The limits of self-custody
The limits of self-custody
Decentralization is expensive. That means it will never be common.
The cost and complexity of decentralization means the self-custodied economy will always be smaller than the trusted economy — even in a world of universal Bitcoin adoption.
Inside this issue:
There is no perfect custody solution
Maximizing security versus minimizing risk
We already prefer to outsource custody
Decentralized networks are for settlement
The importance of self-custody
There is no perfect custody solution
Discussion of Bitcoin custody frequently devolves into a debate about the ‘ideal’ security setup – but in practice no security setup is perfect. With any self custody strategy there is some risk of theft and some risk of loss. Seemingly reliable exchanges go abruptly insolvent. Extremely experienced and knowledgeable experts get hacked. There are no risk free strategies to storing Bitcoin over time.
Bitcoin lets us replace counterparty risk with first party risk but it does not allow us to avoid risk entirely. There is no perfect Bitcoin custody solution because there are no perfect Bitcoin users. Even to the extent that risk-free custody strategies exist they can only ever be imperfectly approximated by imperfect users. Rational Bitcoin investors will assign non-zero likelihood to the possibility of their own failure.
Maximizing security versus minimizing risk
Our first instinct with self-custody is to keep our entire portfolio in the safest available strategy, but we can do better. Storing all our Bitcoin in a single strategy is broadly analogous to investing our entire portfolio in a single promising asset. Since our goal when storing bitcoin is to minimize risk, it makes sense to lower our overall portfolio risk by storing our Bitcoin across several different strategies with different (i.e. uncorrelated) risks.
Diversifying like this reduces our risk in the same way that a diverse investment strategy reduces portfolio volatility — we sacrifice potential upside (some of our bitcoin is exposed to known/anticipated risks in less safe strategies) in exchange for greatly diminished downside risk (at least some of our bitcoin is always protected from unexpected risks in strategies seen as safe). For investors optimizing their custody strategy to minimize costs, minimizing downside risk makes sense.
In a simplified example model where there are only two custody/risk strategies (self custody/third party custody) and where all custody failures are assumed to be 100% portfolio loss, an investor might allocate accordingly:
Anyone who reasons about their custody risk this way will likely employ some amount of third-party custody today (even if they have a fairly negative view of the risks) just to mitigate the potential downsides of a failure of self-custody. Other considerations (ideological preference, third-party convenience, government intervention, fear of a wrench attack, etc) might shift their balance of allocations, but they probably won’t eliminate any particular custody strategy entirely.1
Most people who have dollars keep some of their dollars in bank accounts and some of their dollars in paper cash at home — Bitcoin will be the same way.
This intuition generalizes across more custody strategies, more threats and more nuanced severity/likelihood pairs. You can explore or extend a slightly more sophisticated model exploring the same idea in this spreadsheet. The conclusion is broadly similar: risk-minimizing investors will seek a blended custody strategy across a variety of diverse approaches with uncorrelated risk profiles.
Relatively few Bitcoin holders will choose to be exclusively self-sovereign.
We already prefer to outsource custody
No analogy for Bitcoin is perfect, but one salient comparison for understanding user’s relationship to self-custody is physical cash – both are trustless, decentralized bearer instruments that allow greater privacy and autonomy but also require an approach to secure custody.
Businesses face similar trust/risk tradeoffs between physical cash vs USD bank accounts and self-custodied bitcoin vs BTC denominated accounts. Most businesses are actively seeking to avoid holding physical cash, which is why banks today are able to charge (~3 bps) for commercial scale cash deposits. That’s also why businesses are often willing to offer free cash withdrawals on debit transactions — they are actively seeking to sell physical cash for USD-account value at par. Even banks prefer to minimize how much cash they have on hand — which makes sense, because holding large piles of physical cash is a risky thing to do.
Businesses that don’t have access to a reliable banking sector may be forced to rely more on physical cash, but when given the opportunity they systematically prefer to replace sovereign self-custody with trusted third-party security specialists. It is becoming increasingly common for businesses to move away from handling cash at all, paying extra fees to credit card companies and forgoing any potential cash sales to avoid self-custody entirely.
One should reasonably infer that businesses will likely have a similar approach to custody of digital cash: accepting bitcoin to facilitate transactions but actively seeking to exchange it for BTC-denominated account value with a trusted custodian as quickly as possible. Most businesses will find the costs of self-custody much higher than the costs of outsourcing custody to a security specialist.
For most businesses handling their own Bitcoin would be like buying and operating their own armored vehicles instead of hiring a cash-in-transit security firm. Similar analogies can be drawn for retail users who routinely rely on safe deposit boxes, storage facilities, art vaults, personal bodyguards and commercial bank accounts.
Hiring trusted custodians is not an obstacle for most participants in most markets.
Decentralized networks are for settlement
The cost of self-custody can be lowered (Lightning Network, e.g.) and techniques for self-custody can be improved (multisig, hardware wallets, etc) but self-custody solutions will always be more expensive and complicated than trusted alternatives. That means anyone with both self-custodied and third-party custodied bitcoin will actively prefer to transact using the trusted layers and rebalance as needed into self-custody with large, occasional batch transactions.
In other words, for most users it will make sense to do most of their bitcoin spending from a bitcoin-denominated bank account they deposit into as needed. Spending using a custodial account saves transaction fees and reduces the need for handling self-custodied private keys. The size of the balance a user is willing to risk in a custodial account will vary, but cheap, trusted transactions will naturally outnumber the more expensive deposits/withdrawals into/out of self-custody.
In the limit you could imagine the market converging on a single shared third-party custodian since a universally shared custodian could clear transactions between anyone at no marginal cost — but in practice there are natural limits to the size of a trusted custodian in the same way the traditional economy does not converge on a single universal bank. The larger the assets managed by the custodian the more tempting a target the custodian becomes to thieves, governments and rogue employees. Trusted systems simply do not scale to the size of the global economy.
A more plausible network topology is a hub-and-spoke network where the hub is a cluster of large (but not too large) specialized custodians with large payment channels open to each other and the spokes are an outer ring of private user vaults. Central custodians would need to be large enough to compete for access to other custodian’s liquidity but also small enough to avoid the natural predation of thieves and governments. The size of custodians vs private vaults would ebb and flow naturally with improvements to security techniques or the perceived trustworthiness of custodians. Everyone would be incentivized to clear transactions off-network (using trust) whenever possible and only use on-chain for final settlement.
A network topology like this implies that large custodians will be responsible for the economic center of gravity / Schelling Point of the network, since the large majority of transactions will prefer to be routed through centralized channels. The existence of private vaults and the option to withdraw into self-custody creates a check on the power of those central custodians, but the cost of decentralization means custodians will always be able to offer a cheaper (trusted) alternative.
Most Bitcoin transactions will happen on trusted layers.
The importance of self custody
Although self-custodied assets will (for most users) represent only a subset of the portfolio and a minority of active transactions, it still plays a critical role in the balance of the ecosystem.
First and most importantly meaningful self-custody is a necessary requirement for ensuring Bitcoin’s monetary integrity. Users need to be able to distinguish between bitcoin and bitcoin IOUs, otherwise the creation of new bitcoin IOUs is indistinguishable from inflation of Bitcoin’s supply. The cost of securing and spending bitcoin directly needs to remain as low as possible to keep access to the network as broad as possible. If there are only a handful of specialist providers actually interacting with the network they will eventually conspire to control it — or be overwhelmed by outside attack.
Keeping self-custody practical also improves the quality and reliability of the custodial network. The more accessible self-custody is the more fiercely custodians will need to compete via better pricing/services or greater transparency.
Custodial transactions will always be cheaper and faster than decentralized alternatives, so they will probably always be the majority of bitcoin-denominated transactions by both volume and frequency. But the trustless settlement transactions in actual Bitcoin are what anchor the trusted custodial layer to reality, so they are still critical to the function of the bitcoin economy.
This is similar in some sense to the role of the legal system in the traditional fiat economy: the vast majority of transactions operate within various trusted layers rather than being settled trustlessly, but those trusted layers are fundamentally supported by the neutral authority of the courts. Most contracts and transactions are never disputed because the economic rewards for cooperation exceed the potential benefits of defecting – but that cooperation still depends on the credibility of the courts even when it is never invoked. The size of the court-adjudicated economy is small and not representative of the overall economy – but it is a critical foundation.
A particular user’s custody strategy will likely reflect not just their risk assessment but their ideological alignment. Users with strong commitment to the ideals of the network or with strong ideological opposition to local custodial networks may prefer to deliberately overallocate to self-custody relative to their risk profile, such as a Bitcoin activist who prefers to reside entirely within the circular Bitcoin economy. These ideological users are rare but function critically as an ‘intolerant minority’ in the Bitcoin ecosystem that enforces the integrity of the protocol itself.
Even for users who are less ideological overall they may occasionally have reason to make ideologically sensitive transactions that custodians might otherwise censor: political donations, illegal purchases, avoiding surveillance or capital restrictions. Even users who literally never make an ideologically sensitive transaction may choose to self-custody a larger portion of their portfolio to retain the option value in case custodial ideology changes. All users have some degree of vested interest in keeping a portion of their portfolio beyond control.
Self-custodied transactions will be the minority of bitcoin-denominated transactions by frequency and by volume and they will not be representative of the overall bitcoin-denominated economy – but they will also be the load-bearing transactions that form the foundation of the ecosystem overall.
Self custody matters deeply, but narrowly. Most transactions will stay trusted.
It may seem counterintuitive for users to hold any of their portfolio in a high-risk strategy, but it is a more common practice than might initially appear. Gift cards, store credit, layaway purchases, reservation deposits, annual subscriptions, pre-orders and Kickstarters are all examples of users custodying small portions of their wealth without carefully scrutinizing the security or financials of the custodian. Conversely an envelope of cash is a perfectly reasonable way to carry money into or out of a bank but is too high risk a storage solution for any significant length of time. Storing wealth in a high risk strategy for a short period or a small amount of money (or both) is a normal thing to do.