The Pomp Podcast - #1181 Michael Shaulov | The Man Protecting Bitcoin Self-Custody

Episode Date: April 2, 2023

Michael Shaulov is the CEO of Fireblocks. In this conversation, we talk about counterparty risk, current banking crisis, self-custody wallets, and what Fireblocks has built to help people in the bitcoin and crypto world keep their assets safe. ======================= Pomp writes a daily letter to over 200,000+ investors about business, technology, and finance. He breaks down complex topics into easy-to-understand language while sharing opinions on various aspects of each industry. You can subscribe at https://pomp.substack.com/

What's up everyone? This is Anthony Pompliano. Many of you know me as Pomp. You're listening to the Pomp Podcast, which is my effort to find the most interesting people in the world and sit with them for hours while I ask questions in an effort to learn. We have no advertisers on this podcast, so it would mean the world to me if you would subscribe to the show on your favorite audio platform, watch episodes on YouTube, and tell your friends and family about the podcast. My goal is to help millions learn from the world's most interesting people. So let's get into today's episode. Michael Shalov is the CEO of Fireblocks.

They are the leader in digital assets and cryptocurrency custody transfer and issuance technology. In this conversation, we talk about counterparty risk, the current banking crisis, self-custody wallets, and what Fireblocks has built to help people in the Bitcoin and crypto world keep their assets safe. I really enjoyed this conversation with Michael, and I hope you guys enjoy it as well. Here is my conversation with Michael Shalom. center.com slash Spotify. Great news. The federal EV rebate is back. Eligible customers get up to $5,000 with the federal EVAP rebate on select 2027 Bolt and 2026 Equinox EV models. Visit your local Chevrolet dealer today for more details. Anthony Pompliano runs Pomp Investments. All

views of him and the guests on his podcast are solely their opinions and do not reflect the opinions of Pomp Investments. You should not treat any opinion expressed by Pomp or his guests as a specific inducement to make a particular investment or follow a particular strategy, but only as an expression of his personal opinion. This podcast is for informational purposes only. What's going on, guys? Bang, bang. Got Michael here with me. I thought a great place to start is the current banking crisis. And obviously, there is this kind of fiat world. There is a Bitcoin and crypto world. But in the fiat world, most people don't think about crisis where they store their deposits. They don't think about counterparty risk. They don't think about what

is the bank doing with my money once I give it to them. But now all of that has risen up to the surface. And now that is a topic of conversation. How do you evaluate what's happening with all of those banks and some of the problems they're running into? Yeah. So I mean, I think we are definitely in a very uncharted territory with some of those banks. And honestly, I'm not an expert in the kind of in traditional Finance but I think you know even ourselves we have this uh uh exposure to svb that luckily we managed as a as a company we moved actually the assets from svb the beginning of February so we sort of like you know dodged that entire fiasco but when you think about what actually happened over there and how it plays into the narrative of crypto the first

is really what is the counterparty risk and what is the transparency that you have in the traditional financial system and i think that what you said is sort of on point that when you put your money in the bank right and you're seeing it in the checking account i think most of the people most of the population thinks that the money is over there right that's you basically log in into your bank account and if you deposited one thousand dollars they show you that you have one thousand dollars and people actually think that there is one thousand dollars in in that account they don't actually know that in order for the bank to have his business model he's a lender and as long as it is both in checking and saving account right there they're basically taking this money and they

lending it or they putting it to work right and then you are essentially exposed to their investment uh philosophy you're exposed to their investment risk and um as we've seen you know with svb and a few of those other folks that um you you know now it's basically depends on their competence you know the first thing and the second is actually also depends on some some you know what effect what the federal regulators and what are the central banks are actually doing with the the economy. When we look at that kind of traditional financial system, it is a custodial system, right? You're giving your funds to that bank. They're obviously doing everything that has kind of now been unpacked and explained to the average consumer. Is there a world where in

a fiat system, we could have a non-custodial type engagement where, yes, you could have physical cash and put it under your mattress, but like, are there ways that you could actually interact with some sort of financial service and have it be done in a non-custodial way? It can exist, but it will require us to move into a system where the cash is represented on a blockchain, right? That we will actually have a natively issued central bank digital currency. And whether it's a wholesale or retail and potentially by virtue of wrapping, even if it's a wholesale. see so for the folks that are not familiar with the terminology central bank digital currency is effectively a situation that in which the central banks instead of uh issuing um kind of those you

know dollar dollar accounts that are either in the form of cash or in the form of uh um you know digital deposits that they would uh that they provide to the different banks it's it's basically issued on a on a blockchain uh whether it's public or permission but it's actually issued already on the blockchain and this is the only place in which it is being represented and the wholesale central cbdc is a situation that basically only the banks have access to that rail so very similar to what is happening right now in in the traditional fiat economy that you know you have bank of america and jp morgan and you know all those banks they are the only one that have access to the fed and they're the only one that will have access to cbdc and retail cbdc is actually something which is

more similar to what we're seeing in in china where it looks a bit like what we are familiar with usdc and with the stable coins that you can actually have the currency in your wallet right so it basically propagates to the end consumer and there is a debate you know in um it's actually like you know very philosophical debate on whether western western countries like the united states and europe uh which model is the the right model because you know you have you are exposed to privacy and other uh questions that uh probably people didn't care that much when they are interacting uh in a country like china with this and then if it's actually just basically stops at the bank level then the banks can use a natively issued stable coin like usdc or paxos or and so on

to basically propagate that mechanism to the end customer this is broadly stating that the model and clearly if we are moving into that kind of system then you can have non-custodial exposure to fiat right in a way that doesn't require you to basically you know go to the atm withdraw the cash and put it under the mattress right you can effectively have that cash truly represented on a digital ledger on a blockchain in the account and then if you own the king you own the key and no one else can basically manipulate the assets and the fear that is in your account. As we look at this kind of custodial risk or this counterparty risk, obviously, this has been a topic of discussion also in the crypto world as well. We've seen a

number of custodial centralized services that have succumbed to bad trading, potential fraud, and a whole host of other issues. How do you look at the potential superiority of kind of this new financial system over the old financial system? Or is it actually something where there are parallel systems and the same risks actually exist in each of them. And so a user, whether you're in the traditional financial world or this new one needs to underwrite the risk in either scenario. How do you think about that? So in the traditional world, especially when you talk about real, like big money, or you're talking about assets that are not specifically fiat that can be represented in the form of a dollar bill, you don't have an option

to go non-custodial okay you have to be custodial right whether you are you know if you want to have no one will i think you know unless you are uh you know running some kind of illicit activity and you're not going to have millions of dollars sitting in cash uh in uh in your garage right so the the custodial option is probably the only option and specifically if you now want to interact with securities right so for example you want to have access to bonds or you want to have access to to to equity then it also has to be custodial because eventually the certificate that this government bond belongs to you sits in dtcc which is the depository trust company it points into the custodial bank say jp morgan bank of new york state street points to and eventually

it points to some brokerage accounts that belongs to you right so it has to be that custodial relationship um you're not going to go to the cn basically pick a like a you know a paper certificate and you know take it home when we when we think about crypto in crypto you sort of see both models right so when we talk about mostly decentralized exchanges or decentralized centralized lenders whether it's a you know uh Coinbase FTX I'm not putting them like in the same bucket of course you know one of them is a very legitimate and well-run business and the other one that we know what happened right and we're talking about block fire Celsius and some of those players they're clearly running we're running out of the custodial out of a custodial

framework but you also see quite a lot of activity that is a non-custodial right so we have the ydx we have a compound we have ave right and those are completely non-custodial offering right so i think that what is actually proven is that in the crypto kind of in the crypto rails you can choose between those two models right and you know one of them like the DeFi protocols and the fully non-custodial it has still some technology risks that some people are and some friction right in terms of this in terms of on-ramping and interaction that some people are trying to avoid vis-a-vis the custodial uh the custodial relationship with uh with um folks like Coinbase or, you know, the ones that I mentioned earlier, and then you effectively taking a very

similar risk to the risk that you were taking in traditional finance. So maybe the example that I always like to show recently is that if you look at like, you know, the inception, right, of actually what triggered the bank run on Celsius, it is a very similar situation to what happened with SVB, right? Because basically the way that the bank run on Celsius started was that someone figured out that they have ETH locked in ST, in staked ETH deposits on one of the DeFi protocols

or one of the DeFi pools, and they figure out that they have a mismatch between their obligations to their retail clients that they promised them that they can withdraw that ETH instantaneously whenever they want vis-a-vis the fact that actually that ETH was already locked into STETH and there was not enough liquidity to basically convert it back to ETH to issue the withdrawals.

Very similar to, by the way, SVB taking those deposits and putting them in a 10 year treasury bonds, right? That if you actually wanted to withdraw that cash, then they didn't have, they had maybe like enough liquidity, but they had to sell it in a really aggressive markdown, right? So it's kind of similar. Got it. And so when you think about what you all are building, right,

Fireblocks is a custodian kind of at the core, and then you guys have all this software built around it, and then you've got a number of different services that people can leverage and use on the platform. Talk a little bit as to how you've thought about building this for this new financial system, right? How do you eliminate counterparty risk, or how do you mitigate some of the risks that people have seen on other platforms?

Yeah. So the first thing that I would say is that Fireblocks is actually built, we specifically call ourselves, we don't call ourselves a custodian, we call ourselves a custody technology provider, right? And there is a reason for that nuance. The reason for that nuance is that we are not keeping 100% of the keys, right? no situation fireblocks is basically has full control or full uh or you actually take or our clients right uh specifically taking full counterparty risk to us so let's assume that

you're a hedge fund or you're an asset manager um for for for uh sake of um convenience that you when you put your assets with let's say you know a fully custodial service out there that custodial service has 100 of your of the keys they basically have full control over your assets when you are using fireblocks fireblocks basically is built with technology called mpc multi-party computation we've been um one of the leading research organizations behind that technology and honestly i think we are now probably uh the the most uh kind of the biggest player that is providing that technology but the idea around npc similar to multisig is that at least one of the key shares that control the wallet are with the client right so we can't move the funds without

the client actually initiating their key and there's one one or many keys with the the client and then we keep a few keeps keys on our end to basically put safeguards or actually run security policies to on to make sure that the client is not being defrauded or hacked or manipulated by either you know the north korean hackers or an insider who is in their organization because they can pre-configure the policies on our end so essentially you would say you know if i'm not sending it to those white listed addresses i want to make sure that there are five people in my organization that needs to approve it right and then we essentially both mitigating collusion we are mitigating a situation in which you know you have people that are hacked and then the hackers are trying to

basically activating activate withdrawals on their behalf so this is what we provide kind of in a very high level from a technology standpoint can you talk a little bit about um kind of the state of security around this stuff and and uh mpc and some of the like more nuanced components because i think what's really important is i personally when i talk to people about this i separate out like what is almost like the marketing message from the actual underlying technical capabilities and the reason why i think that's important is uh a lot of people when they first are like hey what is this asset? How do I hold it? They need the marketing message, right? They need to understand things like not your keys, not your coin. They need to understand, hey, there's self

custody. It's like being your own bank, whatever all those kind of memorable lines are. But you all are very, very technically savvy in terms of like what's actually going on with things like MPC. Can you explain that a little bit more? Yeah, sure. So I'll maybe give a bit of the history right so initially the concept of well at the very beginning we had the private key right so there were only two options one of the most familiar options is basically i will store the private key on my computer or i will have a ledger nano right and that will store the entire private key right that had a bunch of issues you know one issue is that if you start on your computer and your computer is hacked and you have a malware it will steal your private key and the the hackers

will run away with all your money and if you had a ledger nano which is like a very secure device the problem with it that it was offline the problem with that was that it's a single device so how do you work in an institutional environment where you need multiple people to approve all those things were basically unsolved then in 2012 or so we came out with multisig which was a specific protocol for for bitcoin that allowed us to kind of have multiple keys that can control an address right and that actually solved the issue of a single point of failure right the main challenge was multisig was uh there were actually two two challenges with multisig the first one is that it was protocol specific so multisig worked one way on bitcoin it worked in a different way uh on on

ethereum it worked but completely different way of solana right so it was very difficult to create a unified structure or unified environment that will that you have basically like one protocol to rule all the different blockchain that was issue number one and the second issue was related to the fact that it was expensive right expensive from fees standpoint because all this logic is essentially deployed on chain and you need to pay the bit you know you're in order for you to operate the kind of a single key address on bitcoin it will be cheap but if you wanted to operate an address that has 10 key holders the transaction was actually expensive because of the the fees npc solves those two problems and the way that it works it basically kind of

takes this problem one a step below and and focuses on actually the encryption algorithm And across the entire blockchains that we currently have, you know, whether it's Bitcoin, Ethereum, Solana, Stellar, whatever it is, we have only two encryption algorithms. One is called ECDSA, the other one is called EDDSA. But, you know, for the sake of simplicity, they are basically just two algorithms. And MPC is working on those algorithms, which means that as long as you have only two implementations, you can cover all the different blockchains. And what it does, it basically creates this distributed key, right, that every one of the participants, and the participants can be humans, those can be servers, can be mobile devices, but I can essentially create a distributed key that never comes together. It never comes into one single location, but through this distributed keys and a distributed computation that is built on zero knowledge proofs, you can basically compute a transaction.

So as long as a quorum of, let's say, three out of five of those devices agree, they can compute a transaction, but they never put a private key together. So you eliminate the issue of a hacker coming in and stealing all those funds from a single location and you eliminate collusion because there is not a single employee there is not a single person that has access to the entire private key without requiring the participation of others what types of organizations use this is this like for family offices are there corporations doing this and part of the reason i ask this is uh many people will look at security measures whether it's physical security cyber security whatever and as an individual they're like eh

i don't need that right i'm just an individual who would really want to take my stuff in the crypto world, they're bear assets. And so the kind of risk-reward calculation changes a little bit. But are there very, very large corporations or is this for more investors? Who's kind of the user base that you guys are seeing success with? So honestly, we see success across the board. Let's start from actually even the retail. On the retail side, Fireblocks is not yet involved over there. We're working on some solution to help there as well but you have great companies like zango and you have the coinbase wallet that they're actually using this technology for consumers so you know pure you know any consumer

can use this technology right now it will provide them protection then when we basically move to the institutional or enterprise or the business side i would say it's actually like you know the full spectrum of of users are currently using mpc and not multisig there we whether it's two guys and a dog in a in a garage that are running uh two ladies in the dog in the garage that are basically running a small prop hedge fund that that that is trading crypto if we're looking at big fintech companies and exchanges like revolut and others if we're looking at um at the bigger banks bank of new york mail on um amz bank now all those banks are also using this solution so asset managers big and small are using this those solutions so it became i would say that the

standard when we started in 2018 people were kind of skeptical about it because it was a very advanced technology that and not many people fully understood how it was working and the multi-sig was quite an understood technology back in the days but what happened over the last five years is that this technology almost propagated to everywhere and almost every custodian and and every provider is currently using this underlying technology got it when When you see this technology that you've built, one of the other things that you guys are doing is you're basically wrapping it with developer tools. So I know that you guys just launched a whole suite of developer tools. Talk a little bit as to how you can focus on the security, but then also add in kind of these developer tools that basically are trying to democratize access to the security.

Yeah. So I think that what was happening over the last couple of years that we started to see a shift from people using crypto mainly for speculation, right, or for trading purposes. And the client base was mostly gravitating through, you know, around hedge funds, over-the-counter desk, proprietary trading firms and so on. And in the last 18 months or so, we are seeing many more developers that are trying to build almost like real world applications, right? Whether those are NFT marketplaces, whether those, we have actually a pretty cool company that is using us that what they do, they are replacing airline tickets with NFT based tickets, right? so if you if you don't want they call travel so if you if you don't want to take the flight you can basically transfer the nft to someone else and they can board the flight um so you're starting to see and i think like there are a lot of applications in the marketing domain that we are seeing with you know starbucks and nike and so on and the museums and other use cases so all those

in all those use cases we basically see developers large and small right some of those developers they're already working for established brands or established companies and some of those developers are just basically startups or people that are trying to work on a some kind of poc or mvp and what i think is like is quite critical over there is that in a very early stage they will be um developing on a secure environment right because if there is something that we should learn from what happened from um i guess like all the hacks that we've seen in crypto in 2018 2019 was that a lot of those hacks happened to the exchanges and the reason why those hacks happen is that those exchanges started very small as an idea they didn't really put a lot of emphasis on how they

developing or building things securely and then overnight they became big but still their underlying infrastructure for key management and custody was something that you know they built in-house without any controls and then it failed right and i think that now we are slightly in a similar space but or a similar situation but with developers that are building applications for for for really real world use cases and what we created for them and people can find at fireblocks.com forward slash developers it's basically a set of tools and a sandbox that the developers can open an account they can start building their application on testnet and there's also like a very attractive package for them that they can go and start working and deploying it

on mainnet and from the beginning they can use a very secure infrastructure for the key management right so basically whether they need to generate hundreds of thousands or millions of wallets for their users or whether they need to deploy smart contracts and mint nfts and and and distribute those nfts they have secure interfaces they have policies they have all the control stack that they need from day one and hopefully if they are successful and their application is successful and it becomes basically something that has a very large user base, they don't need to go and re-platform. They don't need to go and rebuild, refactor, re-engineer the entire base of their application. They can start very small and very secure without too much uplift. And then as it

grows, the base is secure and it's future-proof. What do you think the evolution of security is going to be? Is this going to be something where people will be able to use this in a very user friendly way, like literally on their phones and their desktop, it'll just kind of be second nature. I think a lot about, you know, when I use the internet, I can have a secure connection. And there's a lot of protection that's provided to me. And it's almost happening in the background versus right now when I want to secure, whether it is Bitcoin or other assets, then there's a little bit of like, I'm opting in mentally, right? I'm making sure that I'm doing it. And so it kind of just happen in the background do we eventually get there yes and i think that to

a certain degree we are almost there that was actually the philosophy of how we developed fireblocks in our solution and and i'll give you just like you know our my philosophy uh i've so yeah i spent about like two decades in cyber security uh so the vast majority of my career was actually in cybersecurity rather than in crypto or fintech and i definitely agree that most people associate cyber security and cyber security control with the you know mcafee or semantic antivirus that you have on your laptop and that it basically starts running in the worst time possible and basically your computer is stuck right so we sort of view convenience and security as two extremes on the spectrum, and they don't view it as something that can actually

live together in a very convenient way. One of the only examples of a company that was really able to do it well is Apple with iOS and the iPhone. So if you look at what Apple did, and they've done a pretty amazing job, is that when they came up with an iPhone, they actually came up with an amazing user experience but iphone one would argue is also one of the most secure devices on the planet without asking the user to like how many people you know that they have an antivirus on their iphone right they're basically very few there are actually no proper uh today like you know there aren't like you know very sophisticated antivirus software for iPhones, right? It's not that it has zero vulnerabilities, but they took a lot of very

interesting steps, both on how they build the entire hardware, how they build the entire software, and how they build the entire ecosystem through the App Store to find the sweet spot between exceptional user experience and high level of security. I think that there is a huge opportunity to mimic the same approach with crypto and blockchain and the main reason is that the underlying signal or the underlying technology for for blockchain is already built on security right basically it's all cryptographically secure there are if you look at bitcoin ethereum as a blockchain network right it was never hacked although it is the biggest it is the biggest honeypot on the internet so the solutions that are built on top of it whether those are the

custody solutions the wallets the way that we interact in in peer-to-peer transactions there is a huge opportunity to make it very seamless and that people won't need to think about hey like did i back up the key i didn't back up the key so and i think it's the the job of all the people that are working on those solutions, including ourselves. Talk to me about the bear market. As you've gone through this bear market over the last, let's call it, 18-ish months, maybe 15 months, whatever it's been now, are you seeing more of a drive to the custody products?

And what we have seen is people pulling assets off exchanges. I'm assuming that they're going more into kind of self-custody and non-custodial products. But are you guys actually seeing that in the kind of customer flows? Yeah, so the week after FTX collapsed, we've seen something like $10 billion inflows, right, from people pulling assets from exchanges into the direct custody infrastructure. And we're also working very hard right now to create solutions where, at least for institutions, they can still basically allocate and trade and take positions on exchanges but they don't need to take the full counterparty risk and refund on the exchange so

there's definitely a lot of push towards that as well and i i can also say that when you talk with a lot of the consumer-based wallets uh people like zango and ledger and so on they also like the the months after ftx has been the best months that they ever had in terms of product adoption and new users so yeah overall i think that uh there is a definitely like you know a larger appetite and there is a full recognition of uh counterparty risk and you know quality systems and uh and you know both figuring out that you don't expose yourself to mismanagement of your assets by a third party and also that the technology under the hood is safe and secure and people are asking way more in terms of what are the certificates what are the certifications

that you have what are the governance and controls that you have in terms of developing the solution you know for example we worked really hard to achieve something and it's called ccss level three which is we are currently the only one that are holding that certification which is a dedicated certification for cryptocurrency uh wallets so people sort of like you know looking into into all those aspects i will also say that uh people talk a lot about the fact that it's a bear market right now and probably it's true given the activity volatility price point but as a company we went through the 2018 bear market and i think it's very different now as we watch this all continue to play out regulation is a big piece of it do you think that self-hosted wallets

uh you know non-custodial wallets whatever you want to kind of use the nomenclature do you think that those could potentially come under even more scrutiny or possibly in the extreme example be banned in the united states it's it's a amazing question um and i think that the pendulum is sort of like you know continuously swinging between uh both sides of that spectrum i think it so uh i actually got appointed a few weeks ago to be on the technology advisory committee of the cftc and we had a session over there earlier this week and then at the the the self-hosted wallets was one of the topics i think that the sensible part or the sensible regulate regulators and also the sensible legislators congress people and so on they

view self-hosted wallets as a mandatory part of the ecosystem so it's hard to see how those can be absolutely banned and it's hard to basically under underwrite the narrative of why they should be banned there there is a confusion on the regulatory side that somehow assumes that if you introduce self-hosted wallets or unhosted wallets you undermine specifically a anti-money laundering and the ability to basically trace down illicit activity that's actually was proven to be not true right you can because the blockchain is somewhat transparent and and track and transactions are trackable it's true that it's harder to freeze those assets in some cases especially when we talk about the kind of native assets like bitcoin ethereum but

it's probably more interesting if the regulators will kind of switch the the the the kind of the view on this and we'll say okay you know most of we believe that the future activity is actually going to be in let's go tokenize assets broadly but you know whether those are nfts or stablecoin or you know tokenized securities or whatever right and then you can actually build a very interesting compliance logic into the asset itself into the smart contract and then it's actually agnostic to whatever it moves in hosted ones and or unhosted ones but i think it will be very very difficult for their regulators to bet on hosted wallets especially given the narrative that we have right now that counterparty risk is important um fully custodial services they have their own

vulnerabilities and people should have the option what are you most excited about internally so i'm super excited about us uh kind of seeing a lot of the newer use case coming to the fruition that we've been working on with you know partners and i think that our investment in working with payment service providers banks merchants and so on on the utilization of stable coin for transforming uh transforming f the core financial rails and probably like you know the simplest property of payments between people is starting to pan out and i think in the next 12 and 18 months we'll see a pretty significant explosion on on that as being one of the killer use cases especially as it comes to cross-border transfers micropayments creator economies and so

on so i'm very excited about that i'm excited excited about the use cases around the broadly speaking web3 that are sort of when you go into the non-financial markets like you know gaming companies brands that are using it for for loyalty points that we're putting a lot of investments over there and last but not least this is a bit of a longer i think uh horizon but some of the works that we have around really the core capital markets um it's slower in the us but especially in europe and more so in apac and africa where you see governments really thinking about uh crypto you know crypto rails as the rails for for for the future of uh capital markets i'll I'll give you a quick example over there.

We're working on a project with the Tel Aviv Stock Exchange. So the Israeli government is currently working on issuing their treasury bonds on a blockchain, right? So those are kind of very futuristic projects, but we're starting to see those things panning out. As we look kind of moving forward, if people want to find out more about the business, if they want to come potentially work with you guys, if they want to become users, where can we send them to find more about Fireblocks? Our website, so fireblocks.com. That's probably the place where they can start

in terms of exploring what we do and getting in touch with us. And then are there any types of roles that you guys are actively trying to fill right now or any types of people that you're looking for? Yeah, we're mostly currently focusing on the, say, both customer services roles and we are also focusing on some of the,

basically, R&D areas. uh where we are hiring and then where can we find you on the internet um so on my linkedin uh michael shallow and uh you can email me at michael firebox.com awesome michael listen thank you so much for taking the time to do this obviously self-custody has become a huge huge uh topic of discussion counterparty risk both in the legacy fiat system but also uh in the crypto system still remains top of mind for many people you guys have done a great job building a technology that obviously a lot of people find valuable and continue to use today so congrats on all the success and we'll definitely do this again in the future as

you continue to build out further thank you so much