Securing Crypto

For crypto to be able to transition into the 'real world' it's speed and power at processing transactions will need to be met by equally powerful checks on senders and receivers of funds.

June 24, 2024

Cryptocurrency was born from a cypherpunk ideology of decentralisation, privacy, and permissionless access. It offers a world where individuals can be their own bank, transacting freely without intermediaries. Yet, this revolutionary promise exists in a direct and escalating conflict with the foundational principles of the global financial system—a system built on identity, verification, and oversight to protect against crime and ensure stability. As crypto integrates with the mainstream, this clash of architectures is creating profound challenges for users, regulators, and authorities at every touchpoint.

The most visible battleground is the centralised exchange (CEX). For most people, platforms like Coinbase or Binance are the primary on-ramps into the crypto ecosystem. Under immense pressure from global regulators, these entities have become reluctant gatekeepers, forced to implement the stringent Know Your Customer (KYC) and Know Your Business (KYB) checks standard in traditional finance. Users must submit passports and proof of address, directly contradicting the ideal of a pseudonymous system. For regulators, this is a vital chokepoint for applying Anti-Money Laundering (AML) rules and establishing a basic audit trail. For crypto purists, however, it represents a necessary but compromised betrayal of the core ethos.

This regulated gateway, however, opens into a vast and untamed frontier: Decentralised Finance (DeFi). Here, the conflict intensifies dramatically. DeFi protocols—be they exchanges, lending platforms, or investment pools—are designed to operate autonomously via smart contracts, with no central operator. This raises a critical regulatory question: who is the "obliged entity"? When there is no intermediary to serve a notice to or hold accountable for compliance, how can KYC or AML checks be enforced? A user can connect a self-custodial wallet, containing assets moved from a CEX, and interact with these protocols pseudonymously. The transaction is public on the blockchain, but the real-world identity behind the wallet address remains intentionally obscured.

This leads to the self-custody dilemma. The ability to hold one’s own assets in a personal wallet is the ultimate expression of financial sovereignty. It is also where the audit trail for tax and law enforcement authorities can go cold. Global standards, such as the Financial Action Task Force's (FATF) "Travel Rule," require financial institutions to pass on verifiable information about the sender and receiver of funds. But how does that apply when a transaction is sent from a regulated exchange to a private, un-hosted wallet? The receiving party's identity is unknown, breaking the chain of information and creating a significant blind spot for monitoring the flow of illicit funds.

Furthermore, the very structure of these new systems presents unprecedented challenges. How does a tax authority audit the complex, multi-step transactions within a DeFi lending protocol? How does a regulator enforce rules on a Decentralised Autonomous Organisation (DAO)—a collective entity governed by anonymous token holders scattered across the globe, with no physical address or board of directors? These structures were not designed to interface with a legal and regulatory system built on clearly defined, centralised actors.

This friction is deliberately amplified by privacy-enhancing technologies. Tools like cryptocurrency mixers are explicitly designed to sever the link between a user's identity and their funds by pooling and mixing transactions, making the source and destination of assets nearly impossible to trace. Privacy coins take this a step further, building obfuscation into their very foundation. While proponents argue these tools are essential for legitimate privacy in a transparent digital world, they present a direct and potent challenge to authorities seeking to combat money laundering, terrorist financing, and tax evasion.

The result is a fundamental impasse. It is not simply a matter of an "unregulated" industry waiting for rules. Instead, it is a deep architectural conflict between a system designed for sovereign, pseudonymous transactions and a global regulatory framework that demands identity, accountability, and traceability as its cornerstones. Navigating this divide is the central challenge defining the future of finance.

Working with the XRP Ledger Foundation

Against this backdrop we started working with the XRP Ledger Foundation who kindly gave us a grant to explore how integrating Self technologies with the XRP Ledger might bring about benefits for users. The video embedded here shows a prototype of that work, with biometrically gated transactions, Verifiable Credentials and user messaging out of band of the transactions. We also worked with the XRPL Accelerator to extend the scope of this research to cover both their decentralised exchange (DEX) and other currencies including the proposed XRP stable coin.

UPDATE: May 2025

This work will emerge as a standalone non-custodial wallet solution in the coming months with an enterprise wallet to follow. We're really excited to see it come to life.

Identity is not a product
The increasing trend among governmental and corporate entities to conceptualise and manage human identity as a product is fundamentally flawed. The approach is not only morally problematic, but also technically unsound.
Exploring Call Fraud
Since Telephone operators were replaced by dial phones, call fraud has been a problem, today it is a huge global industry. We explore how and why this problem remains so difficult to eradicate.
Your security problem is an identity problem
It’s only going to get more difficult for organisations to protect themselves, their customers and their data as the technology the hackers use gets better. In many cases organisations simply aren’t ready for today's challenges, let alone those which are coming