Collaborative Custody

Security with the Control of Self-Custody & the Benefits of a Managed Financial Service

Why Use Collaborative Custody?

Collaborative custody gives Bitcoin holders greater transparency and security when they use a financial services provider. Participants share in key management of a multisignature quorum designed for each product with keys always being cold-stored.

  • Reduce risk of loss from hacks
  • Maintain transparency of assets
  • Share control only as necessary
  • Protect funds from exchange insolvency
  • Reduce single point of failure risk
Collaborative custody models for loans & vaults

Distributing Keys Across Multiple Trusted Parties

Client-Controlled

  • Used for vaults
  • This solution makes accessing and administering multisig easy for the individual
  • User controls 2-of-3 private keys, retaining ultimate sovereignty
  • Unchained acts as either a backup or an active co-signer, providing both redundancy and transactional services

Multi-Institution

  • Used for loan collateral security and vaults
  • In this 2-of-3 model, keys are held by three separate parties: a customer, Unchained and our third-party key agent (Citadel SPV)
  • Our key agent acts primarily as a backup, creating redundancy and reducing the risk of trust in any one single party

Protection From the Common Risks of Traditional Full Custody

Frozen Accounts / Withdrawals

When you don’t possess any keys, your exchange account or transactions can be frozen just like a bank account.

Proof of reserves

Without unique keys and addresses, exchange funds are often commingled and at risk of loss in the case of insolvency.

Compromised User Account

Assets held by third parties are at risk of unauthorized transfer if a user’s login and 2FA are compromised.

Exchange Hack

As high value targets for theft and fraud, exchanges are frequent victims of hacking attempts which result in a user’s loss of funds.

Core Security Principles of Collaborative Custody

Multisig
  • Reduce single point of failure risk
  • Create threshold redundancy
  • Industry-standard best practice
Distributed Keys
  • Improve operational security by sharing key management burden across multiple parties
  • Avoid co-locating keys sufficient to spend in one geographic location
  • Reduce risk of monkey-wrench attack
  • Multiple sources of entropy
Unique Addresses
  • Multisig with segregated funds
  • Create fewer honey pots
  • Improve transparency & customer auditability
  • Limit service provider solvency risk
Cold Storage
  • Materially reduce attack vectors
  • Difficult to compromise remotely
  • Prioritize physical security
Trusted Partner
  • Account and system controls amplify protocol strengths
  • Active monitoring for suspicious activity
  • Identity and intent verification
  • Managed service, including offline co-signing

Compatible with the Most-Trusted Hardware Wallets

Choose devices from Trezor, Ledger or Coldcard, and get started with Unchained today!

Our Best-in-Class Financial Security Practices

Wallet Security

Our systems use unique per-customer, multisignature P2SH addresses. With vaults and multi-institution loans, these addresses are partially derived using a customer’s extended public keys. (We never have access to user private keys, ever.) All Unchained keys use hierarchical deterministic (HD) wallets that are cold-stored on hardware devices, including offline air-gapped machines. We use well-tested, industry-standard open source software to author and audit transactions.

Operational and Physical Security

We maintain an internal security policy and ensure that includes personnel training. We store our hardware devices in geographically separated, physically secure locations that require identity verification for access. We store wallet seeds in physically secure locations separate from the wallets they restore. We never store devices or seeds at Unchained corporate offices.

Network Security

We employ high-level security throughout our IT infrastructure in accordance with PCI-compliance standards. We operate within a secure, private, firewalled network. We encrypt all data to, from and within our environment (in motion and at rest) using industry-standard AES-256 encryption. We require two-factor authentication (2FA) to access all sensitive resources. Our centralized identity management infrastructure uniquely identifies employees. All access to systems are limited, minimal, and controlled by this infrastructure. We aggressively monitor all traffic to, from and within our environment, and we retain access, system, and application logs indefinitely (with user/system/employee identifiers).

Identity & Intent Verification

We help our customers achieve a higher degree of security by offering a cosigning service. If requested by customers, we will verify both the identity and intent of a customer transaction prior to cosigning. A customer has the option to record a video verification of their identity that Unchained uses to validate transaction signing requests and 2FA resets. This opt-in feature is only active if requested and includes the option to set transaction amount thresholds for active identity and intent verfication. This service helps high-net-worth customers enhance the operational security of high-value transactions.