withdraw their assets and transfer them to different exchanges, we can facilitate those processes for them.

As Onchain Custodian solution caters for different kinds of customers, such as central deposit repository, hedge funds as well as miners. What are the differences in custodian among these customers you have just mentioned?

There are two main types of customers, the first type of customers is crypto-centric. They have been in the crypto space for the last two to three years and are familiar with the crypto world. For instance, they are crypto exchanges, crypto funds, family offices, and high net worth individuals. They participate in token investments.

The second type is leaning towards the more traditional players such as hedge funds, asset managers, central depositories and custodians. In order for asset managers and hedge funds to go into the crypto space, there is a need for custodians. They would generally rely on traditional custodians such as State Street, Bank of New York, or DBS in Singapore. However, these giants are not ready. They are not geared up technically but also in terms of operations to manage those assets for their customers.

What we are currently doing is engaging with existing custodians, private banks, and central securities depositories to assess areas of collaboration. We also work with asset management firms in the traditional capital market space. While they have licenses and knowledge on the traditional market, we have the knowledge of crypto and blockchain so we can work together to offer strong solutions for our and their customers.

How does the SAFE™ Digital Asset Custody Platform fulfill the different needs of different customers? Can the platform be customized to meet different customer needs?

Very good question. We have a version one and are working on a version two of our SAFE™ Digital Asset Custody Platform.

Version one is multi-sig cold storage-based, meaning that you need multiple signatures to sign transactions on the blockchain. This version will evolve quickly to version two because we want to be able to fulfill the requirements of multiple types of customers.

The version one today allows for co-managed and full custody, co-managed means that a customer has a hardware device that will be used for signing transactions and we have the other hardware devices to complete the transaction.

Full custody means we take care of everything. You just need to go on our user interface, authenticate yourself, and authorize the transaction, then we take care of the rest. This is still in cold storage, meaning that they will be multi-signature processing of transactions, which is a manual process. What we are doing is evolving the platform towards something that is fully automated, though remaining fully secure, that will cater to warmer storage solutions to cater to the needs of exchanges and different types of customers.

Version two is being built based on the feedback of our customers. We created a very simple version one on purpose three months ago to allow us to build a version 2 based on customer feedback. In parallel, we have explored different solutions to make version two more dynamic and automated such as a hardware security module and multi-party computation solutions.

Our version two will likely be based on a multi-party computation system. Multi-signatures are still used allowing the signing of transactions from different players who needs to act on the transaction. But it can be automated without necessarily the need for a human being to intervene.

US Treasury Sanctions Two Men Accused of Laundering Crypto for North Korean Cyber Crime Syndicate

The US Treasury’s Office of Foreign Asset Control (OFAC) has sanctioned two men believed to be involved in laundering stolen cryptocurrency from a 2018 cyberattack against a cryptocurrency exchange.

The Chinese nationals, Jiadong Li and Yinyin Tian have been added to the OFAC’s Specially Designated Nationals List according to an update by the US Treasury earlier today. The two men are believed to be a part of the Lazarus group, a cybercrime syndicate alleged to be working in collusion with the North Korean government and OFAC has blacklisted 20 Bitcoin addresses associated with the pair.

Sanctioned Chinese Nationals

According to a press release on March 2, Tian and Li received roughly $91 million that had been stolen in an April 2018 hack of an unnamed cryptocurrency exchange from DPRK-controlled accounts and an additional $9.5 million from a hack of another exchange.

It has been deduced by OFAC that Tian and Li transferred the currency among a series of addresses, siphoning off a small portion to an alternate address with each transfer. This process of laundering the US treasury describes as a “peel chain.”

As a result of today’s action, all property and interests in property of these individuals that are in the United States or in the possession or control of US persons, including the 20 BTC accounts, must be blocked and reported to OFAC.

North Korea’s Ties to Cyber Crime

The Democratic People’s Republic of Korea (DPRK) has reportedly been training cybercriminals to target and launder stolen funds from financial institutions, with a series of attacks leading to a subsequent UN investigation last year.

On Sep. 13, 2019, the US Treasury identified the Lazarus Group, along with Bluenoroff and Andariel, as North Korean hacking entities based on their relationship to the DPRK’s primary intelligence agency, the Reconnaissance General Bureau (RCB).

As reported by Blockchain.News, the Lazarus group also made headlines in December 2019 when security researcher Dinesh Devadoss, encountered a newly designed piece of cryptocurrency-focused macOS malware software on a website called—unioncrypto.vip—that advertised a trading platform for “smart cryptocurrency arbitrage”. All evidence pointed to the work of the North Korean cyber group.

The Treasury strongly believes that North Korea’s malicious cyber activity is a key revenue generator for its totalitarian regime often targeting cryptocurrency exchanges.

The release does not name either of the exchanges hacked, however, last November the South Korean exchange Upbit was the subject of an attack with a total of 342,000 ETH, a value of $50 million at the time, stolen from the Upbit Ethereum Hot Wallet.

Image via Shutterstock

US Court Indicts Alleged Lazarus Group Members in $250 Million Crypto Exchange Theft

While blockchain is promoted as being cryptographically secured as the underlying technology for cryptocurrency, exchanges that hold them are still prone to cyberattacks.

Two Chinese nationals, Tian YinYin and Li Jiadong were sanctioned yesterday by the US Government for their alleged involvement in laundering stolen cryptocurrency from a 2018 cyberattack against a cryptocurrency exchange.

Grand Jury Indictment

Court documents released via Twitter by Seamus Hughes at Program on Extremism reveal that the United States District Court for the District of Columbia issued an indictment against the two individuals in a massive cryptocurrency theft against an unnamed exchange. The grand jury for the case was sworn in on May 7, 2019.

Tian and Li who also go by their GOT inspired online aliases, Snowsjohn and Khaleesi respectively, have been charged with stealing nearly $250 million worth of virtual assets between July 2018 and April 2019.

According to the court documents, Tian and Li both held accounts at two different unnamed cryptocurrency exchanges. The pair violated legal requirements set out by the Financial Crimes Enforcement Network (FinCEN) by converting virtual currency into fiat currency in exchange for fees; the pair effectively operated as an unlicensed money transmitting business.

Tian and Li transferred over $100 million worth of Bitcoin between each other’s US accounts and China accounts engaging in a form of cryptocurrency laundering know as a “peel chain” before the hack occurred. Other forms of laundering mainly consisted of converting Bitcoin to USD, Chinese Yuan, and iTunes gift cards.

Tian and Li Linked to Lazarus Group

As announced by the US Treasury on March 2, Tian and Li have been identified for their connection to the North Korean state-sponsored cyber-crime syndicate known as the Lazarus group.

The Democratic People’s Republic of Korea (DPRK) has reportedly been training cybercriminals to target and launder stolen funds from financial institutions, with a series of attacks leading to a subsequent UN investigation last year.

On Sep. 13, 2019, the US Treasury identified the Lazarus Group, along with Bluenoroff and Andariel, as North Korean hacking entities based on their relationship to the DPRK’s primary intelligence agency, the Reconnaissance General Bureau (RCB).

The court documents do not name either of the exchanges hacked, however, last November the South Korean exchange Upbit was the subject of an attack with a total of 342,000 ETH, a value of $50 million at the time, stolen from the Upbit Ethereum Hot Wallet.

Image via Shutterstock

Exit mobile version