Kasper Luyckx

In January, @drakefjustin wrote that @ethereumfndn management had officially declared post quantum security a top strategic priority. The Foundation later set a 2029 planning target for full L1 post quantum security. In my experience it takes 12 to 18 months from RFP to a custody stack in production, so the stack chosen today has to still work after that switch. Custody has to deal with hash based signatures such as leanXMSS, an awkward fit for MPC because each hash step is computed jointly and stateful variants must stay in sync. Coinbase, which runs MPC custody, has described researching programmable HSMs as a fallback. An HSM is not quantum safe by default, but a programmable one can run a new algorithm inside the same hardware boundary and policies. At @Ledger we are working on that agility in our @ledger_business HSM stack. @ethereuminsti the question for every institution: how would your provider add a new signature scheme, and how long would it take? enterprise.ledger.com/news/p…

Tomorrow at @blockworksDAS London with @khingoei @jojothecow and @alvarezmarsal: securing onchain capital when keys alone are not enough. Irreversible losses, freezes, and what institutions should demand before chasing yield. What question should we put to the room?

When stolen stablecoins can be frozen, who gets to decide? Circle says it froze USDC linked to the Binance hack in coordination with law enforcement. That can help stop stolen funds moving further. But freezing funds is not the same as returning them. Someone still needs to establish who owns the money and whether it can legally be returned. The question for me is what happens when the victim is a small business or an individual. They should have a clear way to report the theft, know what evidence is needed and understand who can act. Access to that process should not depend on having industry contacts or making headlines. That does not mean every claim should trigger a freeze. False claims and mistaken freezes can hurt innocent people too. If stablecoin payments are going to replace traditional payments, how does the industry ensure smaller victims can get help, with clear rules, a practical way to report theft and a way to challenge mistaken freezes?

Securing the keys is necessary. It is not the whole security model. Bybit and Binance illustrate why. In February 2025, a compromised Safe developer machine enabled a disguised malicious transaction that deceived Bybit’s signers. For the October 2026 Binance incident, Richard Teng told CNBC that attackers used malicious downloads and fake job interviews to compromise employees, then moved through internal tools to reach the system authorizing wallet transactions. The investigation remains ongoing. For founders choosing a custody or signing setup, I would ask two sets of questions: 1. Where does the policy engine live? How is it secured? Who can change its rules, and what independent controls protect those changes? 2. Who or what can submit an approval? How are those people, identities, devices and environments secured? Can approvers independently verify that what they sign matches the intended action? These accounts do not establish that policy engines themselves were compromised. They show why the signing and approval environment deserves scrutiny alongside key protection. The HSM versus MPC debate matters, but security has to cover the whole stack, not just the private key. If your keys remain protected but your approval environment is compromised, what prevents an attacker from obtaining a valid signature?

Digital self custody was born with the invention of bitcoin. It brings true ownership to both individuals and institutions, no longer do you need to rely on a third party. It’s a right of freedom, but this freedom is under constant attack. Not just by governments but also by malicious actors who try to steal your assets. At Ledger, we fight for this freedom every day. Even if we face set backs, we don’t give up, but we improve and continue. Because freedom is what’s at stake.

Tune in live for @Ledger Op3n and hear the latest product announcements, we have some great things in store for today! #selfcustody #ownership m.youtube.com/watch?v=6_twUP…