Published Jan 17, 2022
By Qredo Team
Decentralized MPC vs Hot and Cold Crypto Wallets
Since the early days, crypto wallets have come in two types: Hot crypto wallets, which are connected to the internet, and cold storage, which takes the private keys controlling digital assets offline.
Qredo offers a radical new approach: A suite of trading, settlement and compliance tools that leverage a decentralized implementation of multi-party computation (MPC) — a unique method of managing private keys.
This post examines how Qredo's implementation of MPC — which we call decentralized custody — stacks up against hot and cold crypto wallets.
Hot Wallets
Hot crypto wallets: Software for storing digital asset private keys that runs on a computer connected to the internet.
The equivalent of pocket wallets for physical cash, hot crypto wallets are connected to the internet and typically used to hold a small amount of digital assets for day-to-day transactions.
The very first crypto wallet — Bitcoin-Qt — could be considered a hot wallet because it stored the private keys quite precariously in a file on the user’s desktop. Since then, hot crypto wallets have evolved to become more secure and user-friendly, but they still have the same defining characteristic of storing keys on an internet-connected device.
Pros and Cons
Easy accessibility
As hot crypto wallets are connected to the internet, assets can be withdrawn on demand — allowing transactions to be made with just a few clicks. For individuals, this makes hot crypto wallets very convenient for making small purchases. And for companies such as crypto exchanges, it enables customers' assets to be immediately withdrawn. Hence many crypto firms use hot wallets to store a small portion of between two and five percent of total customer holdings.
Poor security
Countless tales have been told of hot wallet hacks, with private keys pilfered and
prised out in endless different ways. In fact, there have been so many losses over the years that forward-thinking regulators have introduced legislation requiring exchanges using hot wallets to hold the same quantity of crypto elsewhere to reimburse users in the event of loss.
🔎 Historic Hack: Bitfloor, 2012
Early bitcoin exchange Bitfloor was hacked to the tune of 24,000 BTC, worth about $250,000 back in 2012. This was made possible because the private key was kept online in an unencrypted hard disk partition. As one of America's most popular crypto trading platforms at the time, the hack sent a clear message to other crypto companies that storing private keys online was a recipe for disaster.
Cold Storage
Cold Storage: A method of storing digital asset private keys on a device that is not connected to the Internet.
Often sold as the most secure method of crypto custody, cold storage solutions store private keys offline in a throwback to the physical security paradigm of storing assets such as gold in vaults.
The first primitive forms of cold storage were simple printouts of private keys known as paper wallets. Since then, the most popular form of cold storage has become specialized hardware modules that secure private keys in a smart chip known as a Secure Element.
Pros and Cons
High security
Private keys held offline can't be hacked or stolen by malware. Hence, cold storage solutions are generally considered more secure than hot crypto wallets. However, cold storage hardware can be vulnerable to theft and damage such as broken screens like any other electronic device. As a result, the most secure cold crypto storage solutions rely on the same physical security mechanisms that you might find protecting gold bullion — with private keys stored under Swiss mountains in reinforced steel vaults, and even protected by armed guards.
Low accessibility
Much like the plunder of pirates buried six feet beneath the sand, private keys held in hardware crypto wallets can be difficult to access. For an individual custodying their own funds, this might make it only slightly more bothersome to withdraw funds. But for exchanges and crypto companies where cold crypto storage devices can be shared between teams, withdrawing from cold storage can mean navigating cumbersome and delay-prone workflows involving human approval, and can take hours, days, or even weeks, depending on the circumstances. In addition, storing the private keys offline can leave the digital assets cut off from the yield-earning opportunities of DeFi.
🔎 Historic Heist: QuadrigaCX Cold crypto storage lockout
Founder of Canadian crypto exchange QuadrigaCX, Gerald Cotten, held the majority of the exchange’s assets in cold crypto storage. He then took the assets to the grave on his unexpected death, leaving thousands of customers out of pocket. This event showed that, despite the supposed strength of cold storage, it is ultimately only as secure as the governance policies protecting the funds.
The Hazards of Hot Crypto Wallets and Cold Storage
| Principal risks of Hot Crypto Wallets | Principal risks of Cold Storage | |
|---|---|---|
| Individuals | Hacks, malware | Accidental loss of keys, human error |
| Crypto companies | Hacks, malware | Insider theft and human error |
The Hot-and-Cold Combo
The compromises of each type of custody means crypto firms typically rely on a combination of both hot and cold crypto wallets, protected by an additional layer of governance in the form of multisignature schemes.
After the hack of the Mt.Gox exchange in early 2014, multisig became popular as a way to spread signing responsibilities and prevent any single person from being able to compromise assets held in a wallet. It does this by having multiple individual private keys (N) for each wallet, with a set number of signatures (M) needed to authorize transactions (M of N).
But using hot and cold crypto wallets combined with multisig — also known as a co-wallet strategy — has significant drawbacks.
Both hot and cold crypto wallets were designed from the get-go for individuals. Thus, even when combined, they still lack the operational flexibility, granular control over governance, and institution-grade security that crypto firms need to scale custody of hundreds of digital assets across a growing business. This is especially the case when serving millions of customers that increasingly want instant access to funds, while simultaneously guarding against the ever-present threat of hacks, human error, and rogue insiders.
Decentralized Multi-party Computation (MPC)
Qredo disrupts the dichotomy of hot and cold crypto wallets with a new method of managing the private keys controlling digital assets: Decentralized custody.
Using this custody method, the private keys are distributed across an independent blockchain network using a cryptographic technique called multi-party computation.
As the single point of failure of the private key is taken out of the picture, there is no need for the offline storage, air-gapped hardware, and cumbersome signing procedures that make assets held in cold storage difficult to access.
And, because compliance and governance is baked directly into the Qredo blockchain, there is no need to rely on inflexible multisig schemes. Instead, Qredo users can easily adjust custodial policies with rules-based transactions that have unlimited flexibility.
Qredo’s scalable custody infrastructure...
...combines the frictionless convenience of hot crypto wallets, with the virtually impenetrable security of cold storage — resolving the inherent trade-off between security and accessibility which is endemic to existing custodial solutions.
...provides a flexible and programmable foundation for a suite of decentralized apps that support institutional digital asset needs (such as Travel Rule compliance), while enabling easy integration with the front, middle, and back office services of traditional finance.
... bridges the gap to DeFi, allowing digital assets to be deployed in decentralized finance protocols, with finely-tuned governance to match organizational needs (as enabled through our partner MetaMask Institutional!)
All of this and more means that hot and cold crypto wallets can't compete with decentralized MPC:
Hot and Cold Crypto Wallets vs Decentralized MPC
| Hot and Cold Wallets | Decentralized MPC | |
|---|---|---|
| Security | Hot crypto wallets leave private keys vulnerable to theft, and cold storage solutions risk loss due to human error. | Decentralized MPC removes the single point of failure of the private key, making theft or loss almost impossible. Assets are insured by Lloyds of London. |
| Accessibility | Storing assets in a multisig co-wallet strategy means distributing keys across the organization, which can create delays and bottlenecks when the time comes to withdraw. In addition, shuffling assets between hot and cold wallets and withdrawing them on Layer 1 chains is slow and cumbersome — impeding the ability of organizations to quickly execute time-sensitive trades or access DeFi. | Assets held on Qredo can be instantly transferred between custodians, brokers and financial institutions on the Network, and withdrawn at the speed of biometric authentication. |
| Fees | Taking custody of digital assets can mean purchasing your own hardware, or subscribing to expensive third-party services. Costs are further increased by the size of large multisig transactions, which typically incur high network fees on the underlying chains. | Qredo charges zero fees to hold funds on the Network. |
| Interoperability | Only a few blockchains — such as Ethereum and Algorand — support onchain multisig transactions. And, the multisig schemes can only support assets on that specific chain — meaning large crypto firms will need different solutions to accommodate multiple assets. | Decentralized MPC enables a single custody solution to be implemented for multiple assets across different blockchains. |
| Access to DeFi | Assets held offline in cold storage are divorced from the DeFi ecosystem, limiting the ability of digital asset holders to participate in on-chain activities such as governance and staking. | Qredo delivers institution-grade access to DeFi through MetaMask Institutional. |
| Compliance | Hot and cold crypto wallets typically require bolt-on solutions for regulatory compliance. | Decentralized apps such as Qredo's Travel Rule solution allow for easy compliance with emerging regulations. |
| Governance | Multisig is inflexible, enabling only basic (M of N) governance based on simple approval quorums that cannot be adjusted without creating a new address. This means users must move the entire balance each time an approver is added or quorums are amended. | Decentralized MPC rolls compliance and governance directly into custody, removing the need for cumbersome onchain multisig. Users can assign an unlimited number of signers, adjust approval quorums on-the-go, and flexibly customize policies to fit organizational needs. |
| Auditing | Having multiple hot and cold crypto wallets for different assets makes it difficult to provide the complete picture of digital asset activity needed to meet increasingly stringent regulatory demands. | Decentralized MPC records all activity on a Layer 2 blockchain, providing an immutable and exportable record of inflows and outflows on the Network. |
Ready to enjoy the benefits of decentralized custody?
👩💻 Sign up for a free Qredo Wallet today, or arrange a call to learn more about how your team can meet its governance needs and manage crypto assets in a more efficient way.