Centralizing SaaS wallets: Killing autonomy for the sake of convenience?

Disclosure: The views and opinions expressed herein belong solely to the author and do not necessarily represent the views and opinions of crypto.news editorial.

Traditional software-as-a-service multi-party computation custodians are often seen as the “go-to” solution in the crypto universe, managing a surprising portion of decentralized assets. But the truth is, when you delve deeper into the technological aspects of custodial digital currency, that suitability quickly diminishes, and a host of limitations, unexpected risks, and challenges emerge.

Regardless of your stance on centralization versus decentralization, it is important to recognize that the appearance of private key control may be due to a lack of control in policy management and infrastructure that you do not manage yourself.

The rise and risks of SaaS-based MPC wallets

The emergence of SaaS-based MPC wallets has significantly impacted the crypto landscape, allowing businesses to manage digital assets with ease and perceived security. These wallets are typically provided by tech companies that are now increasingly positioning themselves as non-custodial providers. However, despite this label, these solutions still require users to trust a central party to securely coordinate signing and key generation, placing them higher on the custodial spectrum in terms of control over assets.

This reliance on a centralized service provider creates a situation where control and security are not entirely in the hands of the institution using the service. While these technology providers do not operate as traditional third-party custodians like BitGo or Anchorage (they offer highly regulated and fully managed custodian services), they still present a centralized point of control and a potential vulnerability. MPC technology, used by both SaaS-based providers and traditional custodians, involves splitting the cryptographic keys required for transactions into multiple pieces distributed among various parties to increase security.

However, when it comes to SaaS-based solutions, the centralization of these services in a few dominant players introduces new risks. One is that these providers become attractive targets for hackers due to their significant control over the assets of many customers, creating a vulnerability similar to that of centralized exchanges. Second, the concentration of control in these SaaS-based models not only increases security risks, but also indirectly limits the autonomy of crypto businesses.

By relying on an external provider to manage critical aspects of digital asset security, institutions may find themselves constrained in managing the policies, procedures, and overall management of their assets. This centralization conflicts with the decentralized ethos of the crypto industry, where individual sovereignty over digital assets is paramount.

Challenges of dependency and trust on MPC custodians

While MPC wallets often claim to be non-custodial because the institution holds a portion of the key, the reality is much more complex: heavy reliance on third-party vendors for day-to-day operations, security, and service availability introduces significant risks. While the client institution owns a key share, all other components that impact the use or potential misuse of key shares remain under the vendor’s control. This setup creates vulnerabilities around key signing integrity, but more importantly, it introduces friction into the customer experience, which is an operational risk that must be accounted for. For example, any policy changes can take up to several weeks if not prioritized by the vendor, causing significant delays and operational inefficiencies.

Analyze this potential impact further. MPC wallets can have longer transaction times and relying on vendors for routine account changes and maintenance can be problematic. If a team member leaves, revocation of their access is done at the vendor’s pace. This can take a significant amount of time and can lead to a period where assets may be compromised. Additionally, maintenance outages during business hours can disrupt operations. Additionally, asset recovery in disaster scenarios can take up to 48 hours, which is a very long time for any organization dealing with high-value transactions. These operational dependencies can be extremely inconvenient. As a result, they create security risks that run counter to what decentralization stands for; running your own wallet infrastructure.

For regulated financial institutions or firms with stringent security requirements, these dependencies are deal breakers. This is because the operational risks and costs associated with relying on third-party MPC wallet solutions are often unacceptable to internal risk teams. These teams are uncomfortable with the inherent uncertainty and potential for delayed response times that come with these products. As a result, many MPC wallet solutions fail to pass the rigorous scrutiny of risk assessments, which prevents them from being adopted by organizations that require the highest levels of security and operational control.

A new paradigm for crypto storage

If current SaaS solutions represent a ‘trust us’ model, the ideal solution is to shift to a ‘trust but verify’ approach and ultimately to a ‘never trust, always verify’ model. This shift gives customers control and ownership of critical IT infrastructure by empowering them to host software in whole or in part. By eliminating the opaque processes found in black-box SaaS solutions, organizations not only reduce the operational risks hidden in the friction of operating in a third-party’s virtual space, but also enable more agile and flexible infrastructure management.

This enhanced control supports better risk management and enables institutions to quickly adapt to market demands, which ultimately increases revenue growth and positively impacts profitability.

A practical solution integrates critical governance and policy controls into a comprehensive platform, allowing organizations to manage their digital assets within a zero-trust security framework. This architecture continuously verifies every interaction, eliminating implicit trust and increasing security. By adopting a service-oriented architecture, organizations can tailor the system to their unique needs, ensuring scalability, high performance and robust security.

Current market offerings that rely entirely on SaaS-based MPC wallets place an unfair reliance on vendors who control all components, including cryptographic processes, keys, policies, and transaction data. By moving toward solutions that allow institutions to own and control critical pieces of their digital asset infrastructure, the industry can mitigate risks and reduce vulnerabilities while operating closer to decentralization principles. Such a transformation is essential to foster trust and security in the rapidly evolving crypto landscape.

It’s time for institutions to take control of their policies. By adopting models that provide partial or full control over fundamental governance and policy implementation, institutions can better align with the proper treatment and oversight of service providers or outsourcing arrangements. This paradigm shift is essential for the future of the industry and is poised to pave the way for continued innovation and trust while preserving the core values ​​of cryptocurrency.

Hadden Patrick

Haden Patrick is the director of business operations at Cordial Systems, a provider of enterprise-grade self-storage software that uses a zero-trust security model. Haden has executive experience in team leadership, engineering, and education stemming from his 24-year career as a Navy officer. After founding SoloKeys, the first open source security key company, he led projects connecting web3 with traditional finance at a cryptocurrency trading firm before joining Cordial Systems.