Ben Strack

Users of Robinhood’s self-custody Web3 wallet can now use the Bitcoin and Dogecoin networks to custody, send and receive crypto, the investing platform revealed Wednesday.



The company <a href="https://blockworks.co/news/robinhood-beta-tests-new-web3-wallet-with-polygon-as-first-blockchain">first rolled out the wallet</a> for select iOS customers in September 2022 — noting at the time that Robinhood Wallet would use Polygon as its first blockchain. The offering went live on iOS devices across 130 companies in March.&nbsp;



In those six months since, Robinhood has “heard loud and clear that people want access to more coins on more chains,” the company said in a Wednesday <a href="https://newsroom.aboutrobinhood.com/robinhood-wallet-adds-support-for-bitcoin-and-dogecoin-and-enables-ethereum-swaps/">blog</a> post.&nbsp;



After launching Robinhood Wallet with custody, send and receive support for Polygon and Ethereum, it added support on layer-2s Arbitrum and Optimism, before the Wednesday unveiling of Bitcoin and Dogecoin.



In addition to adding bitcoin and dogecoin network support for all users, <a href="https://blockworks.co/tag/robinhood">Robinhood</a> is enabling in-app swaps on the <a href="https://blockworks.co/tag/ethereum">Ethereum</a> network. These are available to select users for more than 200 tokens starting Wednesday. The platform said it will make them available to everyone in the coming weeks.



Previously, users of Robinhood’s wallet could only swap crypto on the <a href="https://blockworks.co/tag/polygon">Polygon</a> network via decentralized exchange aggregator 0x API.&nbsp;&nbsp;



Robinhood Wallet users are able to swap without holding ether (<a href="https://blockworks.co/price/eth">ETH</a>), as network fees are automatically deducted from the tokens they already hold, the company said.



“With Robinhood Wallet we stripped away many of the complexities of DeFi and the broader Web3 ecosystem, and reduced some of the challenges and barriers to entry for everyday people,” Johann Kerbrat, general manager of Robinhood Crypto, said in a statement.&nbsp;



The product expansion comes after the company launched Robinhood Connect in April — a way for certain US users to buy and transfer crypto to and from their Web3 wallet.&nbsp;



The company said in the Wednesday blog post it is “actively working to broaden access to other low-cost, fast and secure [layer-2] chains that users have asked for.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Robinhood extends Web3 wallet support to bitcoin, dogecoin

James Cirrone

DeFi security provider Webacy announced it would integrate with Arbitrum last week. This will grant Arbitrum’s nearly 12 million distinct addresses access to Webacy’s “wallet watch” tool.&nbsp;



This tool, which founder and CEO Maika Isogawa says is the company’s most popular, gives users real time notifications through SMS or email for things like inbound and outbound transactions, approvals, trades and airdrops.



Keeping up with everything going on in one’s crypto wallet can be a challenging prospect, Isogawa told Blockworks. Improving self custodial wallets is a key reason why she and her team introduced Webacy a little over two years ago.&nbsp;



“One of the biggest things in the space right now that is preventing people from coming is safety and lack of education,” Isogawa said. “We build tools that don&#8217;t exist in the self custody space to help keep you safe. Things like monitoring, things like understanding risk, things like taking action if something does go wrong.”



Webacy is a non-custodial security suite that integrates with a user’s chosen wallet, such as <a href="https://blockworks.co/tag/metamask">Metamask</a>, Coinbase Wallet, and others of a similar product type.



She further clarified that Webacy doesn’t touch customers’ keys nor has access to people’s wallets. Rather, Webacy gives clients the tools to safeguard their wallet on their own.



And while Webacy’s services are not offered natively through any of the crypto wallets themselves, that’s something Isogawa aspires to get done at some point in the future.&nbsp;



For now, Webacy’s three layer suite of protection is available through desktop or a mobile browser. There are another two layers besides monitoring. 



One is the ability to assess the level of risk present in one’s wallet. All a user has to do is input their wallet address or even an address of a friend or colleague that they’re aware of, and Webacy will spit out what’s called a “risk score.”



On the risk dashboard, Isogawa explained that questionable transactions will be flagged, making it clear who to steer clear from.&nbsp;



But making an assessment of risk really isn’t enough to protect a user if their wallet is compromised. The panic button is Webacy’s last-ditch means to wall off assets a user thinks could be or could soon be under control by a malicious third party.



It works like this, according to <a href="https://webacy.gitbook.io/webacy-docs/product-guides/backup-wallet">Webacy’s docs</a>: a user deploys a smart contract with pre-approvals, determining which assets in their wallet will be ported over to a backup wallet under certain conditions, such as loss of access or in the event of suspicious activity. With Webacy&#8217;s notification system, the users would be notified of anything fishy and could simply press the panic button in an attempt to secure their coins. Through smart contracts, the user’s assets would be immediately transferred to the other wallet, so long as the suspicious transaction has not yet been confirmed.



Isogawa said that users have told her that they’ve hit the panic button to save themselves from a “dumb” trade or just to be safe after accidentally clicking a phishing link.



Similar to the panic button, Webacy’s crypto will — as in the <a href="https://blockworks.co/tag/web3">Web3</a> version of a real-life document willing your assets to your chosen beneficiaries after your death — operates through smart contracts. 



And once the proverbial dead man switch is flipped, your crypto will be transferred to whichever wallet or collection of wallets was specified on your will.&nbsp;



Isogawa’s final takeaway was that people are after convenience, something self custodial wallets aren’t yet known for.&nbsp;



She wants to merge convenience with safety, adding that she wants to follow in the footsteps of NortonLifeLock, a consumer security company that booked $3.3 billion in revenue last year.



“I think that there&#8217;s room for a safety company to dominate Web3 and crypto, and I think we&#8217;re up there,” Isogawa said.&nbsp;



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Webacy looks to make DeFi and self custody safer with Arbitrum integration

Spot cryptocurrency and derivatives exchange OKX is bolstering its efforts around transparency in a bid to reinforce trust from existing customers — and in a play to win over potential new traders — following the crash of rival FTX, which took the opposite approach.&nbsp;&nbsp;



The Seychelles company has rolled out a proof-of-reserves page on its website that shows its latest collateralization ratios, as well as a self-audit tool intended to verify assets are backed on a one-to-one basis, known as <a href="https://blockworks.co/news/what-are-proof-of-reserves-and-can-they-build-back-trust" target="_blank" rel="noreferrer noopener">proof of reserves</a>.



The concept, designed to act as a safeguard for client funds that becomes even more relevant in the event of another pronounced downturn and ensuing spate of withdrawals, is gaining traction. FTX’s <a href="https://blockworks.co/news/ftx-auditor-proof-of-reserves" target="_blank" rel="noreferrer noopener">auditor</a> and Binance have both pushed for the setup to become an industry standard.&nbsp;



OKX, meanwhile, is rolling out what it calls an independent custodial wallet designed to enable institutional clients to secure their assets separately from its reserves.&nbsp;



The wallet, set to launch in coming weeks, is designed as a real-time tracker for wallet balances and safeguard the private keys of customers in a custodial model.&nbsp;



Ripple effects have continued, largely unabated, following the liquidity crunch that essentially forced FTX <a href="https://blockworks.co/news/whats-next-for-ftx-and-its-customers-after-bankruptcy-filing/" target="_blank" rel="noreferrer noopener">to declare bankruptcy</a>. Lawyers for FTX and its affiliates said in a <a href="https://pacer-documents.s3.amazonaws.com/33/188450/042120644082.pdf" target="_blank" rel="noreferrer noopener">motion</a> that as many as <a href="https://blockworks.co/news/ftx-doom-draws-dozens-of-federal-state-international-agencies" target="_blank" rel="noreferrer noopener">one million creditors could be affected</a>.



Lennix Lai, OKX’s financial markets director, told Blockworks that while the crypto exchange had no direct exposure to FTX, customers are reeling and want to know what firms — especially exchanges and custodians — are doing about their unease.



“That’s why we’re in the process of a third-party audit to publish our <a href="https://www.investopedia.com/terms/m/merkle-tree.asp" target="_blank" rel="noreferrer noopener">Merkle Tree </a>proof-of-reserves, and we’ve shared 23 of our BTC addresses and 13 ERC20 addresses <a href="https://twitter.com/okx/status/1590812545346330624" target="_blank" rel="noreferrer noopener">publicly</a> to verify a portion of our reserves,” he said.&nbsp;



Added Lai: “Our new proof of reserves [and self-audit features] give users the ability to self-verify that their assets are 100% backed. But the third-party audit will provide additional reassurance.”



It is unclear just how effective so-called “<a href="https://blockworks.co/news/what-are-proof-of-reserves-and-can-they-build-back-trust" target="_blank" rel="noreferrer noopener">proof of reserves</a>” dashboards from OKX and others, like Crypto.com, will be in <a href="https://blockworks.co/news/crypto-exchange-proof-of-reserves-not-calming-investor-fears" target="_blank" rel="noreferrer noopener">calming investor fears</a>.&nbsp;



“As this crisis has made apparent, centralized intermediaries of financial transactions are opaque and often untrustworthy,” executives at crypto-focused asset managerPantera Capital wrote in a Nov. 11 letter to clients.. “Nothing could have made more obvious the need for decentralized, trustless protocols that allow users to trade, hold, and transfer their assets without relying on entities like FTX, Celsius or Voyager.”



Crypto storage wallet Arculus said it has seen a sales boost amid the recent heightened volatility, but declined to comment on specific sales. And digital assets access provider Wellfield Capital said last week it expects its revenue to rise, as the market shifts away from centralized exchanges — toward decentralized services and self-custody.



“Going forward, OKX will continue to do whatever we can to demonstrate our solvency and stability, while continuing to safeguard our users’ data,&#8221; Lai said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.

Crypto Exchange OKX Has A Plan to Assuage Traders’ Fears: Transparency

Bessie Liu

<div id="highlights-block_62aa2d415a283" class="highlights">
 <ul>
 <li>The discovered vulnerability exposes browser wallet users’ secret recovery phrases</li>
 <li>Affected wallet providers were contacted, and the vulnerability was kept confidential until the security issues were remediated</li>
 </ul>
 
</div>



A number of popular browser-based crypto wallets are vulnerable to hacking under certain conditions, according to new research. 



Blockchain security firm Halborn found several instances where wallets including Brave, MetaMask and Phantom can be compromised under specific computer conditions — adding yet another wrinkle to traders still reeling from recent high-profile decentralized finance (DeFi) hacks.&nbsp;



The conditions can expose a crypto wallet user’s secret recovery phrase (a series of words generated that gives the owner access to their crypto), which can then be used to change their private key. All told, billions of dollars of digital assets are stored in software wallets.&nbsp;



Affected wallet providers were contacted and the vulnerability was kept under wraps until the security issues were remediated.



<h3 class="wp-block-heading">Who is affected? </h3>



Users who meet the following conditions may be at risk:



<ul><li>Users who have unencrypted hard drives</li><li>Users who have previously imported their secret recovery phrase into a web extension on a device that is in the possession of someone else or have had their computer compromised</li><li>Users who have used the “show secret recovery phrase” checkbox to view their secret recovery phrase on-screen during the import process</li></ul>



Cryptocurrency wallets like the ones impacted by this vulnerability, such as Metamask, are a self-custody wallet — meaning users alone are responsible for safeguarding their private keys. 



“Exchanges like Coinbase or Binance usually hold custody of those keys on the behalf of their customers,” Steven Walbroehl, Halborn’s chief security officer and co-founder, told Blockworks.



“This impact is only for those that self-custody those assets, and it is the users&#8217; responsibility to take it seriously, upgrade the wallets to the patched version listed on the wallet developer&#8217;s websites, and to rotate their mnemonic phrase if they think it may be at risk,” Walbroehl said.&nbsp;



MetaMask has <a href="https://medium.com/metamask/security-notice-extension-disk-encryption-issue-d437d4250863" target="_blank" rel="noreferrer noopener">asked</a> users to update their extension versions to 10.11.3 and later and to “take the time to enable full disk encryption on computers.”



Echoing Walbroehl, Dan Finlay, founder and group manager at MetaMask <a href="https://medium.com/metamask/security-notice-extension-disk-encryption-issue-d437d4250863" target="_blank" rel="noreferrer noopener">wrote in a blog post</a> that users should “remember that it’s your responsibility to keep your computer secure. No wallet or software can keep itself safe if the system it runs on is compromised. Take time to learn how to avoid installing a virus on your computer.” 



Phantom, meanwhile, wrote in a <a href="https://phantom.app/blog/demonic-vulnerability" target="_blank" rel="noreferrer noopener">blog post</a> that to protect themselves on Web3, on top of general internet safety measures, users should diversify their wallets to minimize risk and use hardware wallets to store large amounts of assets and currencies.



“Other mitigations include storing the mnemonic phrase/key on a hardware-based wallet like Trezor or Ledger. These wallets still work with software wallets like Metamask when physically connected via a USB cable&#8230;but it protects the keys from attackers that may access your disk,” Walbroehl said.



Halborn has been rewarded $50,000. The wallet providers did not immediately return requests for comment.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Don’t miss the next big story – join our <a href="https://blockworks.co/newsletter?source=end" target="_blank" rel="noreferrer noopener">free daily newsletter</a>.