Why Execution Risk is the New Custody Challenge in Crypto

Opinion by: Ido Sofer, founder and CEO at Sodot.

• Extended custody risk goes beyond just securing private keys, necessitating a focus on all credentials.
• Execution risk is emerging as a significant vulnerability, requiring comprehensive security policies across diverse environments.
• New frameworks must prioritize zero key exposure principles to safeguard real-time capital movement.

The Shift in Custody Security Landscape

The cryptocurrency industry has always prided itself on its pioneering innovation and rapid evolution. However, when it comes to security, it often finds itself playing catch-up. Traditionally, the primary custody risk in the world of crypto was primarily centered around the theft of private keys. While the sector made strides by employing cold storage, air-gapped systems, and more sophisticated methods like Multi-Party Computation (MPC), there’s an emerging recognition that safeguarding private keys alone is inadequate. The focus on these singular vulnerabilities has created a blind spot to a much larger and more intricate landscape of custody risk.

Today, the concept of custody has significantly expanded. It encompasses a dynamic ecosystem involving various transactions across multiple venues, custodians, and systems. Modern active trading firms now interface with exchanges, staking platforms, and liquidity venues, relying on a wide array of API keys, validator keys, and deployment credentials that have become integral to operations. This shift underscores the need for a more nuanced understanding of custody — one that acknowledges the complexities of managing real-time transactions against a backdrop of constantly evolving threats.

Navigating the New Terrain of Execution Risk

The evolution of custody security has progressed in phases, with the initial focus being protecting private keys to embedding robust policy frameworks that govern their usage. However, this paradigm must now further mature to include all credentials and keys involved in a cryptocurrency operation. The unfortunate reality is that today’s execution risk is emerging as the most critical vulnerability. Cybercriminals increasingly target off-chain secrets like API keys and server credentials instead of merely attempting to breach on-chain security measures, evidenced by notable incidents like the Bybit hack.

This rising execution risk is exacerbated by the structural challenges faced by asset managers and trading firms. With numerous connections to centralized and decentralized exchanges, managing credentials spans various operational areas — development, risk, and security — resulting in complexities that can lead to inadvertent security lapses. The organization’s effort to maintain consistent security protocols becomes a painstaking manual process, increasing the likelihood of gaps and vulnerabilities in the system.

Addressing the Fundamental Security Challenges

The lessons learned from the previous experience of securing private keys led to a clear directive: eliminate full key exposure and enforce rigid policy frameworks governing credential utilization. These principles must now be applied universally to all credentials that authorize asset movement. The crux of the solution lies not just in better storage of secrets but in the fundamental architecture of key management systems. Traditional secret management tools are designed for convenience but introduce significant risks in live execution environments, as they can grant access to full keys at critical moments.

To mitigate these risks effectively, the industry needs a shift toward zero key exposure architecture. This framework ensures that no individual or entity can unilaterally control credentials, combined with policies that are contextually aware of how and when credentials are used. Approaches such as Multi-Party Computation (MPC) can contribute to achieving this, but the broader imperative is to extend best practices concerning private key security across the entire crypto execution landscape.

Opinion by: Ido Sofer, founder and CEO at Sodot.