papers/lux-institutional-custody/sections/13-comparison-existing-custodians.tex

\section{Comparison to Existing Custodians}

\label{sec:compare}
%% =====================================================================

We compare the proposed architecture against the four custodians
most likely to be the incumbent for an \$8B fund: BitGo, Fireblocks,
Anchorage Digital, and Coinbase Custody. The comparison is on
\emph{trust assumptions} (which entities must remain honest for the
custody to remain sound), not on user-experience or feature checklists.

\subsection{Trust-Assumption Framework}

For any custody arrangement we ask: \textbf{which set of parties,
acting together, can move the assets?} Smaller is worse (more
fragile); more diverse is better (less correlated risk).

\subsection{BitGo}

BitGo Trust Company is a South Dakota-chartered trust company. Its
multi-sig (three-key, two-of-three) places one key with BitGo, one
key with the user, and one in cold backup. Trust assumptions
\cite{bitgo-soc}:

\begin{itemize}[nosep]
\item BitGo must remain honest with respect to its key. (The user
typically delegates the user-key to BitGo as well, in practice
collapsing to a single-custodian model.)
\item The on-chain multi-sig is publicly visible: P2WSH on Bitcoin,
contract on Ethereum.
\item Insurance ceiling: published \$250M aggregate; well below an
\$8B portfolio's potential exposure.
\item Single jurisdiction (US) for the trust company.
\end{itemize}

\subsection{Fireblocks}

Fireblocks is a technology platform, not a fiduciary. The fund
operates its own custody using the Fireblocks MPC-CMP signing
service. Trust assumptions \cite{fireblocks}:

\begin{itemize}[nosep]
\item The Fireblocks software (closed-source) must be free of
extraction back-doors.
\item The Fireblocks signing infrastructure (their portion of the
MPC) must be honest.
\item Threshold structure is configurable by the fund; the fund
typically deploys three signers, one of which is the Fireblocks
co-signer.
\item Not a fiduciary: counterparty risk is the fund's, not
Fireblocks'.
\item Not insured by Fireblocks; the fund must arrange its own
insurance.
\end{itemize}

\subsection{Anchorage Digital}

Anchorage is a US OCC-chartered national trust bank. Trust assumptions
\cite{anchorage}:

\begin{itemize}[nosep]
\item Anchorage as a fiduciary must remain honest and solvent.
\item Anchorage's SGX-based key infrastructure must be free of
microarchitectural attack.
\item Single fiduciary point of failure (mitigated by OCC oversight,
not by cryptographic redundancy).
\item Single jurisdiction (US).
\item Insurance: undisclosed amount, behind an \$8B portfolio is
likely under-covered.
\end{itemize}

\subsection{Coinbase Custody}

Coinbase Custody Trust Company LLC is NYDFS-regulated. Trust
assumptions \cite{coinbase-custody}:

\begin{itemize}[nosep]
\item Coinbase as a fiduciary must remain honest and solvent.
\item Coinbase's cold-storage architecture (dispersed cold storage,
multi-vendor) must remain sound.
\item Single fiduciary point of failure.
\item Single jurisdiction (US).
\item Insurance: \$320M policy, below \$8B exposure.
\end{itemize}

\subsection{The In-House Architecture}

Trust assumptions of this paper's architecture:

\begin{itemize}[nosep]
\item No single fiduciary. The fund itself is the custodian.
\item Three of five independent HSM-vendor lines must remain honest
(cold tier).
\item No single jurisdiction can compel asset transfer; cold-tier
shares span at least three continents.
\item No single cloud provider controls signing authority on its
own; cloud shares are bounded by 2-of-9 across all tiers.
\item Insurance is independently arranged at \$500M+ tower from
Lloyd's syndicates, layered.
\item Custody policy is invisible to the chain.
\end{itemize}

\subsection{Side-by-Side}

\begin{table}[h]
\centering
\small
\begin{tabular}{p{3.5cm}p{2.4cm}p{2.6cm}p{2.4cm}p{3cm}}
\toprule
\textbf{Property} & \textbf{BitGo} & \textbf{Fireblocks} &
\textbf{Anchorage} & \textbf{In-house} \\
\midrule
Trust root & Trust co. & Software vendor & Trust bank & Self \\
Threshold & 2-of-3 & 3-of-3 (varies) & internal & 3-of-5 (cold) \\
Chain footprint & Public multisig & MPC (single sig) & internal & MPC (single sig) \\
Vendor diversity & Single & Single & Single & 4 distinct lines \\
Jurisdiction count & 1 (US) & 1 (US) & 1 (US) & $\geq 3$ \\
Insurance ceiling & \$250M & user-arranged & undisclosed & \$500M+ \\
Fiduciary & Yes & No & Yes & Self \\
Effective fee on \$8B & $\sim$\$8M/yr & $\sim$\$3--5M/yr & $\sim$\$32M/yr & \$5.36M/yr \\
\bottomrule
\end{tabular}
\caption{Side-by-side custody comparison. Fee figures
are best estimates from rate-card disclosures where public.}
\label{tab:side-by-side}
\end{table}

\subsection{When the Incumbent is Defensible}

The proposed architecture is not the right answer for every fund.
A small fund (\(<\) \$200M AUM) with a small operations team is
plausibly better served by an incumbent custodian, because the
overhead of running this architecture (six-engineer custody team,
six-month SOC 2 window) does not amortise. The break-even is
approximately \$1B AUM for the operational economics; below that
band an incumbent is the rational choice.

For an \$8B fund the operational economics decisively favour
self-custody on this architecture, and the trust-assumption
diversification is a step function improvement.

%% =====================================================================