All right, I think we're live.
Good to do this. Yeah.
Welcome everybody. Canadian Bitcoin conference podcast. We're here today with Loick from BitVault. How are you Loick?
Doing fine, thank you. And you?
Great.
Good. And today we have obviously Wasim Sunny and we're missing Ben. Ben's doing some other things today, so we're marching on without him. so, thanks for joining us, Lo. We obviously want to dive right into it and you know, talk about probably one of your main subject areas. I'm sure you've got many, but you know, recently, you know, this is the Canadian Bitcoin Conference podcast. We have cold card are you know Canadian based we've had the issues in the last number of months with with what happened there. my first question is single sig self-custody dead? what's your opinion on that?
Well thank you for having us. no I'm not sure it's dead. what I would say is or my understanding of self custody is single signatures obviously for a wallet for me a wallet is is for spending your bitcoin if you want to keep your bitcoin for the long term you need a vault which is my in my opinion different u way forward it demands multi- signature and time delays.
So, explain that vault to me. you know, it's a vault. When I think of a vault, I think of, you know, if you I've been in vaults in Toronto and it's RBC and it's locked behind, you know, big wheels and you know, big cast iron doors. what's a vault mean to you? well a vault is keeping your bitcoin for the long term. So you can put money in very easily but it comes out slowly and it's been designed in that way. So that the two main problems of of self custody are that things break. you lose a seed phrase, a device dies, or as we watched this summer so many Bitcoin walked out of thousands of addresses in a very tight pace. the problem is the multi- signature needing several keys. so that having a vault in with a multi- signature allows you to have that single failure which would be fatal on the side. And the second problem is that people can be compelled if somebody comes to your place and forces you to fetch every device you own. probably they'll they'll have that happen and the only thing that can protect you is a time delay. So the vault is built in such a way that you define every conditions before creating the vault and once it created you can't change the conditions. yes. is that enough or should I.
No, that that's okay. I guess my follow on question from that is what are those conditions?
Well the first one is the time delay. So maybe if you have like small amounts, you would have time log like maybe two hours or yeah two days.
And if you have generational wells as it's so nicely exposed, you would maybe want to have two weeks or two months in there. that's the condition. Yeah.
Okay. Perfect.
So I guess that's a natural progression, right?
Yeah.
So it sounds like it's a natural progression, right?
Sorry, Go ahead. Yeah, go ahead.
Sorry. Was a bit of a delay there, so I could show up there. Sunny, go ahead.
No, Go ahead with him. You first. I just have a bunch of Yeah, you first. It was a natural progression, right? Like you kind of start on you know on you buy on a particular platform you may move it to a hot wallet now cold wallet and now we're talking about you know storage like long-term storage in a vault. That kind of makes a lot of sense, right? And I guess what you're highlighting here is like from a hot wallet perspective, day-to-day use, cold wallet, you know, that could be something a little bit more not permanent storage, but like some more timebased storage, longer storage. And then the vault would be like that's your gold. Like that's locked away for good. And we and you just have the timebased component on top of that as the secure the additional security kind of layer on top of like a cold wallet. it's really the combination between the multi- signature arrangement. So you need two two signatures to move the coins.
So say Sunny has one and you have one and we also have one. So you need you need two of three. Obviously, it's a multi- signature. and we have two paths to to spend your bitcoin. So, the normal day-to-day pass would be your device plus our co- signature. that's the pass that carries a delay that you set. that's well, as a default, it's anywhere between 2 hours and 15 days. but the really cool thing is that the moment a payment starts, you get an alerting telling you the amount and where it's going. And during that period, you can cancel it.
Okay. So like.
What you can also do is you can also have a trusted person that quietly gets alerted so somebody else knows to check your all right before any money moves. So that's the normal parts right your your device plus our co- signature in that in that way and the other one is what we call the recovery pass where you need your two devices you need nothing from us at all. So that pass opens after a year but not a year after the vault was created but after that particular UTXO lands in the vault. it's how should I say it's your door out it's written in the Bitcoin script itself. You can go and read it on the blockchain. there's nothing we can do to close it. and yeah, if we go out of business, if somebody orders us to see.
To go out of business, yeah, you can still move your coins. So, it was designed like this, but it means there are some there are some choices you have to make. and for us, it was really important that the user can move their funds. the hardest thing to do is to wait a year until those until the recovery pass is open.
Okay. So, can I just one thing you'd talked to us about just when we were just before we went live is when we talked about the cold card issue, you were surprised with the how fast those wallets the pace of those wallets being swept. that's really interesting. And I guess, you know, for me as well, I mean, yeah, it seemed like and there were days and maybe even weeks between people people's wallets were swept and then they realized that they actually the Bitcoin was gone.
That's the thing was they maybe had their call card in their safe and they didn't do anything, right? It was just because it was certainly possible to just brute force your way through. But with Bit Vault, what you're saying is if you know if you had that one week, two week time delay, when if someone tries to sweep your wallet, or eventually gets access to your wallet, they and they move funds to another wallet, there is a time delay or there is a notification and then they have to wait, you know, that one to two weeks, you know, but in between times you can, you know, you can cancel the transaction. That correct? That's what I understand.
You can cancel it or you can send it somewhere else.
Okay. Yeah.
And nice aspect is that somebody you trust gets notified beforehand say I'll just check in. Dan wants to send his Bitcoin. He seems okay. giving a ring or something like that and then you can move it and if it doesn't happen then you can maybe send the police.
Yeah. And how does the notification work?
You can use telegram or or email.
Okay.
Is the time delay is it check sequence verify like pre-sign transactions or covenants like how are you pulling it off?
There's no covenant. but well it's all onchain so it's check sequence verify it's a relative time lock which is linked to the UTXO in question. So if you have two bitcoin you send the first bitcoin and six months later second bitcoin you would have two different relative times going.
And then if I send those two bitcoin I send it one bitcoin to Dan then the one bitcoins come back and then you have.
Oh.
You have one I mean it refreshes the relative time block. So,.
So, you have different.
Do so in order for.
For your Bitcoin to all always have the first pass or the normal day today where you have the time delay is that after 6 months we send you a notification a send yourself Bitcoin. There's a small fee of course you have to pay but that's the idea. So different unlock times per UTXO. So how do users track that?
How do users track that?
Track it.
I track we do the tracking for you.
Got it. And if Bitfall vanishes tomorrow, like how do I get my coins?
Well, you have to sit and wait for at least a year. that's 52,560 blocks. and that enables the recovery path to yeah to open and and then you need your key your signature device plus well the other signature device but you don't need bit vault.
Cool. Thank you.
That's really cool.
Wow. But that was it was designed like this because it makes sense that we are not a custodian and we are helping you with the convenience of holding your Bitcoin yourself.
What breaks at scale?
I like the UTXO management the fees or like user error. well what we advise you can go and look at our website is that you have to have well a good management good practices is that you keep both your hardware devices in two different locations and the backup as well. That's really important. Yes. super smart with.
I saw on your on your site you've also got some some integration maybe more recently with lightning as well right so is there is so how do you kind of balance that right like between you know trying to enforce security on the base chain for you know long-term bitcoin storage versus you know integrating with lightning for you know liquid support for you know more time delayed cold storage against like finality of layer 2 networks how do you kind of.
We the company was created the end of June last year and well the vault as we call it is the is just happened at the end of June this year. We're not that far with lightning now. we've concentrated all our resources on on the vault. So and that's a story for later. we getting there but there's this the things we have to do before but so I think what most people get wrong and what catches people out with any multi signature is that the seed phrase on the own will not get your bitcoin back. that will never happen in any multi- signature setup whatsoever. what you need is the rules you know you need which public keys in what order what are the time locks if you have a perfect seed backup but you don't track how it's been arranged you cannot rebuild the vault so what we do is that we send you a PDF with all the instructions you get the QR code you can scan it back in and I think when you have the complete recipe, it it makes perfect sense, right? And you can sew it on the cloud or you can get it encrypted copy stored.
Can governments compel you to freeze or block a withdrawal? to be honest, they can I Yes, they can do this for they can do this temp temporarily. so they can order us to stop cosigning. You know, they can come to and say no, you can't do that anymore. that's within their power. And yeah, I won't claim otherwise, but what they can't order us to do is to hand over coins we're unable to move because we have no lever on our side that moves money on its own, right? It's a two of three. So we having one co signature doesn't move the funds. I think that's the smart way forward. is that super interesting. Sorry, last one before I hand over. I'm just really intrigued. Is it tap routt or a minuscript?
Super cool. Learn more about it. Is there like a white paper or like is it all on your website?
There's lots of information on the website. and there's a well our repos it's all open source. but we can send you the information.
Who's your biggest users is like family offices and like high net worth individuals mostly.
Institutions using you guys.
Yeah, we just started. So we have we had 800 850 better users. I hope they will translate into actual users because that's the idea is that we fight for self custody, right? but we also noticed that that the new vague of of adoption in Bitcoin is like missing. I mean, I don't know what you guys have seen, but there's less people interested in Bitcoin or moving into Bitcoin by many metrics.
It's a bare market.
Yes. but also like nine months ago the adoption is not really there or the options I saw coming was not there. We see institutions coming in. So if you have 10 million to custody, you would be looking into a solution like ours. I think what we do differently maybe I can speak a bit about that.
Yeah. is that we insist on having a a normal day-to-day pass with all those functions. I I talked before what happens often is that you have an emergency route and and different providers work on that. But what's important for us is that you have the like the normal time pass has the time lock has all the features needed not just the emergency rout.
I'm just looking on your website as well like the package the two-year package which includes a keystone 3 and a G plus I mean that's good value on its own. Never mind you know.
With the the hardware wallets.
Yeah, I mean it's on what you said about the the adoption. Yeah, I mean we probably as you know we canceled our the Canadian Bitcoin conference. We had a few days planned this year just.
Yeah. planning to Yeah. But we we canceled with yeah like Wasim said bare market vibes the companies are being challenged in terms of their sponsorship. So you know the feedback from the ground is that you know it's either sp sponsor and attend a conference and go to all the expense or let people go you know who they've employed and you know obviously companies are trying to keep people employed. is more important. you know, also, yeah, like you say, the newer people coming in, I I'm not sure how it's going to look like in one year in terms of, you know, if number goes up and lots more people come back in and then they start to look for these products or you know, all the products again. But yeah, it's it's been a challenging time. But there there's certainly and even we saw that when we were planning the conferences there is a bigger shift to the institutional side the digital credit the family offices the you know you know.
Financialization of Bitcoin the family offices and almost you know there were com people's people on companies we've been talking to for years and we're like no Bitcoin that's not too risky it's not mature enough, you know, and gold was there. And then you see this kind of swing from gold and, you know, other investments and even in Canada that the real estate is a big one as well where they're looking for exposure to other things now. So, Bitcoin is becoming an option.
And then yeah, Bitcoin obviously if you're investing large amounts of money, you need to secure it properly. So, that's probably what you're seeing on your side. But we have a solution for for institutions, family offices. but generally businesses, you know, Switzerland is a country of small and medium enterprises and we also see that there right the Swiss Frank is very not competitive. I mean we export a lot to the European Union. more than one out of two Franks comes from there. but everything is 20 25% more expensive in Switzerland than you find in the EU. So it's definitely something these small and medium enterprise are looking into because that so if they have if they can save if they have savings they can put part of it in Bitcoin and then they need to be able to do it in a self custodian way because maybe they need to move quickly. maybe for whatever reason financial institution can block them or and in Switzerland we are very we're very small so we are like trying to very we've been very often deceived by bigger players. So I think maybe it's a Swiss component as well. yeah, but what I see the battle is isn't at all about Bitcoin anymore. Bitcoin has won many arguments I would say. but if you if you consider that it's a decentralized network where almost everybody everybody's coins sit within a couple of custodians. it isn't decentralized in any sense that actually counts. So you can have a very resilient protocol but if the practice is centralized you've built a bubble just with a different branding. So the battle for self-custody is really an important one and it's really whether ordinary people can actually hold Bitcoin themselves in a safe way. and that's why I think this solution is such a good one because it allows everybody to self-custody their Bitcoin.
And I think that's a you know very in invaluable feature right of Bitcoin the fact that you can self- custody. Now, admittedly, it's not necessarily for everybody, you know, there are and also, you know, from a regulatory perspective, particularly, you know, kind of in the investment space, like it's not like you can hold Bitcoin in registered accounts, etc., at least here in Canada. So, you know, you're kind of, but the option exists for any anybody globally, right, to self- custody. I guess the challenge is you know, self-custody in itself is, you know, as we've been talking about for the last 20 minutes is, you know, it's not necessarily a straight line and straight as and it's necessarily foolproof. it is quite involved that you got to kind of educate yourself. It's a you know just like you would hold gold like I guess you got to kind of think about how to protect it. This isn't similar thing in the digital world here. So what do you see is like the next major hurdle really for the industry to kind of solve the self-custody to really make it foolproof because it is quite there's the barriers there's a lot of friction right to kind of enable self- custody still. yes. well just realizing that multi- signature is not the way forward. because a coordinated attack can happen and it can happen really quickly. we've seen this this summer unfortunately. So yet I think it's been a big setback for not only the small the small holders but also maybe institutions that were planning to go into Bitcoin and suddenly.
The cold card card was played. So and that was most probably a setback for new adoption.
Yeah, 100%.
Very troubling. It's not been the only one, right? TZO was also a story. We had lightning. So BTC pay was also affected or we have a Swiss Bitcoin payment company that was also attacked.
Not to mention Liquid.
Yes.
Liquid. Yeah.
Yeah. And but Liquid is house is housed in Blockstream. at one point employed 80% of the core developers of Bitcoin. So I guess the question I have is like are the hardware wallet vendors itself now the single point of failure? Well, I would still say that we are so you are I am we as a human being are we make mistakes. we are for the most part very lazy. what we advise is so the good thing is to do a good way forward would be to use a would be to use a keystone to use jade because you have different levels of well you don't have just one single hardware wallet provider and this is also important because you can use an older one, but we kind of try to remind people, use a new one. start from scratch. Have your backup. sure. I'm sure many Bitcoiners have a backup and they've done it six, seven, or eight years ago and they haven't touched it. I think it's also good practice to have a small amount of Bitcoin, test your backup. If it works, put more on. But which Bitcoiner has really done that? So I think I think what really happens to Bitcoin is is how we handle it. Yeah, there are steps, right, that you can take that but who does it?
Yeah, you're right. Like there's selfdy.
Yeah.
And then there's self-custody hygiene, right? Which is kind of what you're describing. Like you kind of be neatly doing stuff to make sure it's still working and you remember how to do it. And you know, especially when you're under duress or under pressure, you got to be able to do it well because you get one crack at it, right? So yeah.
Isn't Bitfall's co- signature the same trust problem in a new outfit though?
In which respect?
Like meaning I want like the re what happened is nobody actually verified with cold card, right? Like meaning nobody could.
Well I mean like nobody did at least.
It was only until AI presented itself, right? So all these.
Kind of holes in our armor are starting to show. So I'm just want I'm not saying what you're doing is wrong. I actually am super impressed by what you're building, but I'm just asking is like the co- signature that you're using in BitVault, I need to trust you that it actually makes sense, right? And or is that all open source and you have like teams like how do we get away from having to trust one person or one source, right? I mean, from what I understand, the cold car situation when they kind of diverted away from open source and made that pivot to cold to closed source, that's kind of when the error started to I think start to show and whatnot. But do you know what I'm asking in terms of like where does that line draw itself? It's an interesting topic because in my very humble opinion having an open source protocol is not does not mean it's all good. M but having a closed source then you trust the company and well if it's there for many years then you maybe trust goes up but the trust also gets diluted right if you say it's all open source and you say oh well probably somebody smarter than I am would gone on GitHub and done their due diligence and right so somebody else would have done the work I know everybody says in the Bitcoin space don't trust verify but who actually does.
Exactly the question is how do users verify that was literally their saying don't trust You can right.
What what we started doing is that what happens if we are not there anymore that's where we started and if we can't do the co-signing you have to wait a year and then you can move your funds.
Got it.
But so you don't need us basically. What I mean you can buy a subscription for a year or two because you get two devices and then you stop paying but you get those two devices for the same price. that's maybe just enough you know and I don't know it's it really depends what you want to do. so in my opinion if you have a vault you put funds there that you don't want to move directly right say I have 10 bitcoin how many bitcoin do I need in the next months or in the next say three months or a financial adviser in Switzerland would say to his clients make sure you have enough savings. I mean it seems very it seems incredible for people outside of Switzerland that they would say between three and nine months so that you if you have an emergency then you can the idea is that you have enough savings right this is not the case in the US I think twothirds of the population just live paycheck to paycheck which is very different situation but at least in Switzerland that's what recommending before going into investing in stocks and that kind of stuff. So, three to nine months. how many Bitcoin is that for my life? And the rest I could just put in the vault and it could stay there a year, two, three, four, five, and I don't need to trust Bit Vault.
I love the time component. It's so smart. I I'm surprised I haven't heard more about it.
Cool. Dan Wasim, any other questions? I mean, thank you so much for going into these deep waters with us. these are uncomfortable topics, but I mean, the silver lining I see is that.
Bitcoin is open source. It's kind of this decentralized network. So, it's getting attacked first, right? And it's hopefully healing. Like, the immune system is kicking in, right? We're learning from our mistakes. Like, I mean, I'm learning about new things even.
So, I think I'm hoping that Bitcoin emerges like stronger, right? And ever before. And it's like Yeah.
I don't What do you think, Dan?
Yeah, I think so. I think you're right. you know with all the attacks you know it's changed my approach you know to just your personal information you know ordering products online you know obviously you know now that the points of fail or we know more now that points of failure are with companies that you know can leak your addresses get your you know who knows what's going on sell them like you say someone in there and shipping you know shipping and handling is just handing out addresses to people for 20 bucks, 100 bucks, thousand bucks, whatever it is. That's a single point. So, you got to start to look to those single points of failure and you know, protect yourself from them. So, it's changed my way, I think. And I can see from a lot of people in our community that it's changed those, you know, from Telegram chats, people are starting to explore new options. What's the risks of mis of multi-ig? What's the risks of all the other things? Before this happened, I didn't understand the complexities of multi-seg. I thought it was just two or three, you know, two or three keys like you know, I didn't understand that you needed all the Xpub and the, you know, all the other additional information along with that. So, yeah, you're right, Sunny. It is. I think the community is learning. it will make Bitcoin stronger. and you know with other challenges it's shaking out a lot of the not I don't want to call people weaker hands or whatever but people who are not comfortable with self-custoing large amounts of money or whether small amounts or large amounts but people are not comfortable with that learning that process taking responsibility for that process you know and there are options there like big b maybe cassa and other you know companies who and likes of Anchorwatch. I know those guys that you know do some insurance and stuff as well. So like there there's loads of options out there if people want to look out and yeah do the research but yeah no.
There are so many possibilities well anchor watch the insurance they pay you I think in Viat but yeah basically there's no way of insuring in SATs I mean you don't get your SATs.
You get the amount that that goes into the insurance policy in fiat. I think that's the that's the way they have which is already really well thought. I just wanted to say them something about you know that shipping partner of Trezor that was.
Yeah.
That was hacked.
Yeah. So what you can do so if you want to buy a subscription for BitVault you can use Zaprite and you only need a decoy email, right? So that would be the only information we would have regarding your person. we wouldn't know anything else. You could have a telegram handle as well, but that can also be pseudonymous. so you can really get protected.
Cool. I like thinking about that.
What's also important to know is that we don't do any of the shipping. Keystone and Blockstream do it. So you redeem a coupon directly with them. So there's no delivery address on our systems at all. We basically only thing we have is the email address you use but you can use whatever privacy first email address you can use proton you can use what's the another one elude mail or that kind of and I think you can also go into more in into more depths and you could buy your Keystone annual block stream at a Bitcoin conference, right? Or if you order it, you could have it shipped to a different address. You know, this way forwards. what I would what would I like to see is that this is the cooperation between the solution providers like BitVault but also from the customer side right you have to work together so that the security I mean the whole game is elevated. Yeah. So.
I think it's personal responsibility for a lot of people. I think that's one of.
What we do is we tend to minimize what we collect. So I told you it's just the email and the telegram handle if you wish but that's you for you to decide but you have to control what you hand over right. So it's.
Yeah.
If a company tells you your privacy is entirely their responsibility, I think they they're confused.
Then I got to ask one more question, right? I mean, we've all agreed that Bitcoin's going higher. You know, the Bitcoin's already won as you said, Lo, but I got to ask you just kind of in closing here, right? So I mean, you came from kind of a traditional finance background, but I think that's kind of your where you you started your journey, but I just wanted to know like what's your aha moment, right? to kind of leave traditional finance and hop into you know starting a building a Bitcoin security company.
I studied environmental science so I am also from that side but also economics.
Cool. yeah well it's not like really sexy as we said at the beginning but what really I mean a very good moment I remember was watching Andreas Antonopoulos video on Bitcoin security which is called bubble boy And the sewer rat. Have you watched that one?
No. Add that one to the list for sure.
It's u it's quite old. but I think it's worth watching it. The idea is that if you live in a bubble, you don't get in contact with the outside world, right? and banks have done that, insuranceances have done that. So you barricade yourself behind the wall. but once the ball u pops then then you have a problem and Bitcoin is the sewer rat right it's been exposed to the open internet since day one and not since day one but but there's been a bounty on the Bitcoin head and it's been continuously under attack and I think what Antonopto is trying to say is that constant exposure is exactly what builds immunity. So.
Yeah this is really what hooked me right. so if security comes from being open and decentralized rather than being walled off then the network is not the fragile part. the users are the fragile parts our device habits our yeah our front doors as let's say front doors in France for now.
Unfortunately.
The pro protocol has been hardening in public for so many years and and on the contrary people holding Bitcoin mostly haven't right it's Yeah,.
Perfect. Listen, that's a good place to end it. So, I' I've posted the link from Andreas there, Bubble Boy and the Surat. That'll be an interesting watch for anybody commuting tomorrow.
So, listen, where can anybody find you? how Lo and yeah, Bault as well.
You can find us on on all social media platforms X Nosta LinkedIn as well. visit our website. it's quite funny. I tell you this, but we have a blog and there's lots of information on it, but like really good information. I think it's called blog uh.bitvault. yeah. And yeah, I mean, go on the blog, you'll learn a lot about security. yeah. we started yeah just over 15 months ago. So yeah we're building and there's more to come. we have we have two great products in the pipeline. but you'll hear more about it in the future. I think there's a really good there's a really good offer going on now. If you can have one year subscription plus one device, you can choose it's good if you go for the two-year subscription you get two devices. So that's that's also on our website. yeah and then as you said before try to have the best security hygiene possible, right? So have a bug cap and test it and come back to it and try to improve and there's no perfect solution for everybody. It's you have to determine what what the solution is and I think BitVault does a really good job to to support you. and yeah, as I said before, it was built so that you don't really need BitVault if if we don't exist anymore. So yeah, it's been.
Yeah. Well, listen, thank you very much for your time, Lo. We we really appreciate it and we know you've been been being at the conference last year and hopefully we'll see you again sometime soon.
Yes, I hope you have the conference next year. I'll definitely come. I wanted to come this year. it's a shame. but I think we'll meet.
It's a building. year.
We we'll be back.
Building awesome. But you're having an event anyways. I saw that like in industry days. I think that's going to be cool anyway.
Yeah. Well, we that one's been shelved at the moment as well, but yeah, we'll have one in the near future. There's no doubt about that. Okay, Lo, thank you very much. Thanks, gentlemen. Thanks for your time. Bye.
Bye.
