Jito (jto) 
Disclosure: The views and opinions expressed here belong solely to the author and do not represent the views and opinions of Global Crypto News’ editorial team.
Traditional software-as-a-service (SaaS)-based multi-party computation (MPC) custodians are often considered a convenient solution in the crypto universe, managing a significant portion of decentralized assets. However, this convenience can quickly wear off, revealing various limitations, risks, and challenges associated with protecting digital currency.
The Rise and Risks of SaaS-Based MPC Wallets
The emergence of SaaS-based MPC wallets has significantly impacted the crypto landscape, allowing businesses to manage digital assets with perceived security and convenience. These wallets are provided by tech companies that often position themselves as non-custodial service providers. However, users must still trust a centralized party to coordinate signing and key generation securely, placing them high on the custody spectrum concerning asset control.
This reliance on a centralized service provider means that control and security are not entirely in the hands of the institution using the service. While these tech providers do not operate as traditional custodians, such as highly regulated entities offering fully managed custodial services, they still introduce a central point of control and potential vulnerability. MPC technology, used by both SaaS-based providers and traditional custodians, involves splitting cryptographic keys required for transactions into multiple parts distributed among various parties to enhance security.
However, in the case of SaaS-based solutions, centralizing these services within a few dominant players introduces new risks. These providers become attractive targets for hackers due to their significant control over many clients’ assets, creating a vulnerability similar to that of centralized exchanges. Additionally, the concentration of control in these SaaS-based models increases security risks and limits the autonomy of crypto businesses.
The Challenges of Dependency and Trust in MPC Custodians
While MPC wallets often claim to be non-custodial because the institution holds part of the key, the reality is more complex. The heavy dependency on third-party vendors for day-to-day operations, security, and service availability introduces significant risks. Despite the customer institution holding a key share, all other components affecting the use or potential misuse of key shares remain under the vendor’s control. This setup creates vulnerabilities around key signing integrity and introduces friction into the customer experience, an operational risk that must be accounted for.
For instance, any policy change can take up to a few weeks if not prioritized by the vendor, posing significant delays and operational inefficiencies. MPC wallets can have longer transaction times, and their reliance on vendors for routine account changes and maintenance can be problematic. If a team member leaves, revoking their access is done at the vendor’s tempo, which can take considerable time, resulting in a period where the security of assets may be compromised. Additionally, service downtimes for maintenance during business hours can disrupt operations. In disaster scenarios, asset recovery can take up to 48 hours, which is far too long for any organization dealing with high-value transactions.
For regulated financial institutions or firms with stringent security requirements, these dependencies are deal-breakers. The operational risks and costs associated with relying on third-party MPC wallet solutions are often unacceptable to internal risk teams. These teams cannot get comfortable with the inherent uncertainties and potential for delayed response times that these products entail. Consequently, many MPC wallet solutions fail to pass rigorous risk assessments, preventing them from being adopted by institutions requiring the highest security and operational control.
A New Paradigm for Crypto Custody
If the incumbent SaaS solutions represent the ‘trust us’ model, the ideal solution should transition towards a ‘trust but verify’ approach and, ultimately, a ‘never trust, always verify’ model. This shift empowers customers to host the software partially or fully, granting them control and ownership of critical IT infrastructure. By eliminating the opaque operations inherent in black box SaaS solutions, institutions can mitigate operational risks hidden in the friction of operating in a third party’s sandbox and enable more agile and flexible infrastructure management.
This enhanced control supports better risk management and allows institutions to adapt quickly to market demands, driving revenue growth and positively impacting the bottom line. A practical solution integrates critical management and policy controls into a comprehensive platform, allowing institutions to manage their digital assets within a zero-trust security framework. This architecture continuously validates every interaction, eliminating implicit trust and enhancing security. By adopting a service-oriented architecture, institutions can tailor the system to their unique requirements, ensuring scalability, high performance, and robust security.
Current market offerings, which rely entirely on SaaS-based MPC wallets, place undue trust in vendors who control all components, including cryptographic processes, keys, policies, and transaction data. By moving towards solutions that enable institutions to own and control critical parts of their digital asset infrastructure, the industry can mitigate risks and reduce vulnerabilities while operating more closely to the principles of decentralization. Such a transformation is essential for fostering trust and security in the rapidly evolving crypto landscape.
Now is the time for institutions to take control of their policies. By adopting models that provide partial or complete control over key management and policy enforcement, institutions can better align with the correct treatment and oversight of service providers or outsourcing arrangements. This paradigm shift is essential for the industry’s future, and it’s poised to safeguard crypto’s core values while paving the way for continued innovation and trust.
For more insights and updates on the evolving world of cryptocurrency, investing, and finance, explore more news on Global Crypto News.
Haden Patrick is the director of business operations of Cordial Systems, a provider of institutional-grade self-custody software using a zero-trust security model. Haden has executive experience in team leadership, engineering, and education originating from his 24-year career as a Naval Officer. After co-founding SoloKeys, the first open-source security key company, he managed projects connecting web3 to traditional finance at a cryptocurrency trading firm before joining Cordial Systems.
