James Cirrone

Crypto wallets are becoming an even bigger entry point for new users than centralized exchanges.&nbsp;



That’s according to Phantom co-Founder and CEO Brandon Millman who spoke Monday at the Permissionless conference in Austin, Texas.



And that’s why the phrase that anyone who’s been paying attention to crypto for half a minute has come across — “how do we onboard the next billion users” — is fundamentally flawed in Millman’s view.



“The space really needs to focus on…retention of users, and not actually trying to onboard all these net new users,” Millman said. “It doesn&#8217;t matter if you onboard a billion users if your retention is zero, because then you end up with no users.”



Having good security in place is the first step toward getting people to stick around. That’s because if they fall victim to a phishing scheme, it makes it dramatically less likely for them to persist in crypto.



However, the assembled panelists seemed eager to move away from seed phrases, a security measure that’s so rigid it can lock the end user out of their account.&nbsp;



Look no further than <a href="https://www.nytimes.com/2021/01/12/technology/bitcoin-passwords-wallets-fortunes.html">Stefan Thomas</a>, a programmer who has hundreds of millions of dollars worth of bitcoin trapped in a wallet to which he lost the password.



Braavos co-founder and CEO Motty Lavie went as far as to say that seed phrases are “almost the root of all evil.”



Braavos, a smart contract wallet, uses two-factor authentication, biometric authentication and a seed phrase, widening the ways users can access their assets. This, essentially, is a form of account abstraction, which can allow users to recover their funds in the event of losing their seed phrase.&nbsp;



A subsequent panel weighed the evolution of account abstraction and its benefits —&nbsp;chief among them being gasless payments.&nbsp;



Stackup co-founder and CEO John Rising described gas payments as a “huge barrier of entry that has now been knocked down by smart accounts” and paymasters.



“A paymaster is an entity that exists on-chain that can basically sponsor transactions for people. So if you have a marketplace, and you want creators to publish things to your marketplace, you can effectively pay for gas for that,” Rising said.



Still, even if account abstraction became the norm, panelists said crypto wallets would need to evolve to handle customer issues in a more standard manner.&nbsp;



As Lavie put it, people will inevitably make mistakes. They’ll click on links they shouldn’t click on and they’ll transfer funds they shouldn’t have transferred. 



Read more: <a href="https://blockworks.co/news/researcher-security-crypto-wallets">Researchers flag security concern for users of certain crypto wallets</a>



Millman and fellow panelist Jason Lau, OKX’s chief innovation officer, emphasized that providing customer support through standard, time-tested systems is the way to go.&nbsp;



“For some reason, crypto and Web3 don’t really take much inspiration from all of the customer support techniques that have been developed over many decades on Web2 and instead opt for sending people into a Discord channel,” Millman said.&nbsp;



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Wallet providers emphasize security as top hurdle to overcome

Sebastian Sinclair

Wallet service provider Phantom said Monday it has introduced a new feature allowing applications to authenticate users using a Solana address.



The introduction of Sign In With Solana (SIWS) is intended to improve the user experience and security by streamlining the traditional &#8220;connect&#8221; and &#8220;signMessage&#8221; flow into a single-click &#8220;signIn&#8221; method.



Traditionally, the connect function enables a user&#8217;s digital wallet to interact with an application, while “signMessage” allows the user to cryptographically verify their identity.



The message lacks human-readable information, which can sometimes lead to new and seasoned users agreeing to malicious prompts. 



Even in cases when connecting a wallet to trusted applications, unexpected pop-up signatures can often confuse or frighten new users, Phantom said in a <a href="https://phantom.app/learn/developers/sign-in-with-solana">statement</a>. This, in turn, can often be a major hurdle for new entrants, it said.



The one-click sign-in method, available as of Phantom version 23.11, allows Solana developers to prompt users to connect and sign a standardized authentication message and prove ownership of their addresses.



Designed as a drop-in replacement for the previous two-step authentication flow, the sign-in method also provides developers with a robust API for creating standardized authentication messages, Phantom said.



The responsibility for message construction shifts from applications to the wallet, allowing Phantom to scrutinize elements such as the site&#8217;s domain or the time of message issuance to ensure legitimacy.



It is unclear whether there could be fresh privacy concerns associated with the shift of responsibility in message construction. Blockworks has reached out to Phantom for comment.



In some instances, that construction may help slow or hinder the progress of malicious actors. That could help prevent instances like <a href="https://blockworks.co/news/solana-based-wallet-users-drained-in-suspected-exploit">last year’s breach</a>, when a coding error allowed hackers to easily find and use client passwords, leading to a breach in both Slope and Phantom wallets.



Private keys associated with the impacted wallets were either leaked or compromised, and these keys were then utilized to authorize fraudulent transactions, according to <a href="https://discover.luno.com/what-exactly-happened-in-the-slope-finance-hack/">reports</a> at the time.



The sign-in feature released on Monday makes authentication more consistent and allows Phantom to check for suspicious activity, its developers said.



Ethereum dapps similarly can facilitate a “sign in with Ethereum” feature using <a href="https://blockworks.co/tag/ethereum-name-service">Ethereum Name Service</a> (ENS), as part of a push for <a href="https://blockworks.co/news/what-is-decentralized-identity">decentralized identity services</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Phantom materializes ‘sign in with Solana’ wallet authentication

Bessie Liu

<div id="highlights-block_62aa2d415a283" class="highlights">
 <ul>
 <li>The discovered vulnerability exposes browser wallet users’ secret recovery phrases</li>
 <li>Affected wallet providers were contacted, and the vulnerability was kept confidential until the security issues were remediated</li>
 </ul>
 
</div>



A number of popular browser-based crypto wallets are vulnerable to hacking under certain conditions, according to new research. 



Blockchain security firm Halborn found several instances where wallets including Brave, MetaMask and Phantom can be compromised under specific computer conditions — adding yet another wrinkle to traders still reeling from recent high-profile decentralized finance (DeFi) hacks.&nbsp;



The conditions can expose a crypto wallet user’s secret recovery phrase (a series of words generated that gives the owner access to their crypto), which can then be used to change their private key. All told, billions of dollars of digital assets are stored in software wallets.&nbsp;



Affected wallet providers were contacted and the vulnerability was kept under wraps until the security issues were remediated.



<h3 class="wp-block-heading">Who is affected? </h3>



Users who meet the following conditions may be at risk:



<ul><li>Users who have unencrypted hard drives</li><li>Users who have previously imported their secret recovery phrase into a web extension on a device that is in the possession of someone else or have had their computer compromised</li><li>Users who have used the “show secret recovery phrase” checkbox to view their secret recovery phrase on-screen during the import process</li></ul>



Cryptocurrency wallets like the ones impacted by this vulnerability, such as Metamask, are a self-custody wallet — meaning users alone are responsible for safeguarding their private keys. 



“Exchanges like Coinbase or Binance usually hold custody of those keys on the behalf of their customers,” Steven Walbroehl, Halborn’s chief security officer and co-founder, told Blockworks.



“This impact is only for those that self-custody those assets, and it is the users&#8217; responsibility to take it seriously, upgrade the wallets to the patched version listed on the wallet developer&#8217;s websites, and to rotate their mnemonic phrase if they think it may be at risk,” Walbroehl said.&nbsp;



MetaMask has <a href="https://medium.com/metamask/security-notice-extension-disk-encryption-issue-d437d4250863" target="_blank" rel="noreferrer noopener">asked</a> users to update their extension versions to 10.11.3 and later and to “take the time to enable full disk encryption on computers.”



Echoing Walbroehl, Dan Finlay, founder and group manager at MetaMask <a href="https://medium.com/metamask/security-notice-extension-disk-encryption-issue-d437d4250863" target="_blank" rel="noreferrer noopener">wrote in a blog post</a> that users should “remember that it’s your responsibility to keep your computer secure. No wallet or software can keep itself safe if the system it runs on is compromised. Take time to learn how to avoid installing a virus on your computer.” 



Phantom, meanwhile, wrote in a <a href="https://phantom.app/blog/demonic-vulnerability" target="_blank" rel="noreferrer noopener">blog post</a> that to protect themselves on Web3, on top of general internet safety measures, users should diversify their wallets to minimize risk and use hardware wallets to store large amounts of assets and currencies.



“Other mitigations include storing the mnemonic phrase/key on a hardware-based wallet like Trezor or Ledger. These wallets still work with software wallets like Metamask when physically connected via a USB cable&#8230;but it protects the keys from attackers that may access your disk,” Walbroehl said.



Halborn has been rewarded $50,000. The wallet providers did not immediately return requests for comment.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Start your day with top crypto insights from David Canellis and Katherine Ross. <a href="https://blockworks.co/newsletter/empire">Subscribe to the Empire newsletter</a>.

Security Threat Exposed for Browser-based Crypto Wallets

Sam Reynolds

<div id="highlights-block_612e77f34b15b" class="highlights">
 <ul>
 <li>MetaMask says it has grown by 19x since July 2020</li>
 <li>Other non-custodial wallets like Phantom have also seen similar exponential growth as more users explore DeFi as an investment alternative</li>
 </ul>
 
</div>



As the total value locked in decentralized finance (DeFi) comes close to the <a href="https://defipulse.com/" target="_blank" rel="noreferrer noopener">$90 billion</a> mark, MetaMask, the most popular wallet used by traders in the DeFi ecosystem, has reported that it has passed the 10 million mark of monthly active users, up from just over 500,000 a year ago.&nbsp;



“MetaMask defined a new kind of cryptocurrency wallet, where users don&#8217;t just interact with currencies, but with decentralized applications, and we are constantly making these new kinds of applications more safe and accessible to a broader audience,” said Dan Finlay, MetaMask Co-Founder. “We&#8217;re letting users explore new ways of establishing trust on the internet.”



Part of the appeal of MetaMask is that it functions as a browser add-on, allowing integration with DeFi protocols and dApps on the web. Furthermore, with MetaMask, users are always in control of their assets. Their keys are always under their control on their PC, so a situation like what happened with QuadrigaCX — where the <a href="https://www.investmentexecutive.com/news/industry-news/not-your-keys-not-your-coins-lessons-from-quadrigacx-fraud/" target="_blank" rel="noreferrer noopener">founder absconded with the keys</a> and thus the assets of the exchange — can’t happen.&nbsp;



Given <a href="https://cms.blockworks.co/why-asia-is-becoming-the-natural-home-of-decentralized-finance/" target="_blank" rel="noreferrer noopener">DeFi’s appeal in Asia</a>, MetaMask reported that Asia is the number one region in terms of users’ growth, followed by Europe and North America. Within Asia, the Philippines, Vietnam, China, India, Indonesia and Thailand led for the number of downloads and active users. MetaMask’s growth story is shared by other wallets in the industry.



Speaking to Blockworks, the CEO of Phantom, a non-custodial wallet startup, said that their platform is about to break 100,000 MAUs. Since its launch four months ago it has already gotten to a point where there are already 1 million transactions a month though through the wallet. 



“There’s two predominant umbrellas: DeFi and NFTs, which have exploded over the past year and a half or so. There’s no sign of slowing down as long as people are discovering these apps and becoming comfortable with them,” Brandon Millman, CEO of Phantom, told Blockworks. “These applications are going to become more and more popular and there will be more of them and the wallet is a window into all of them.”



Millman believes that the only thing holding back further adoption of DeFi and NFTs are expensive gas fees — something that<a href="https://cms.blockworks.co/ethereums-role-in-a-multi-chain-future/" target="_blank" rel="noreferrer noopener"> many new blockchain protocols</a> are trying to solve.



“NFTs are just getting started&#8230;Even within the US there’s a huge number of people who don’t interact with them at all because they’re so expensive, but despite that, you&#8217;re still seeing a lot of growth,” he told Blockworks. “With the advent of blockchain tech that’s faster and cheaper, you’ll see more and more people buying NFTs and trading them. From a consumer perspective, it has a lot of room to grow from the NFT trader and publisher perspective.”



But non custodial wallets aren’t for everyone.



Some investors would not feel comfortable having their millions tied to a browser plugin. This isn’t a bad thing per se, rather it shows the strength of retail interest in DeFi.&nbsp;



Eric Ervin, CEO of Blockforce Capital, added that he’s seeing “incredible demand” from investors looking to get exposure to DeFi, so much so that his company has put together a fund with DeFi ecosystem Vesper Finance to give users that don’t want to install wallets and prefer to get exposure via a more traditional fund subscription, a chance to get exposure to DeFi.&nbsp;



“We believe this will act as an onramp to significant adoption from investors who have yet to approach – and benefit from – the decentralized ecosystem,&#8221; he said.



At this time, MetaMask doesn’t have a token like that Binance or FTX has, but is willing to explore one should there be a &#8220;compelling use case&#8221; for it. These tokens, like BNB or FTX, are utility tokens but are also used by investors as a proxy for a public listing.



Want more investor-focused content on digital assets?&nbsp;<a target="_blank" href="https://cms.blockworks.co/events/digital-asset-summit-2021-2/" rel="noreferrer noopener">Join us</a>&nbsp;September 13th and 14th for the Digital Asset Summit (DAS) in NYC. Use code ARTICLE for $75 off your ticket.&nbsp;<a target="_blank" href="https://cms.blockworks.co/events/digital-asset-summit-2021-2/" rel="noreferrer noopener">Buy it now</a>.