Generative Data Intelligence

Tom Hoznik on Potential Security Flaws in Bitwise’s Spot Bitcoin ETF

Date:

Unchained Capital’s Tom Hoznik seems concerned with the safety of the BTC holdings of Bitwise Asset Management’s spot Bitcoin ETF.

Unchained Capital is a Bitcoin-focused financial services company. It offers services centered around Bitcoin, including secure custody, loans, and financial products that leverage Bitcoin as collateral. This approach is particularly appealing to individuals and businesses looking to leverage their Bitcoin holdings without selling them. One of their notable offerings is a multisignature wallet service.

Multisignature (multisig) refers to a digital signature scheme which requires multiple keys to authorize a cryptocurrency transaction, enhancing security beyond traditional single-key wallets. In a multisig setup, the responsibility and authority to execute a transaction are distributed among multiple parties, each holding a unique private key.

For a transaction to be validated and processed on the blockchain, a predefined number of these keys must agree and sign off. This threshold setup reduces the risk of theft or loss, as no single person has complete control over the wallet. Multisig is particularly useful for organizations or groups where financial transactions require consensus or for individuals seeking an additional layer of security for their digital assets.

On January 24, Bitwise Asset Management, self-described as America’s premier crypto index fund manager, announced a significant update regarding its Bitwise Bitcoin ETF (BITB). This ETF, along with ten others from various companies, received the green light from the U.S. Securities and Exchange Commission (SEC) on January 10 and commenced trading the next day.

Bitwise proudly announced that its BITB ETF is the first in the U.S. to disclose the wallet address holding its Bitcoin assets. This development, as per Bitwise, enables public verification of the ETF’s holdings and transaction activities directly on the blockchain. The company emphasized that this initiative is in harmony with Bitcoin’s fundamental principle of on-chain transparency. Bitwise takes pride in this commitment, showcasing its dedication to embodying the values integral to BITB.

Moreover, Bitwise considers the revelation of the wallet addresses as the initial step in its ongoing effort to enhance public transparency. The company is looking forward to future technological advancements and is eager to partner with firms like Hoseki. Through such collaborations, Bitwise aims to offer real-time cryptographic attestations, thereby enhancing the transparency and trustworthiness of their ETF.

<!–

Not in use

–> <!–

Not in use

–>

Later that day, Tom Hoznik, an employee at Unchained Capital, posted a thread on social media platform X discussing the security measures of Bitwise Asset Management’s spot Bitcoin ETF. Hoznik claimed that BITB is not using multisig security for its Bitcoin holdings, which he considers a significant security oversight.

Understanding Bitcoin Wallet Address Types

Hoznik explains that the type of Bitcoin wallet address used by BITB indicates its security method. He notes that BITB’s address begins with a “1,” identifying it as a Pay to Public Key Hash (P2PKH) address. This type of address is associated with single-signature (singlesig) wallets.

In contrast, multisig addresses, which Hoznik advocates for, use different formats: Pay to Script Hash (P2SH), Pay to Witness Script Hash (P2WSH), or Pay to Taproot (P2TR). These formats are distinguishable from P2PKH addresses and are designed for enhanced security through multisig setups.

The Importance of Multisig for Large Balances

Multisig is a security feature in Bitcoin where multiple signatures (from different keys) are required to authorize a transaction. This method is particularly crucial for protecting large Bitcoin balances, as it introduces threshold security, meaning several parties must agree to execute transactions. Hoznik emphasizes that multisig is a “bitcoin-native, battle-tested” method, suggesting its reliability and proven track record in the Bitcoin ecosystem.

Alternatives to Multisig: SSS and MPC

Hoznik mentions two alternative security methods: Shamir’s Secret Sharing (SSS) and Multiparty Computation (MPC). Both methods have their trade-offs compared to multisig:

  • Shamir’s Secret Sharing (SSS): This method involves dividing a secret (like a private key) into parts, distributed among participants. It’s vulnerable at the creation of the key and when the key is reassembled for signing a transaction, presenting potential single points of failure.
  • Multiparty Computation (MPC): MPC for Elliptic Curve Digital Signature Algorithm (ECDSA, a cryptographic algorithm used in Bitcoin) is less battle-tested than multisig and more complex. This complexity could lead to a broader surface for potential issues.

Hoznik’s Ideal Security Recommendation

Hoznik recommends that institutions like Bitwise should use multisig as their foundational security method. Additionally, they could employ distributed key agents, each using SSS or MPC, for each key to enhance security further. This approach would combine the robustness of multisig with the additional security layers provided by SSS or MPC.

Featured Image via Pixabay

spot_img

Latest Intelligence

spot_img

Chat with us

Hi there! How can I help you?