And if all your secrets are owned by others, you have no property. Where is your freedom? Can you envisage a world where the self that you say would be regulated? I think that it is very dangerous to move towards concepts of the type, 'Well, we want to regulate private property because now we want to know everything.' What is your feeling about the level of security of exchange platforms today? There is a whole part of the industry which acts as if nothing had happened and which completely ignores the thing.
Thank you for finding us on Unhusted. Today my guest is Pascal Gauthier, the CEO of Ledger. With him we are of course going to talk about security in the crypto world and also the Bybit hack. You will see it's fascinating. Before you start, remember to subscribe to the channel, it helps us a lot. We left with Pascal. Hi Pascal.
Hi. Thanks for having us. We'll meet exceptionally today at Ledger in Studio 106.
You are the CEO of Ledger. How would you define today Ledger's mission?
It's still to secure cryptos. So welcome.
Thank you. It's great that you're here. Ledger's mission seems quite incredible to me. In fact, it has never changed. I was the first investor in... I took the tour of SID and the SID deck when we presented the company. Well, in any case, when the founding team presented the company, the vision of the company is more or less what made the G today. When I invested, it was because I noticed in 2014 that there was a real problem in securing what we call the endpoint. That's the white paper. The white paper by Satoshi Nakamoto described well what he wanted to do with Bitcoin, but I didn't really understand what we were doing with the private keys. And so I met the founding team of Ledger who explained to me that they wanted to use the Cartapus technology, which is a French invention, to secure these cryptographic secrets, which are in fact what you have to be able to sign and prove to the public Bitcoin protocol that you are in possession of a Bitcoin which is on an address A in order to then be able to send it to an address B. For me, it was really what I was looking for because I really did not understand what we were going to do with the private keys, how we were going to secure them. And so the mission of Ledger at the beginning, in a very simple way, is to secure your private keys for Bitcoin. And in fact, by doing that, we realized two things gradually. It is that what is Bitcoin? It is digital private property because in fact it is the first time that you can have a digital asset which is yours, which belongs to you. And once we enter into this logic of digital private property, in fact we realize that there are a whole bunch of digital assets of which we have the secrets and which we must keep ourselves finally, that from now on we can keep ourselves in order to be able to use them according to our desires, to be able to delegate the use of these assets according to whom we wish to delegate, and we escape a little from this digital trap into which we were kindly entering, where ultimately our digital personality is possessed by third parties and we do not own it. So there, we suddenly own everything. And Ledger, it's digital private property.
Since we're talking about private property but also about security, I wanted us to come back to one of the major security problems that has taken place in recent months, which is the Bybit hack, which you must have heard about. No, no, I'm kidding. Did this hack surprise you? It shocked you?
No, but we, you know, we're often at the Friday night party, we're a bit of a nuisance. We're always talking about security, finally the thing that's annoying everyone. It's not exactly true because with Ledger, I think we succeeded in creating a brand and there is a real love of the brand on the part of consumers and there has a cool side to Ledger. It's the first time that you have a company which provides security for the consumer and which is relatively cool. So we're not that annoying in the evening. Nevertheless, we're always a bit of a Cassandra. We're always explaining what's going to happen in the future and unfortunately people don't believe us. It's a bit like with children when you say that fire burns, you can't tell them, they don't believe you until the day when they burn themselves and they do the experiment and then, well, that's how you learn that fire burns. Unfortunately, in crypto, that's a bit what's happening. That is to say that what happened with Bybit, we had planned for a long time and it's something quite simple anyway to summarize the Bybit problem. So well, already it's an exchange which is losing 1.5 billion dollars. So it's a very big hack. Therefore, this is the reason why security in crypto must be absolute and not good enough. Because before, if you want, with phones and computers which are not secure, hardware security exists until the moment it no longer exists. But hey, at the time it was OK because ultimately there is not much to hack on computers. Well, what did he steal? And so the security paradigm changed once we can steal Bitcoin and you can clearly see on a hack you can escape with 1.5 billion dollars. So it's really monstrous. And the problem of these, the advantage and the problem of these blockchains is that the transaction is immutable. Once it has happened, we cannot bring it back. We are unlike the traditional financial system where on a hack like that you could bring back the money in one way or another. What happens overall is that the industry has got into a bad habit of signing blank checks. It's called blind signing. That is, we sign transactions but in fact we don't really know where they are going to land. And why? Because as we sign them often from a computer or a telephone, we don't have a secure screen, we don't have a secure interface to be able to see where the transaction really goes. The screen of your phone or your computer will say that the transaction goes to an address A when in fact the attacker is going to... it's already below and it sends it to a B address. And so that's what happened with Bybit. It's something that we explained to the market at length. And furthermore, we can find the posts from the dungeon which explain that. We have an initiative called Clear Signing, precisely the opposite of blind signing, which we put in place last year already because we had noticed this problem. And that is to say that we still let users use Ledgers to sign blindly because it is a consumer request. But we said to ourselves that regardless of the consumer's request, now we are going to force the industry towards clear signing because we no longer want to compromise on security whatever the reasons for use, whatever the simplicity of use ultimately, because yes it is easier to use but on the other hand you don't know if the money will arrive safely. And so we think that it's not good for the future of the industry because when there is a hack like that, it's not just a problem for Bybit, it's a problem for everyone. Then the people who thought of joining this world of cryptocurrency, well, don't do it because they say to themselves that it's really the Wild West. And there you go. And so that could have been avoided with clear signing, that is to say looking on a secure interface, the screen. I show you from a Ledger. That's like that. If you see on this screen which address is secure, that means that it is the correct address. And so in the case of Bybit, they would have seen that there would be a difference between the address that they would have seen on the secure screen and the address that they saw on the computer. The address on the computer was the address to which they thought they were sending the funds and they would have seen on the secure screen that in fact the funds were going to another address.
Do you think that this type of security problem could happen again in the future with other exchanges in general? What is your feeling on the level of security of exchange platforms today?
So what is absolutely amazing in this thing is that I take the example of the guy in the evening who pisses everyone off. When you talk about security, in fact you annoy people. Even if there was a Bybit effect, like there was an FTX effect, like there was a Celsius effect, that is to say that each time there are events like that, overall it benefits the message and the business of Ledger. That means that there are still people who are aware of the dangers and who are coming towards Ledger technologies either at the consumer level or at the business level, because when you talk about Bybit and the fact that Ledger can help Bybit, because we also have a business, Ledger Business offer. So there is a positive effect and an educational effect. People are still aware of the dangers and some increase their level of security by coming to Ledger in particular. On the other hand, there is a whole part of the industry which acts as if nothing had happened and which completely ignores the thing because it didn't happen to them. So it happens to others but they don't feel concerned. I don't know why, it seems hallucinatory to me but that's like that. When you say a whole part, well, there are a whole bunch of actors in fact who today have exactly the same setup as Bybit. That is to say they use something called Gnosis Safe, before, therefore a free software called Safe which does not take clear signing into account at all. So you can't know what you sign with Safe. You are obliged. And even if you sign with Ledger with Safe, in fact you use Ledgers to do blind signing on this software solution which is called Safe. And well, in fact, Safe to my knowledge has not lost 90% of its customers today. So that means that all the clients who run on Safe have the same attack problem as Bybit. And so today most of the Safe clients for example are not in the process of upgrading their defense and say to themselves that ultimately so far everything is fine.
Generally speaking in the crypto world, you have the impression that the level of security is progressing or rather regressing? I sometimes have the impression that it is stagnating. That is to say that in fact crypto today I think is mainly interested in the growth of the top line. And in addition the exchanges are setting a bit of a bad example because what happened with Bybit and the reason why ultimately everyone found that Bybit had done extraordinary crisis management is that they repaid the billion and a half quite quickly and so ultimately it's as if nothing had happened. But it's a bit of a misery cover in fact. That is to say that in fact something still happened. They still lost a billion and a half. So that's not great and it's a real problem to lose a billion and a half. It's good that they can repay it thanks to them and it's better for the industry rather than actually once again creating a default of a billion and a half compared to cheated consumers. But I think that there is a responsibility upstream which is not to lose them, because we would have done well without another scandal. When I say the exchanges, I give the bad example, that is to say that Binance, Bybit, OKX, Coinbase are real cash machines and therefore today they have the power to reimburse extraordinary sums even if they lose them. Except that that's not real life. Real life is about not losing the money and on top of that there are a whole group of more fragile players who don't have the means to repay this type of amount. So it's a bit of a bad habit given to the industry to say, well anyway if you lose the money it's no big deal, you repay it. I congratulate them for repaying because it's still better but I think that basically we should try not to lose money and especially for all the people who don't have a business model as explosive as the exchanges which create billions in profits every year. You really have to be very careful with these securities because once the money is gone it's difficult to get it back. You should know that the money was stolen by the North Koreans. So it's a group called Lazarus. Well to go and recover the money in North Korea you have to have an army.
I would like us to talk about self-custody which is the business, the core business of Ledger. Do you think that self-custody is going to become mainstream or that it is rather in the process of becoming downright a political act?
I don't like at all the word self-custody. I say to you because Bitcoin at the beginning was to say you can't leave all your money in a bank because the Lehman Brothers, because nobody is too big to fail. You see no one is too big to fail and therefore you have to be able to keep your money yourself. So it's for that there is a kind of custody, so when you entrust your money to a bank or to someone versus self-custody. But in fact it gives a financial connotation to all that. And so when we think purely in financial terms we enter into considerations of do I trust my bank, do I trust myself, ultimately the politicians in all that, and then Bitcoin as a reserve value in relation to dollars, gold, etc., etc. Well OK, we are immediately in financial consideration. It's not wrong but it's not just that because in fact I spoke earlier about digital private property and in fact for me we are more in private property, digital, than only something financial. And when we say that we say to ourselves, 'Ah okay but if it's not just financial then already that completely relaxes the point in terms of is it possible not possible and are we in the process of taking away the power of money from the states for example?' We are entering into something which is much simpler. Do you have the right to private property? The answer is, well, if you are in a democracy, yes, because private property is one of the fundamentals of democracy and I think it is better to present it like that because in an educational way for people who don't really understand what Bitcoin is, cryptocurrencies, cryptoassets as a general rule and there is a movement ultimately to tokenize everything that is important and has value for us on the internet like your identity for example. The question is do you have the right to keep your identity, is it your private property? The answer is yes. There the identity you are given by the State, well that is sure but it is still your fundamental right and it is still your private property in the sense that you undoubtedly have an identity document with you today. You own it, it is yours and it is up to you to show it if necessary to others, authorities, if you want to cross a border or if you want to prove that you are 18 years old, etc., etc. When we operate and when we think in terms of digital private property, in fact the point of view becomes much simpler. Will we have digital private property in the future? The answer is necessarily yes. Who it concerns? The answer is everyone. So that means that the technologies that are being developed today are for absolutely everyone tomorrow.
So you have your vision because there you are talking about identity for example, it's a world where you could hold your identity on a Ledger or an equivalent product?
Well of course today we cross the borders with a passport which is 48 sheets. Well, that's something from the past. So there is a chip in it. Besides in parentheses, what is interesting is that in your passport you have a chip which is roughly the kind of chip that is in a Ledger. So technologically it is perfectly compatible. And so tomorrow yes I think you will badge with a Ledger to go from one country to another and you will no longer have a paper passport. Finally I mean the paper will become completely anachronistic and we will move on to a form of digital presentation which is much better. Besides in parentheses what is funny is that when you cross the borders with passports there is still a lot of manual verification, etc., etc. So less and less because now it's true that with electronic chips you can still badge the passports but you can also see that you badge the passport. So that means that tomorrow you will be able to be with your Ledger. There is an NFC chip in the Ledger. You badge your Ledger and you have the same experience as today except that everything is in your Ledger. And in your Ledger you will have your password, your passkeys, your identity, finally a whole bunch of things which are your secrets and which only you have. And the question is not so much philosophical it is rather practical. That is to say at a given moment if all your secrets are possessed by others and you have no property, where is your freedom? Freedom is based on security. It was not safe, was not really free and is based on the protection of your private life, that is to say you need a bit of both and that is the basis of your freedom and your private property in fact. And so we are really working on these subjects to make them easy to use and we think that it will apply to multiple assets which has a double future. Moreover you will be able to entrust some of your assets to a bank, to third parties of course, but you will also be able to keep them and you will be able to do the double. Besides the double thing, you will be able to keep your passkeys yourself and then keep a bunch of passkeys on Google. I think that there is a future which is not black or white where it is I own everything versus I entrust everything to everyone but at least now you have the opportunity to have digital private property. And that is a big change and I think that it is a change which is profound and fundamental which will also ask people to understand, to educate themselves because these are quite strong changes and that everything must not be sacrificed on the altar of simplicity of use. That is to say that at a given moment we must also think about what is our private property, what we need, what do we want to entrust to third parties, what are the risks to entrust everything to third parties and then adjust accordingly.
I take 30 seconds in the middle of this episode to talk to you about Débloc. Débloc is the first crypto wallet backed by a real current account. You can receive your salary, pay your rent and buy and sell crypto without limit. It's free and registration takes less than 2 minutes with the link in the description. We left with Pascal. So you are precisely saying you shouldn't sacrifice everything on the altar of simplicity. How is it at Ledger you manage a little this tension between still a need for simplicity of an easy user experience and this core business which is sovereignty, security?
