Articles
Welcome to our blog! This is where we share policy/regulatory recaps, blockchain developments, and more exciting updates.
‘Crafting The Crypto Economy’ Series Returns With Academic and Legal Thought Leaders
Audio show ushers in a new and necessary storytelling format for navigating the world of Web3, exploring themes of privacy, regulatory compliance, niche markets makers, and decentralized exchange ecosystems in blockchain. Web3 policy-focused podcast, Owl Explains, returns for a second season of ‘Crafting The Crypto Economy’ with leading academics to tackle timely regulatory challenges and the practical blockchain applications reshaping Web3. Focusing on critical topics from Decentralized Exchanges (DEXes) regulation, blockchain privacy, and MEV mitigation, ‘Crafting The Crypto Economy’ introduces academic thoughtleaders and papers from around the world with the latest research on blockchain technology and the crypto economy. With five substantive episodes, Season 2 drops in with well-timed topics to equip policymakers and stakeholders with valuable insights on Web3 regulation and emerging challenges. The hosts of this series, Professors Andreas Park (University of Toronto) and Fahad Saleh (University of Florida) are leading authors in Blockchain Economics and Finance and are part of the Crypto and Blockchain Economics Research (CBER) Forum. The group producing the podcast, Owl Explains, is a trusted blockchain policy resource driven by the expertise of Ava Labs’ Legal team. This partnership between Owl Explains and the CBER Forum seeks to bridge the gap between academic rigor and actionable insights for policymakers. As the SEC increasingly scrutinizes decentralized finance (DeFi) platforms, Episode 1, ‘Regulation of Decentralized Exchanges,’ with Professors Campbell Harvey of Duke University and Joel Hasbrouck of NYU Stern, dives into the novel risks for traders who trade at DEXes and why standard regulatory approaches are not well-suited for addressing those risks. In Episode 2, ‘Blockchain Privacy and Regulatory Compliance,’ Professor Fabian Schär from the University of Basel discusses how blockchain users may attain privacy in their transactions while also remaining compliant. Despite the perception of anonymity, most blockchain transactions are traceable, leading to a rising demand for privacy solutions. The episode explains how blockchain identities are not anonymous and what methods may be implemented to achieve both privacy and regulatory compliance. Detailing the economic values presented in the concepts of Maximal Extractable Value (MEV) and Loss-Versus-Rebalancing (LVR), Columbia University’s Professor Ciamac Moallemi discusses associated mitigation methods such as expedited block times and auction mechanisms for extraction in ‘Mitigation Methods for MEV and LVR.’ Moving into intent-based markets (i.e., Uniswap X, CoW Swap) as a hot topic, ‘Decentralized Exchange (DEX) Aggregators and Solvers,’ with Professor Mallesh Pai of Rice University, explores the economic implications of these niche markets, potential outcomes for traders, and the impact of their underlying economic structures. The World Economic Forum predicts that 10% of global GDP will be tokenized on the blockchain by 2027. Wrapping up the Season 2, ‘Deep-dive on the Avalanche Blockchain’ features Ava Labs’ Chief Protocol Architect Stephen Buttolph to discuss how Avalanche’s blockchain can be used for the tokenization of real-world assets, specifically through the lens of Avalanche’s consensus protocol. Owl Explains and the CBER Forum are committed to helping regulators navigate the world of Web3 and break through the hype. In an always-on blockchain landscape, ‘Crafting The Crypto Economy’ breaks through the noise, leveraging curated perspectives and mental models from top minds in the space.
Building Bridges in Blockchain Policy – Our Growing US Congress Series
At Owl Explains, we believe the future of blockchain and crypto lies in the conversations happening today between industry leaders and policymakers. That’s why our Congress Series is dedicated to bringing you the sharpest voices in US policy, offering insights on the regulatory and legislative shifts shaping the blockchain landscape. From bipartisan collaboration to bold individual initiatives, our guests tackle the tough questions about self-custody, tokenization, and market structure clarity. These are the policymakers from both at the heart of the debate—ready to share their vision for the role of blockchain in America’s economic future. Meet the Voices of Change: Ep. 17: Congressman Mike Flood Kicking off with Rep. Mike Flood, this episode takes a close look at the difference in perspectives on crypto policy between the House and the Senate and how Congress can build momentum for lasting change. Ep. 32: Congressman French Hill Rep. French Hill shares his take on bipartisan efforts to move blockchain forward, touching on key themes like self-custody and market clarity. Ep. 30: Congressman Wiley Nickel As the political landscape evolves, Rep. Wiley Nickel brings fresh perspective to the table, discussing tokenized markets and their potential to boost US innovation. Ep. 35: Congressman Shri Thanedar (D-MI-13) Rep. Shri Thanedar explores blockchain’s potential to create equity and opportunity, focusing on how technology can drive meaningful policy change. Ep. 36: Congresswoman Yadira Caraveo (D-CO-08) Colorado’s Congresswoman Yadira Caraveo examines the intersection of policy and technology in her state, emphasizing the potential for decentralized systems to support local economies. Ep. 40: Congressman Dusty Johnson (R-SD) Rep. Dusty Johnson offers a refreshing take on blockchain’s role in rural America, highlighting how innovation isn’t just for Silicon Valley. Ep. 42: Congressman Warren Davidson (R-OH-08) Rep. Warren Davidson doesn’t shy away from the big issues—self-custody, tokenization, and why market structure clarity is critical for the U.S. to reclaim its crypto leadership. A Growing Series, A Growing Dialogue As the Congress Series grows, so does the urgency of the topics at hand. Whether it's legislation like the FIT21 Act, the fight to protect self-custody, or debates on token taxonomy, these episodes are more than conversations—they’re a front-row seat to the policies that will define blockchain’s future in America. Cryptocurrency and blockchain technology are rapidly transforming the global economy. As these technologies become more widely adopted, governments are increasingly grappling with how to regulate them. Crypto policy is important because it will shape the future of the crypto industry and its impact on society. The United States is at the forefront of the global crypto policy debate. At Owl Explains, we’re proud to bring together voices from both sides of the aisle to discuss solutions, challenges, and the road ahead. The series is just getting started, and there’s so much more to come. Catch up on the Congress Series today and hear directly from the policymakers shaping the future of crypto, on Spotify, Apple Podcasts, or right here in our owl website.
A Huge Thank You to Our Incredible Sponsors - Avalanche Summit LATAM 2024
As we gear up for the Avalanche Summit LATAM 2024, we want to take a moment to express our deepest gratitude to the sponsors who have made this event possible. Their support empowers us to bring together the brightest minds in the blockchain, crypto, and Web3 space for meaningful discussions, collaborations, and innovation. We are thrilled to partner with these visionary companies and organizations, each playing a vital role in pushing the boundaries of what's possible in the Web3 world. Without further ado, we’d like to introduce our valued sponsors: Platinum Owl Sidley Austin LLP Golden Owls Cleary Gottlieb Steen & Hamilton Davis Polk & Wardwell Sher Tremonte Boreal Owls Fenwick Latham & Watkins Willkie Farr & Gallagher LLP Snowy Owl HJF Law Community Partner Global Blockchain Business Council Our sponsors are more than just logos on our website—they are leading law firms, trade associations, and innovators who share our passion for decentralization, transparency, and the transformative power of blockchain technology. What's on the Agenda? The Best of Buenos Aires! Imagine this: a summit filled with cutting-edge discussions, hands-on workshops, and networking opportunities with some of the brightest minds in blockchain, all set in the dynamic, bustling city of Buenos Aires. From exploring the iconic streets of San Telmo to the modern vibe of Puerto Madero, the Avalanche Summit is going to be an event that brings together innovation and the unique spirit of Argentina, Latin America, and beyond! 🇦🇷✨ And let’s not forget the local flair! From delicious Argentine cuisine (empanadas, anyone? 🥟) to the vibrant street art that colors the city, we’re blending tech with culture in a way only Buenos Aires can. To our sponsors—thank you for believing in this vision and helping us make it happen. Your support is turning this event into a groundbreaking moment for the Web3 community in LATAM. We can’t wait to see what we’ll achieve together! So, let’s give a big round of applause to these amazing partners and look forward to meeting up in Buenos Aires, where the future of blockchain is being written, one tango step at a time! 🎵 Get your tickets for 50% off using our code OWL50.
Custom Blockchains: Shaping a Bespoke Future
The inception of blockchain technology, heralded by Satoshi Nakamoto's whitepaper on Bitcoin, ignited a revolution whose full magnitude is only now coming to light. Yet, the true marvel doesn't lie solely in the foundational concept outlined in 2008; it resides in the ongoing evolution, fueled by brilliant minds since. Today, we stand on a new frontier: customization. Picture a world where launching a tailored blockchain, precisely attuned to your requirements, is not just a possibility but a reality. Custom blockchains represent an evolution from the original Satoshi blueprint; they embody vibrant ecosystems full of innovation. This newfound flexibility empowers users to design blockchains endowed with specific features and functionalities. The result? New applications and diverse use cases. Consider the foray of Sports Illustrated into blockchain technology, where sports fans securely purchase and trade verified tickets to their favorite events, all facilitated by a custom blockchain engineered for authenticity and transparency. This reality, where tickets unlock immersive experiences and collectibles, is not a distant dream but a tangible outcome crafted by forward-thinking enterprises. Similarly, Lemonade's* disruption in the insurance industry depicts the transformative potential of custom blockchains. Through their tailored solution, they've revolutionized weather insurance for small farmers, providing a seamless and transparent shield against unpredictable climate events. This paradigm shift underscores blockchain's role as a tangible force for positive change, far beyond mere rhetoric. The collaboration between Deloitte and FEMA** on disaster recovery reimbursement offers yet another glimpse into the power of custom blockchains. By leveraging blockchain technology, they've streamlined the reimbursement process, ensuring timely and transparent aid to those affected by disasters while simplifying audits. It's a compelling illustration of blockchain's capacity to enhance efficiency and accountability in critical domains. When it comes to loyalty programs and gaming, SK Global’s custom blockchain platform is at the vanguard of innovation. Their solution enables millions of South Korean telecom customers to use loyalty points across thousands of merchants, from real-world items to digital goods, with confidence in the authenticity and scarcity of their digital assets. This convergence of ecosystems and commerce, powered by blockchain technology, illuminates a path towards a more secure and transparent future for consumers and merchants alike. Even traditional financial institutions are embarking on the era of custom blockchains, with giants like Citi and JPM exploring the potential to trade traditional financial assets on custom platforms. This transition promises enhanced efficiency, transparency, and security in the financial landscape, marking a significant stride towards mainstream blockchain adoption. Whether revolutionizing real estate transactions, enhancing supply chain visibility, or reimagining loyalty programs, the space for innovation is extensive. What if we could tailor our digital ecosystems to align with our needs and aspirations? While some headlines may dwell on the volatility of cryptocurrencies, the true narrative lies in the transformative power of blockchain technology. We’re all about more hoot and less hype and recognize the capabilities of custom blockchains as canvases where creativity flourishes and ideas find their specific homes. It's time for Washington, and the world at large, to recognize custom blockchains as catalysts for innovation, efficiency, and inclusion across industries. *Lemonade's use case: *Lemonade's use case: **Deloitte and FEMA: **Deloitte and FEMA:
Proposed US Disclosure Guidelines for a Particular Category of Tokens
In the realm of blockchain, transparency is key, which is why The Proposed U.S. Disclosure Guidelines for a Particular Category of Tokens—revealed at the Sidley-Rutgers Fintech and Blockchain Symposium—signify a crucial step towards standardization in the blockchain industry. All feedback is welcome! Many trade associations are collaborating so you can provide feedback through them. Check out the full guidelines here.
Understanding and Classifying Blockchain Tokens
As seen in The International Journal of Blockchain Law (2024) by the GBBC.
What is a financial product?
Click the link below to download the PDF
OCC Symposium Explores Tokenization of Real-World Assets and Liabilities
In February 2024, the U.S. Office of the Comptroller of the Currency (OCC) hosted its Symposium on the Tokenization of Real-World Assets and Liabilities. The OCC is one of three prudential banking regulators in the United States, overseeing national banks and federal savings associations. Its role in ensuring the safety, soundness, and fairness of the banking system means it is imperative for the regulator to assess how the entities it supervises are planning to leverage distributed ledger technology (DLT) to provide new and enhance existing products and services. The tokenization of real-world assets and liabilities, such as commercial deposits, real estate, commodities, or art, involves converting the ownership rights of these assets and expressing them as digital tokens that can be traced on DLT. This process has the potential to revolutionize the way assets are bought, sold, and managed, offering increased liquidity, transparency, and accessibility. However, it also presents new regulatory queries, particularly in terms of ensuring compliance with existing financial regulations, safeguarding against money laundering and fraud, and protecting investor rights. As tokenization of real-world assets and liabilities becomes further integrated in the financial system, the OCC's role and regulations will likely influence how other regulatory bodies, both domestically and internationally, approach tokenized assets’ oversight. Importantly, and excitingly, many of the themes discussed during the event fall under the five branches of the Tree of Web3 Wisdom. The Tokenization Symposium began with remarks from Acting Comptroller Michael Hsu, where he defined tokenization as “process of digitally representing an asset’s liability, ownership, or both, on a programmable platform,” and called on event attendees to understand the technology. He set as the “north star” for the event, identifying problems and proposing solutions accordingly, as opposed to developing solutions in search of a problem. Panel 1: Legal Foundations for Digital Asset Tokens consisted of members of the Uniform Commercial Code (UCC) drafting committee and others who were supportive of the UCC, a comprehensive set of laws governing commercial transactions in the United States, including sales, leases, negotiable instruments, and secured transactions. The panel argued that amending the UCC to include digital assets benefits token holders because it provides statutory protection compared to enforcing rights through suing over contract rights, and this is particularly important in situations such as bankruptcy, where there is a legal process for asserting claims to recover funds. The panel discussed how the United States has the most advanced body of rules for commercial law, given efforts to amend the UCC to recognize use of DLT, as opposed to other jurisdictions where the common law is still developing. During the discussion, the panelists discussed how it is important to take into consideration the sensible classification of tokens, comparing the concept of tokenization to using paper as a medium for recording rights and liabilities. Panel 2: Academic Papers on Tokenization explored three academic papers: 1) how the acceptance and usage of digital payments leads to increased financial inclusion; 2) the use of payment stablecoins for real-time gross settlement; and 3) a study on the economics of NFTs. The panelists in their presentations discussed thinking globally with respect to how tokenization is occurring across the world and how it can facilitate cross-border payments and support financial inclusion objectives. Panel 3: Regulator Panel featured staff of the innovation offices from the OCC, Federal Reserve (the Fed), Federal Deposit Insurance Corporation (FDIC), Commodity Futures Trading Commission (CFTC), and the Securities and Exchange Commission (SEC). Each office discussed how they are seeing tokenization of real-world assets and how they interact with other aspects of DLT such as smart contracts. The regulators discussed opportunities for tokenization within the banking sector, such as tokenization of deposits, tokenized money market fund shares, and the benefits they can provide in areas such as correspondent banking, repo transactions, and post-trade processes. One area they flagged as an opportunity is increasing the accuracy of systems under the Bank Secrecy Act to monitor for money laundering, terrorist financing, and sanctions screening more efficiently. Interoperability is one challenge they are seeing with respect to tokenization. The panelists discussed throughout how regulation of digital assets should be context-appropriate. Panel 4: Tokenization Use Cases featured representatives from the Depository Trust & Clearing Corporation (DTCC), Mastercard, and the Massachusetts Institute of Technology (MIT). The panelists discussed exciting use cases that tokenization and DLT are enabling such as T+1 settlement and tokenization for private markets, multi-rail payments that support complex types of payments that enable increased coordination, reduce counterparty risk, and enable greater fraud controls. The panelists also touched on how policymakers and innovators should beware of misconceptions when assessing the various use cases. Some themes that echoed from previous panels included challenges around interoperability, developing solutions based on need, and carefully developing regulations based on the use cases. Panel 5: Risk Management and Control Considerations also explored various tokenization use cases and areas where tokenization can make a big difference, such as markets where capital is freed up and markets become more liquid. The panelists discussed the perspective regulators should use when approaching risk management and developing standards to minimize risk. They also discussed the role of intermediaries in tokenization and how industries have evolved and become more "dis-intermediated" over time. In their closing statements, the panelists called for regulators and policymakers to understand the technology and experiment more with it to better understand its implications. The Symposium ended with a keynote speech featuring Hyun Song Shin (Economic Advisor and Head of Research at the Bank for International Settlements) regarding how tokenization can help propel innovations in the monetary system similar to money and paper ledgers. He discussed various concepts involving tokenization such as improved delivery versus payment, central bank digital currency, the “singleness of money” with respect to tokenized deposits and stablecoins, and the "tokenisation continuum" that maps out different use cases ranging from wholesale payments to land registries. In conclusion, the OCC Symposium on the Tokenization of Real-World Assets and Liabilities underscored the need for careful consideration, collaboration, and continuous innovation. The diverse perspectives shared across legal foundations, academic research, regulatory insights, use cases, and risk management considerations have collectively woven a narrative of both promise and challenge. Moving forward, it is clear that embracing the digital evolution calls for a harmonious blend of regulatory adaptability, technological exploration, and a shared commitment to understanding the profound impact tokenization can have on the global financial ecosystem.
Why Fungible Crypto Assets Are NOT Securities
Why fungible crypto assets are not securities The speakers at our Owl Explains Hootenanny last week are co-authors of the most thorough analysis to date of the burning question of whether fungible crypto assets are - or are not - securities. (Spoiler alert – mostly they are not.) Lewis Cohen, Freeman Lewin and Sarah Chen from DLX law firm have analysed the US Securities Acts, the ‘Howey test’ on investment contracts (more on that below) and 266 pieces of case law where the Howey test was applied to different scenarios. The resulting paper is 180 pages long. But fear not! This owl has served up this pithy appetizer to whet your appetite for the full feast which you can find here. So what’s this all about? The flurry of Initial Coin Offerings (ICOs) a few years ago has led some regulators to conflate the token sales in an ICO and the crypto assets involved in them and seek to apply US securities laws to both. The authors of this paper do not dispute that the fundraising activity of an ICO – inviting investors to purchase crypto assets in a fledgling project with the hope of making a profit – might indeed involve an investment contract and that securities law would often apply. What they dispute is whether and when the crypto assets themselves qualify as ‘securities’ according to current laws and regulations. Just as oranges, chinchillas, whiskey barrels and stamps can form part of an investment contract but are not themselves securities, the same goes for crypto assets. (This owl particularly enjoyed the bit about how chinchillas are not securities – of course they aren’t – they’re lunch). They also challenge the notion that ‘once a security, always a security’ that continues to classify a crypto asset as a security well beyond the context of an ICO when the crypto asset may be performing all manner of other functions that do not involve an investment contract. So what should regulators do instead? The co-authors recommend that the status of a crypto asset can only be determined by first understanding the true nature of the crypto asset – and then by understanding and applying case law and legal scholarship on investment contract transactions. And that is exactly what the article does – exploring first the nature of crypto assets and then delving into case law and legal scholarship to explore when an investment contract does and does not exist. Why does this matter? It matters more than ever right now as policy makers and regulators, particularly in the US, are leaning towards deeming many, even all, crypto assets to be securities without going through this exercise of interrogating the nature of the asset and the transaction. And that matters because if all crypto assets are treated as securities even if they represent things that clearly are not – and even when they are clearly not part of an investment contract - regulators risk not only strangling with red tape the innovation and promise of Web3, but also causing confusion for all manner of items like the aforementioned chinchillas. So when is a crypto asset a security? A crypto asset is a security either by its very nature (e.g., a stock or bond on blockchain). When it is part of an investment contract according to the Howey Test, well, the crypto asset is not a security but the investment contract is. Clearly crypto assets cannot be assumed to be securities by their very nature – because a crypto asset can represent literally anything at all. They may occasionally be – but equally (and more often) they may not be. So where the asset is not a security by nature, we have to assess whether they might be part of an investment contract as defined by the Howey Test. Still not a security, but the subject of an investment contract. So what is the Howey Test? The Howey test says that an investment contract transaction exists when a “contract, transaction or scheme” involves an investment of money in a common enterprise with an expectation of profits to come solely from the efforts of the promoter or a third party. So the Howey test defines correctly that fundraising by selling crypto assets as part of an ICO might be an investment contract that the securities laws apply to. And while crypto assets are part of that investment contract, they are not themselves securities. But what happens when the fundraise is complete and the crypto assets are being used for other purposes where Howey tells us clearly there is no investment contract? An example could be when they are merely validated, delegated or staked. Or when they are performing as a utility token intrinsic to the functioning of a blockchain. The article does not shy away from the complexity of all this. In fact it opens with a quote from Homer’s The Odyssey where the old man of the sea changes himself ‘first into a lion with a great mane, then all of a sudden he became a dragon, a leopard, a wild boar; the next moment he was running water and then again directly he was a tree’ Why? Because crypto assets can also shape shift in that different circumstances can affect whether a crypto asset should be treated as a security or not. With this mercurial nature then, regulators and practitioners need to consider each and every transaction and activity concerning a crypto asset on a case by case basis to determine whether there is a security or not. But this isn’t always possible because the information needed to make that assessment is private. So what is the solution? A new law and more engagement from and between the SEC, FTC, CFTC, Department for Justice and state attorneys general. So you mean regulation? Yes. Fundamentally the co-authors call for regulation based on the kind of thorough understanding and legal analysis of crypto assets that this paper provides. Other resources Our wise owl Lee Schneider has written a few essays that talk about these issues and are available here and here.
Think Global, Think Market Integrity
Branch 5 of the Tree of Web3 Wisdom suggests that regulators from different jurisdictions embrace certain first principles when thinking about blockchain, tokenization, and cryptoassets. Market integrity is one such core area for regulation. The topic seems especially ripe in light of the many events in the last ten months that led to disarray in both traditional and cryptoasset markets. Gibraltar prophetically implemented its market integrity principle last spring. Perhaps more people should have paid attention. In April 2022, the Gibraltar Financial Services Commission (GFSC) issued the tenth of its regulatory principles for DLT Providers, laying out market integrity requirements. Principle no. 10 obliges a DLT Provider to conduct itself in a manner that "maintains or enhances the integrity of any markets in which it participates." The concept of market integrity is not always easy to pin down so the related GFSC guidance note sets forth the operational, technical, and organizational standards that DLT Providers are expected to meet and provides examples of good practices for implementing and complying with the market integrity regulatory principle. The Guidance Note states: "Market integrity is essential to the fair, orderly and efficient functioning of a given market as well as of the overall marketplace more generally. It encompasses a number of key responsibilities, such as monitoring for manipulative trading and other forms of market abuse, and fostering non-discriminatory market access, transparency in price formation, fair trading practices, high disclosure standards and robust consumer protection." The GFSC guidance highlights four categories of issues as important to market integrity: market manipulation, insider trading, disclosures, and trading standards. In each case, the Guidance Note gives examples and recommendations for best practices associated with them. For example, DLT providers should make disclosures regarding the markets in which they operate, the assets they trade, and other activities they conduct in those markets, to create and maintain an appropriate level of transparency. For trading standards, they should provide accurate and prompt market data to all stakeholders, such as information about bids, offers and last prices, and any other data relevant to achieving fairness and transparency; put measures in place to prevent preferential treatment for any subset of participants when placing or executing orders; and evaluate the execution quality of trades that take place within the markets that it operates and comparing it to industry best practice. For market manipulation and insider trading, DLT Providers should implement policies and procedures to root out and prevent such activities. At the same time, the GFSC acknowledges the need for some flexibility, stating that each DLT Provider’s responsibilities will depend on the nature of its business and its role and participation in a given market and in the virtual asset marketplace overall. It also acknowledges that flexibility is needed to address the different features and functions of virtual assets and the manner in which they trade. This Owl applauds the GFSC’s approach: to create a clear principle with clear guidance on how to implement it without being too prescriptive. This flexibility works because it can accommodate the variety of roles and operational features of market participants relevant to a DLT Provider’s business. This is music to this Owl’s ears and chimes perfectly with our Tree of Wisdom – specifically branch 3 (classify tokens sensibly) and branch 4 (enact context appropriate regulation). The 5th branch of our Tree of Wisdom is "think global." Our hope is that Gibraltar’s approach can serve as a template for authorities in other jurisdictions. Global market integrity must be a first principle for long term growth and maturation of the cryptoassets ecosystem, as well as in more traditional markets. We encourage a constructive interchange between industry and regulators to inform the development and implementation of market integrity rules. Just like Gibraltar did.
Blockchain Analysis & Investigations
What is it really? It's the process of inspecting, identifying, clustering, modeling and visually representing data on a blockchain. Blockchain analytics can involve the use of software tools and open source information (OSINT) to analyze data on blockchain networks. These tools scrutinize transaction patterns, wallet addresses, and other data points on a blockchain to provide insights into the activities occurring on the network. Blockchain analysis is done for a variety of reasons from market analysis to investigating illicit activity. Blockchain investigations are commonly conducted to uncover illicit activities such as money laundering, fraud, and the use of cryptocurrency in criminal enterprises. Investigations leverage analytics tools to track and identify this activity on-chain. The transparent nature of the blockchain allows for investigators to follow the flow of funds on the public ledger. How it Works: Data Aggregation: collecting, compiling and summarizing information from various sources across blockchain networks Pattern Recognition: identifying and interpreting behaviors and trends within the aggregated data Forensic Analysis: systematically interpreting the aggregated data and recognized patterns to come to investigative conclusions Purposes (not an exhaustive list): AML compliance and regulatory reporting Fraud detection Security analysis Market analysis Enhance security and trust in blockchain networks Aiding law enforcement to catch 'bad actors'
How Should We Regulate Crypto/Web3 Cybersecurity?
Cybersecurity is all about the financial incentives. Getting cybersecurity regulation right means using the threat of regulatory fines to align financial incentives so that companies do the right thing. Compared to most existing cybersecurity regulations, however, the financial incentives in cryptocurrency/Web3 are very different. Most existing cybersecurity regulations aim to improve the security of consumer PII and personal information that companies hold. Because the theft (more accurately: copying) of consumer PII by hackers during a data breach does not result in an immediate financial impact to a company's bottom line, companies have historically paid less attention to cybersecurity than they should. Since the free market financial incentives for companies to secure consumer data are poor, regulators have naturally stepped in with a regulatory stick (where the free market carrot has failed). The financial incentives in crypto, however, are very different. With crypto, if you are hacked and your crypto is stolen, you've lost your own assets. That's a huge incentive to do cybersecurity properly. Here are five major takeaways that regulators should consider: For companies self-custodying their own crypto, financial incentives are already 100% aligned. If Company X holds $1 million in cryptocurrency, and a hacker steals it, the company just suffers an immediate financial loss of $1 million. Regulatory fines would not offer any greater financial incentives for Company X to do the right thing. For companies that hold someone else's crypto assets, the financial incentives are not quite so aligned. If a company custodies $100 million, only $1 million of which is their own, and a hacker steals all $100 million, then the company will simply declare bankruptcy and leave their debtors with nothing. An example might be a centralized crypto exchange, or a DeFi service built on top of a smart contract. In these kinds of situations it might be appropriate for regulators to require minimum security controls to protect users. Getting cybersecurity regulations right is hard. The result of cybersecurity regulations in other areas (such as consumer PII or PHI) has been that companies will do the bare minimum to satisfy cybersecurity regulations, and no more. Finding the right balance between creating regulatory financial incentives without unduly stifling innovation becomes a difficult balancing act. Hackers don't care about regulatory compliance. Cyber defenders have to be right every single time, and attackers only have to be right once. Unlike environmental protection regulation, where accidental oil spills or illegal toxic waste dumping is the primary concern, in cybersecurity we are worried about malicious third parties acting outside the reach of the law in countries like North Korea or Russia. There is frequently no legal recourse in the event of a crypto hack. Crypto startups need to front-load security spending. In most startups, the biggest risk is going out of business, not cybersecurity risk. As a result, startups tend to run very insecure for a couple of years until they are financially successful enough to go back and fix things (so-called "tech debt"). However, this approach does not work in the crypto space, where hackers frequently prey on lean, insecure startups that enjoy overnight financial success. Forcing crypto startups to frontload security expenditure from the beginning could be a key lever of effective regulation. Cybersecurity risk in the crypto/Web3 space is high... ... higher than in most other verticals, because we're not talking about the security of information, but about real, fungible, and non-reversible financial assets. The stakes are high and companies in the crypto space take security seriously. Financial incentives to do security properly align much more closely in the crypto space than in almost any other vertical. The alignment is not 100% perfect, but it is close enough that regulators should take a "light touch" approach to crypto cybersecurity regulation.