Kasper Luyckx

Head EMEA and Financial Institutions @ Ledger Enterprise. Securing onchain assets for institutions. Your keys, your independence. Sunny days = coffee rides.

[Kasper Luyckx @CryptoKasp]

In January, @drakefjustin wrote that @ethereumfndn management had officially declared post quantum security a top strategic priority. The Foundation later set a 2029 planning target for full L1 post quantum security. In my experience it takes 12 to 18 months from RFP to a custody stack in production, so the stack chosen today has to still work after that switch.

Custody has to deal with hash based signatures such as leanXMSS, an awkward fit for MPC because each hash step is computed jointly and stateful variants must stay in sync. Coinbase, which runs MPC custody, has described researching programmable HSMs as a fallback.

An HSM is not quantum safe by default, but a programmable one can run a new algorithm inside the same hardware boundary and policies. At @Ledger we are working on that agility in our @ledger_business HSM stack.

@ethereuminsti the question for every institution: how would your provider add a new signature scheme, and how long would it take?
https://t.co/PxivLMv4jC

[Ledger Enterprise @ledger_business]

Software builds the transaction. The signer is the last line of defense.

Ledger CIO and CSO Oded Blatman on why both need to be ready for the post-quantum era, and the thinking behind Ledger Atom™

Learn more about Ledger Atom™ for Enterprise here: https://t.co/f5IH5txyjS

[Digital Asset Summit 2026 @blockworksDAS]

“We are now in this transition phase where the attackers got a lot better and the defense still has to catch up.”

@CryptoKasp

[Kasper Luyckx @CryptoKasp]

@Cointelegraph A unified capital market with one framework for tokenized securities is what Europe needs. Fragmentation slows innovation, increases costs and hurts liquidity.

[Kasper Luyckx @CryptoKasp]

Tomorrow at @blockworksDAS London with @khingoei @jojothecow and @alvarezmarsal: securing onchain capital when keys alone are not enough. Irreversible losses, freezes, and what institutions should demand before chasing yield. What question should we put to the room?

[Kasper Luyckx @CryptoKasp]

@blockworksDAS 🔥🔥🔥

[Kasper Luyckx @CryptoKasp]

When stolen stablecoins can be frozen, who gets to decide?

Circle says it froze USDC linked to the Binance hack in coordination with law enforcement. That can help stop stolen funds moving further.

But freezing funds is not the same as returning them. Someone still needs to establish who owns the money and whether it can legally be returned.

The question for me is what happens when the victim is a small business or an individual.

They should have a clear way to report the theft, know what evidence is needed and understand who can act. Access to that process should not depend on having industry contacts or making headlines.

That does not mean every claim should trigger a freeze. False claims and mistaken freezes can hurt innocent people too.

If stablecoin payments are going to replace traditional payments, how does the industry ensure smaller victims can get help, with clear rules, a practical way to report theft and a way to challenge mistaken freezes?

[Kasper Luyckx @CryptoKasp]

Bad take, it's highly likely that it's partially used for crime, just like cash and bank accounts are. Stablecoins do solve real problems, such as access to USD outside of the US and P2P instant free exchange around the world. Users of stablecoins are willing to forgo interest rate for those benefits. It's not that bank accounts pay a huge % on deposits, and there you actually take default risk.

[Kasper Luyckx @CryptoKasp]

@andyyy DAS will be 🔥

[Kasper Luyckx @CryptoKasp]

@yugacohler Generating cash flow and returning revenue to holders is still the best model imo, store of value is a hard promise to deliver on

[Kasper Luyckx @CryptoKasp]

@VitalikButerin Being a store of value is a difficult promise to deliver on, Bitcoin is way ahead and still trades likes a risk asset when there is volatility

[Kasper Luyckx @CryptoKasp]

@VitalikButerin Cost of intelligence will go down if there is abundance, no need to regulate here, free markets find equilibrium. Investors will stop investing in data centers if the return goes down.
Creating artificial scarcity however, always drives up cost.

[Kasper Luyckx @CryptoKasp]

@LLuciano_BTC I agree for Ethereum the network, unclear how it translates in the price of $ETH.

[Kasper Luyckx @CryptoKasp]

@theallinpod @DavidSacks @Jason The real question is, what's the most likely path to getting out of the war? Right now it feels like a stalemate with no light at the end of the tunnel.

[Kasper Luyckx @CryptoKasp]

The initial authorization is still the question for me. A policy engine should enforce permitted actions, destinations and limits at a trusted signing or account boundary, not just in the interface.

Changes to those rules should require an independent administrator quorum, with each approver verifying the change on a hardened device. A dedicated OS can help reduce attack surface, but it is not a guarantee. Delegation, upgrades and alternative execution paths also need explicit controls.

Without assuming which controls Binance had, what would prevent a compromised employee environment from obtaining an authorization outside that policy?

[Kasper Luyckx @CryptoKasp]

Securing the keys is necessary. It is not the whole security model.

Bybit and Binance illustrate why.

In February 2025, a compromised Safe developer machine enabled a disguised malicious transaction that deceived Bybit’s signers.

For the October 2026 Binance incident, Richard Teng told CNBC that attackers used malicious downloads and fake job interviews to compromise employees, then moved through internal tools to reach the system authorizing wallet transactions. The investigation remains ongoing.

For founders choosing a custody or signing setup, I would ask two sets of questions:

1. Where does the policy engine live? How is it secured? Who can change its rules, and what independent controls protect those changes?

2. Who or what can submit an approval? How are those people, identities, devices and environments secured? Can approvers independently verify that what they sign matches the intended action?

These accounts do not establish that policy engines themselves were compromised. They show why the signing and approval environment deserves scrutiny alongside key protection.

The HSM versus MPC debate matters, but security has to cover the whole stack, not just the private key.

If your keys remain protected but your approval environment is compromised, what prevents an attacker from obtaining a valid signature?

[Crypto Banter @crypto_banter]

🚨IPHONES DRAINED FOR $4M+ JUST BY OPENING A LINK IN SAFARI!

DarkSword, an iOS exploit kit, is hitting unpatched iPhones on versions 18.4–18.7.

Visit a malicious page in Safari and it can pull Keychain passwords, Notes, Photos, and crypto wallet data without any approval or wallet connection.

@Bitquery_io traced at least $4.06M USDT out of 365 TRON wallets through a network of 43 collector addresses tied to one fee wallet.

@SlowMist_Team has already flagged over 1,500 related phishing domains.

This is a device-level attack, not a wallet bug.

Update iOS and keep seed phrases off your phone.

[Kasper Luyckx @CryptoKasp]

@DegenerateNews @zachxbt @grok any rumours on the EU entity which got backed?

[Kasper Luyckx @CryptoKasp]

@Jason Why would you compare a currency to a computer? A computer can do more things so the currency is not interesting ?

[Ledger @Ledger]

“In order for you to have a safe transaction… you need to go back to hardware, not be based only on software components.”

Oded Blatman, CIO/CSO at Ledger, on the Ledger Podcast with @sebadault, on why AI is pushing security back to hardware.

Do you agree?