The Pomp Podcast - #700 Self Custody DIscussion w/ Adam Lowe

Episode Date: October 24, 2021

Adam Lowe is the Chief Innovation Officer at Composecure and Arculus. In this conversation we discus Self-Custody, Securing Your Private Keys and The Arculus Product Suite.

What's up, everyone? This is Anthony Pompliano. Most of you know me as Pomp. You're listening to the Pomp Podcast, simply the best podcast out there. Now let's kick this thing off. Adam Lowe is the Chief Innovation Officer at CompoSecure and Arculus. I really enjoyed this conversation with Adam. In it, we talk all about securing your private keys, how to do self-custody, and also Arculus and the product they've built. I really hope that you enjoyed this conversation as much as I did. Let's get into the episode and learn all about self-custody. Anthony Pompliano runs Pomp Investments. All views of him and the guests on his podcast are solely their opinions and do not reflect the opinions of Pomp Investments.

You should not treat any opinion expressed by Pomp or his guests as a specific inducement to make a particular investment or follow a particular strategy, but only as an expression of his personal opinion. This podcast is for informational purposes only. All right, guys. Bang, bang. I've got Adam here with me. Thank you so much for taking the time to do this. Great. Great to be here. Absolutely. Let's just jump into this user journey. Everyone comes into the Bitcoin and crypto industry. They say, hey, that looks awesome. I want to allocate some capital to that space. It may be because they're running from inflation. It may be because they think that this is part of their portfolio construction, or it simply could just

be like, hey, I think I'm going to make money, right? And I'm a capitalist and I want to just have the number go up, if you will. But as they start that user journey, it usually starts with exchanges or some sort of like publicly traded vehicle. And then as the value grows, they move towards a hardware wallet. So walk us through kind of how that journey normally happens in your experience. Sure. I think everybody gets excited and almost everyone purchases Bitcoin through a centralized exchange as their first journey, right? The term Bitcoin is actually Googled many multiples of times more than crypto itself.

So everybody generally picks their favorite centralized exchange, goes through a know your customer event, KYC event, and then purchases Bitcoin. I do want to pause there. And if that's where you stop, the most important thing you can do is turn on multi-factor authentication because if you have poor password hygiene, or even if your password hygiene is good,

hackers are really creative and they can get in your account. So I would really encourage you, if you stop there, turn on multi-factor identification. So from there, I think people kind of branch out. They buy different currencies. They get interested in NFTs. They get interested in tokens of currencies. And that's where on a centralized exchange, you can sometimes get a little limited. You have limited staking options, right, where you're effectively earning interest. You have limited DeFi options where you can also earn yield. It's really interesting. So from there, people start gravitating towards hardware wallets where they own their own keys. So I think it's really important to understand that when you're on a

centralized exchange, you do not own the private keys to your crypto. So we like to say your key is your crypto. In this case of a centralized exchange, they hold the keys. They are literally the custodian of your crypto and the custodian of your keys. So in that scenario, you are trusting them with your crypto. And as we've seen from various news articles, if they think that your account gets drained and it's your fault due to passwords or other things, they will not reimburse your crypto. And so once somebody decides that that's not the solution for them, what do they do next in terms of, I'm not going to leave it on an exchange, what do I do? Sure. So there's a out there. There's kind of warm wallets where it's software on your phone or on your computer

where you do hold your own keys, but then your keys are stored on your phone. Your private keys are stored on your phone or on the computer or in the cloud. And those can be vulnerable. So most people that are very security conscious opt for a hardware wallet, cold storage wallet, which is what Arculus is. Examples of those are where you maintain your own keys. They live on this hardware device and they're never exposed and they're never in the clear. So because you own your own keys, it's basically impossible to hack your crypto, which is really important. And because you do own your own keys, it gives you opportunities to enter into the DeFi space and the staking space and some of the more advanced things people do with their crypto once they start amassing it.

So when you think about owning your own private keys, obviously there's a couple of different reasons for that, but how do you describe to people like what is the importance or why should you own those private keys? Yeah. I mean, the fundamental reason to own your own private keys in my mind is to control your own destiny and to really empower yourself to do whatever you want to do with your crypto. If you own your own keys, you literally have to affirmatively decide to do something with your crypto every time you want to do it. Nobody's going to lend your crypto out and not tell you, nobody's going to flip your crypto and not tell you, and nobody's going to access your crypto without you knowing. So by owning your own keys, you can literally make every decision

associated with your currencies. And I think fundamentally, that's an important choice for many people who get into crypto. They like this independence, they like the empowerment. And to your earlier point, they like the hedge against inflation. So for all of those reasons, I like controlling my own destiny and my own security. Yeah. I tend to think that that's a pretty good way to approach life, both in Bitcoin and crypto and also not. But talk to me about Arculus in terms of what is different about the offering that you all have versus maybe other hardware wallets or private key management systems? Sure. So when we looked at the market, we felt that there was a lot of friction around current hardware wallets. So if you ever see them,

they're basically USB sticks with a tiny screen and tiny buttons. They're kind of hard to navigate. They're hard to use. And it takes a very long time to confirm a transaction, send a transaction, anything. And the average user honestly can't use them. So we wanted to solve that problem. So Arculus's parent, Compose Secure, has a 20 year history in banking and fintech. And we use that knowledge and experience to create Arculus. So Arculus uses three factors of authentication to keep your crypto safe. uses the beautiful card behind me to store your private keys on a best in class secure element. It uses biometric as a second factor and it uses pin as a third. So importantly, we like to say

it's something you have, something you know, and something you are. And those three things together keep your crypto safe. So in that situation, I think a lot of people say, oh, that's amazing. I have the physical card, I have a biometric, then I have the pin. What happens if I forget the pin or I lose the card? How does it work? Sure. So for people who have used an independent wallet before where you maintain your own keys, you get a recovery phrase. So during the setup of your Arculus wallet or any other wallets out there, you're given 12 words that represent your private key in plain English. You should keep those in a vault or a safe, and that's your recovery means. So if you lose your Arculus card, you break your Arculus card, scrape an ice off a

window, whatever with it, then you can get a new Arculus card, enter in your 12 words, and you're back in business. What's just as important is if you lose your Arculus card on the street, no one else has access to your crypto. They don't have your pin. They don't have your biometric. Your crypto is safe. Yeah. And I guess part of this is you want to create a system that keeps other people out, but also doesn't prevent people just from daily life, right? If you lose the card or forget the pin. I've got plenty of accounts that I've forgotten passwords to over time, et cetera. And there's always a way to get it back, but it just may be difficult or hard for somebody externally to do. Talk to me a little bit about some of the

common misconceptions around private key management, things that maybe folks have heard before, but aren't necessarily true. Sure. So I think everybody's heard the story of, oh, I heard that guy had that thing and he only got 10 attempts and then it got locked out and he lost 50 million or 60 million, everybody makes up the number of Bitcoin. So that is kind of from the olden days, you know, the Satoshi era of Bitcoin, as it's called. So there are very old widgets that people lock themselves out of. That was before you had recovery seed phrases that were engineered by the community. So you can't really lock yourself out of your crypto anymore when you have a hardware device. Really, the only thing that could happen would be is if you would lose everything. I lost

phone i lost my card i lost my recovery seed well that's that's a problem uh but you know the the weird stories i hear are oh owning my own keys or managing my own keys are going to be hard no it's not it's actually really simple you know we put the great user interface on the app that's free that allows you to manage your crypto and then all security stays on the passive card where it needs to be so i think the biggest misnomer is it's hard um i actually think the user experience is easier than when you're on a major exchange tabbing out going to google authenticator memorizing such digits getting back in before the timer runs out i think our user experience is better than that one of the other misconceptions i've heard people say before is oh i'm going to

use this um key management system or this hardware device how do i know that the company doesn't have access or how do i come up with the trust that i have to put into the business versus the actual kind of my capabilities that people? Sure. So I think trust comes at two levels. The first is, who are you dealing with? So as I mentioned, Arculus is parented by Compost Secure, who manages and makes financial cards for the largest banks in the world. So we think that brings a significant amount of credibility to start. You know, we've managed keys for the largest banks in the world, and they trust us to do so. The other important thing on our hardware wallet is we never have access to any of your keys so the card essentially comes in a ready state and then

when it gets to the user you say create my wallet the card creates your keys and gives you your backup phrase so we never have any knowledge of your keys and therefore to never have any knowledge of your crypto you don't even create an account with arculus so you fire up the app you create your wallet and you get going so the we purposely create this privacy and division so that we have absolutely no knowledge of what's going on with your account. Yeah. The key to that is basically people don't have to trust you not to be evil in the terms of Google a little bit, right? But more so just if you never have access, they don't have to worry about it. What are some of the big mistakes that people make in terms of managing their own keys?

I could imagine one being they don't write down the seed phrase, which would be a huge problem. Are there other big ones? I think the other big one is, and to be fair, we try to prevent that. So we actually make you confirm your 12 words before you go on. So you can't just say, yeah, yeah, yeah, okay, whatever, and then move on and never see them again. So we do prevent that problem. I think the other problem I've seen is when people get excited, I've seen people have two, three, four wallets and they forget which phrase is associated with which wallet and

can kind of get that mixed up. But I think we've set up the system to make it easy enough where it's not challenging anymore to manage your own keys. I think the other mistake some people make is forgetting what is on a centralized exchange versus on their hardware wallet. So they're trying to balance between how much is on my Coinbase, how much is on my hardware wallet, et cetera. But the nice thing is you can import into Arculus with your 12 words or you can always send crypto over the chain. And then what is the best practice or common mistakes people make around the seed phrase itself? Do they write it down on a piece of paper that they lose?

do you know like what are those mistakes and then kind of i guess what is like the best practice from a seed phrase um kind of preservation if you will sure so i think there's two important best practices but one is i always keep my seed phrases on something analog that doesn't sound sexy but writing it down in ink that's not going to fade on acid-free paper that you know cannot be accessed electronically anywhere and then store it in a safe vault i think is a best practice in, I put mine in a, in a fireproof bag that goes inside a vault. So, you know, what's really nuanced there is everybody wants to store their seed phrase digitally, but you know, if it's in the cloud, it's accessible. If this analog piece of paper is in your vault, it's not. So it doesn't

sound as fun or sexy, but I actually think it's a much better practice to keep your seed phrase analog, safe, and completely separate. The second is making sure a loved one that you trust has access to it in case something happens to you um the kind of second largest problem is that you know things happen in life and and we're no longer around and our loved ones need to access our crypto so making sure your loved ones understand it enough to use it know where it is you put it with an attorney with your will if it's a really large amount of crypto um really significant and i think you know that's the the second largest problem i've seen is a loved one a wife whatever gets this piece of paper and has no conception of what those 12 words mean.

And when you think about the seed phrase, is it something where you should write it down on just one piece of paper and keep it kind of analog? Or should people actually create multiple versions of this and kind of keep it in different places, put it in a bank safety deposit box or whatever? How do you think about that versus, no, if you write it down too many places and put it too many places, actually, it could be a bad thing. Sure. So as your crypto wealth rises, you should think about additional security. So for people with substantive amounts of crypto, you can, I still keep them analog, but you can put them in, you know, attorney gets four of the 12, safe B gets another four of the 12 and safe C gets another third of the 12. So that is another way to increase your security because you're not going to be able to access the crypto without all 12 words.

Got it. And then when you think about best practices, how do you think about actually designing it in a way that, you know, if I'm with somebody new to managing my private keys, how do I set this up? Is it put 10% of whatever I own, if it's a material amount on a kind of a hardware device and then have 10 of those, should I have two of them? Is there something around the ability to actually manage various kind of seed phrases across various devices? Like how do you just think about, okay, here's how I would design it if I was thinking about security, regardless of what material percentage would be for somebody sure so if i had a substantive amount of crypto and i was thinking about how i wanted to manage my portfolio i would take um i don't want to i don't

want to put down how much someone wants to trade or not i would i would keep the amount i want to actively trade on a centralized exchange right and they even have some vault functions that have gotten better that a lot they keep your actively traded crypto a bit safer so i would start there so i would i would know how much of my total portfolio i want to actively trade on a daily or weekly basis. And I would keep that there. The balance of that, I would move to one or more hardware wallets. I would argue for more. So we have a few people that have substantive amount of crypto and the way they kept it clean was I have a lot of Bitcoin. I have a lot of Ethereum and I have a lot of XRP. So they bought their Bitcoin hardware wallet, put it in place A,

Ethereum, put it in place B, XRP, put it in place C. And that way mentally they could just keep it nice and clean as to how they divvied up their assets. Got it. And then when you think about the ability to go from buying something on an exchange to the hardware wallet, and then at some point, if somebody wants to sell something and buy a house, or they want to use the assets, how do you think about the best practices or design from being able to transfer from the exchanges to the hardware wallet and then hardware wallet back to an exchange if that's what they desire to do? Sure. So there's a couple of different ways to do that. The biggest thing that users need to look at is fees. Most crypto is pretty fee efficient and I would just send it

over the chain. It's the easiest and most straightforward way. Ethereum has not been so fee efficient, especially if you're holding tokens lately. People should understand how expensive it is and our app clearly displays it before you send a token, but there are horror stories of people sending ERC20s lately and spending more in Ethereum than the tokens themselves were worth. So that's an important point that someone should look at. that said i think the easiest way is just simply send it over the chain it'll arrive there and you can sell it one thing i would encourage users to do is to understand the fee structure of the exchanges some are more fee efficient than others as well as the option to go to a stable coin

sometimes it's much more expensive to go into actual dollars where you could go into usdc or other dollar-backed stable coins and you could actually spend that and buy house with it just is the same. You went for a dollar, but it may be much more fee efficient due to the way the exchange is structured. And when you think about the management side, you already talked a little bit about making sure a loved one has the kind of access to seed phrase, can access the assets. Do you guys think at all about like wills or any sort of documentation or anything that people should put in place around security as well? Even up to should they put the seed phrase in the document? Just how do you think about that? Sure. I would not put the seed phrase in the

document because you never know where the asset's going to end up. Like you may move it to another wallet and that's antiquated and nobody likes updating their will, right? Everybody puts that off. So I would associate part or all of my 12 word seed phrase with the attorney and with the state of the will, depending on security levels. But I wouldn't actually write it into the will because it may change over time. The most important, not most important, one of the most important things to do is specify who gets it, right? It's an asset, just the same as cash, just the same it is as a house. And, you know, you don't want to nicely divvy up cash and house and somebody arguing over your Bitcoin and HBAR. When you start to think about the peer-to-peer

nature of the asset, it feels like this is only going to become more pervasive, right? Money is one of the most viral products in the world. And so more people keep coming in. Is this something where all of society is going to have to become comfortable and kind of educated on managing private keys and that's going to become the standard? Or do you feel like there's almost this maybe early adopter cohort or tech forward cohort that's going to be really the ones trying to manage their private keys, but in the kind of future world, you don't see everyone actually doing it? I feel like it's going to diverge a little bit. I think people need to get used to managing private keys, but may not need to think of it so explicitly. So I'll give you an example.

Arculus also supports the FIDO standard and can be an FIDO authenticator on our B2B side. So there you're literally managing private keys and you don't even know it. So as medical records and other parts of your daily life get locked by digital keys instead of passwords and shared secrets, which are terrible, people will may be managing private keys and not even knowing it. Specific to the crypto world, I do think you're going to see a little of a divergence where people who are interested in true DeFi really pushing the boundaries of crypto. it's going to diverge and a significant amount of the population is going to go there just because it's very fee efficient it's very peer-to-peer and really it's where you can make the most money and some percentage of the population is going to stay on the centralized exchanges feels more like a traditional bank i think the percentage and how that goes depends mostly upon

regulation and and how much fdic like products are going to end up at those centralized exchanges because at the end of the day if consumers lose a ton of money on those centralized exchanges and it's not backed up by some insurance product, then I think that's going to be a bad day. When you think about Arculus and kind of building the product, what's the biggest challenges that you all face or the things that you say, hey, look, these are our big focus right now. We got to get either over them or kind of reach these milestones in order to continue to see progress in the business. Sure. So I can talk to what consumers are asking for the most. We came out with a pretty decent list of crypto, but everybody wants their own favorite crypto. So the biggest

question we get is, when can you add crypto XYZ? And I can assure the community we are actively working on adding as many as we can. I would say the biggest challenge to that is less technical and more regulatory. So doing this in a regulatory compliant way is incredibly important to Arculus and our community. And that to me is the biggest challenge of the entire industry is what are the rules and how do I comply with them? Yeah, I think that that is especially important if you're the one who's basically saying, Hey, we will help protect your assets, right? You probably have to take a perspective on where, um, where can people go if they want to try the Arculus product? Uh, is there some place where they can go learn about it and actually purchase the product?

Sure. You can visit get Arculus.com. Uh, there's a variety of videos where you can learn about it has a great get started and you can purchase it directly there. Awesome. And then where can we send people to follow you at them either online or, uh, or anything you're putting out on Twitter or a blog, anything like that? Sure. The handle is at this is Arculus, and that's the same handle on Twitter and Instagram. Awesome. Well, listen, thank you so much for taking the time to do this. Obviously, as more and more people are coming into the industry, especially as prices are hitting all time highs, I think there's a lot of people asking questions around how should they secure their private keys? What's the best practices?

What are the common misconceptions? And then how should they design kind of security of their setup? So I appreciate taking the time to help everyone understand that today. And everyone we should go check out getarculus.com and we'll definitely have to do this again in the future. Awesome. Thank you very much.