Pillars of digital asset security

Security awareness, education, and threat intelligence sharing are essential. With the threat landscape constantly evolving, criminal groups are refining their techniques and sophisticated threat actors are targeting the digital assets industry. Attack methods may not be new, but with advancement in AI and technology they're becoming more effective, or are they?

We explore the critical aspects of digital asset security and how Copper's solutions are building the institutional standard for the industry.

Digital assets aren’t inherently riskier than traditional finance

When institutions implement robust security measures and governance controls, digital assets can be as secure as traditional financial systems, but it is crucial to adopt proven frameworks and minimise human error in operational processes. Key to this is a robust security model, multi-party computation (MPC), and trustless governance. By providing additional security, co-signing accountability, and protection against human error, assets remain both secure and accessible.

MPC – a game changer in custody

The three common options used by Custodians for the custody of digital assets are:

1. Hardware secure modules (HSM) – when a private key is isolated in a tamper proof-device.
2. Multi-signature (Multi-Sig) smart contracts – for successful transactions you need to collect a set of signatures from multiple private keys. Here, there are many ways in which a key can be stored.
3. Multi-party computation (MPC) – A private key does not exist as an object, instead key shards are created individually and used for transaction signing.

For Multi-Sig, the risk is transferred from the storage of the key to the signing level. As the contract defines what addresses are valid to sign and where you can move your funds, the contract itself becomes a much broader surface for attack.

The HSM and MPC approach requires only one signature to move funds, and both approaches use native blockchain cryptography that are indistinguishable from any other blockchain transaction.

The main differentiator from one custody solution to another are operational processes.

Copper’s use of MPC technology is a cornerstone of security infrastructure. MPC eliminates the need for a single private key by splitting it into multiple key shards, ensuring that no single entity has complete control. This approach significantly reduces risks from insider threats and external attacks.

“Many of the strengths of digital assets also pose many of the weaknesses around security. We obviously think multi-party computation as a model for holding assets is critical.” - Sam Rendell, Chief Information Security Officer (CISO), Copper

The importance of cold storage and hybrid models

While cold storage remains a vital tool for reducing digital attack surfaces, there is a growing interest in hybrid models that combine air-gapped storage with MPC. This approach minimises concentration risk while maintaining operational flexibility.

Smart contract vulnerabilities

Smart contracts, while powerful, introduce complex security challenges due to their open-source nature and infinite functionalities. Focusing on fundamental operations like transaction signing and ensuring rigorous code audits to mitigate risks are paramount.

“Ten signatures are better than three, but all are vulnerable from the same attack vector. However, if you combine cryptography, online and offline components, have four-eye checks and a few independent and isolated environments which are not all administered by you – a very sophisticated and multi-vector attack would be required to reach the target, significantly increasing safety.” – Ilya Brovkin, Solutions Group Technical Director, Copper

Evolving threats from cybercriminals

Tactics of advanced threat actors have refined their techniques over years, targeting both retail investors and institutional custodians. A multi-layered defence, with operational resilience, and information sharing among industry peers are required to counter such threats.

Insurance for digital assets

Copper has pioneered insurance solutions for digital assets under custody, aligning with emerging industry standards to provide institutional clients with enhanced coverage against third-party theft, physical loss, damage to digital assets and more. This provides an unprecedented level of protection for our clients' assets.

Security awareness: the unsung hero

The critical role of security awareness programs in combating social engineering attacks. Education around phishing attempts, insider threats, and other vulnerabilities is essential for maintaining a robust security posture.

“Security awareness, defence and depth, layered controls, classic practices of scanning your code, having a good application security team, making sure you're doing the solid fundamentals…if you combine all of those things, you're in this much more robust place.” – Sam, CISO, Copper

Copper’s approach to digital asset custody is built on four core pillars:

• Robust security models: A resilient base for digital asset protection, leveraging proven technologies like MPC.
• MPC: Eliminate single points of failure or control.
• Offline transaction signing: minimising exposure to remote threats.
• Operational resilience: combining technical safeguards with human vigilance.

By adhering to these principles, Copper provides a level of security that mitigates against complex threats and counterparty risk.

Institutions can confidently navigate the digital asset landscape by choosing the right solution that implements robust security measures, that stays vigilant against evolving threats, and by embracing MPC technology and OES solutions such as ClearLoop which allows for swift market participation without compromising on security, assets are kept securely in Copper’s custody whist hedging on centralised exchange, making the whole ecosystem even safer.

In our podcast, Pillars of Security, Sam Rendall, CISO at Copper, discusses the cornerstones of security infrastructure and shares invaluable insights into how institutions can safeguard their digital assets. Listen in full for an in-depth exploration of Copper's security pillars, the first step towards unparalleled asset protection, and safeguards against growing threats for a more secure digital future.