Sasha asked Riad Wahby the question every security product eventually has to answer, where it sits on the slider between security and usability, and Riad refused the slider.
“Our goal is to say, look, you don’t need to choose between these two things. You should be able to get both. I think most people think, no, you can’t. But here’s one way that you can. So you can actually attach really, really fine-grained policies to each of your keys, and you can use them at extremely high speed. Compared to others in the industry, we’re 100 to 200 times faster to, you know, actually respond. And so, you know, you get this high speed, you get, you know, the performance you need for your, say, trading application or whatever it is. But you also get to make sure that when the bad guy says, hey, no, give me the money, the key says, wait a second, that’s not allowed.”
Riad Wahby, co-founder and chief executive of Cubist, at 2:02
I said on tape that I love connecting authorization directly into the mechanism that drives the transaction, and I still think it is the most important sentence on this page. Three months before we published this, on February 21, 2025, Bybit lost about $1.5 billion from one cold wallet to one disguised transaction that its signers approved because the Safe{Wallet} interface they trusted had been altered. The keys were never stolen. They did what they were asked. We published this on May 22, 2025, with Sasha Sinkevich co-hosting, and the show notes were 37 words. This page is the rest of it: the product Cubist built first and the seventh customer who killed it, what a policy on a key actually is and what it has said no to at Ankr and Lombard and now MetaMask, the four co-founders and why Riad tells every founder to find an Ann, the middle-schooler who talked his father into buying Applied Cryptography, the perfection trap, the 3 a.m. page for a good thing, the fundraise that ran into the Terra collapse, the two pieces of secure hardware Cubist locks together, what Web3 growing up looks like, and the quantum window. There are four things to try along the way: a quiz on the episode, a scorecard for who can sign with your keys, a calculator for what a policy on a key is worth, and a timeline you can filter.
The seventh customer
I asked whether Riad had seen the problem up close, and he told the pivot story that every founder recognizes.
“We actually had this other idea that we were like, oh my gosh, this is going to be so cool. We’re going to build this sort of development suite that’s going to help people build complex Web3 applications, handle multi-chain interactions and stuff like this, which, by the way, is a real problem. And we built something, just version zero, get it out there, get customers using it. And we went and started talking to customers. By the way, credit to my co-founder Ann, who is sort of our business savior, who really, really put the screws to us and said, guys, okay, stop building things. We know that’s fun, but it’s time to go talk to people.”
Riad Wahby at 2:53
The first product was real. The Cubist SDK, announced in alpha in January 2023 and open-sourced that February, let developers write smart contracts as if they lived on one chain and generated the bridging code between Ethereum, Polygon and Avalanche, most of it in Rust, with the plan to sell enterprise features on top (The Block). When Polychain Capital led the $7 million seed on March 9, 2023, that was the product in the press release. Then the customers spoke, and every one of them said the same thing: “this seems really cool. But the thing that actually keeps me up at night is this one tiny corner of the diagram three slides ago where you said, like, automate this stuff.” The founders thought automation meant continuous deployment. The customers meant the whole operation. “After the seventh customer told us this, we had this kind of aha moment where we were like, okay, so this is the product that people actually want. And by the way, it’s actually a product that we can build really well.”
Forty days after the seed, on April 18, 2023, Cubist launched CubeSigner as a key management platform for staking infrastructure, with Ankr as its first public customer, days after Ethereum’s Shanghai upgrade had made staked funds withdrawable for the first time and so made the keys that could withdraw them worth stealing (Cubist). The line Riad gave CoinDesk that November is the tape in four words: what customers said kept them up at night was always “We can’t manage our keys” (CoinDesk). What strikes me about the story is the part he almost skips. The founders had already felt the problem personally: “it can’t possibly be this clunky. It can’t possibly be this bad. What are we missing here?” They were not missing anything. The tools really were that bad. The lesson for anyone building in security is that your own irritation is a lead, and seven customers are the confirmation. In-house, on-demand or YOLO is our version of the same question for startups deciding what to build and what to buy.
What the key says no to
A policy attached to a key is a simple idea with a long tail, so it is worth being concrete about what one says. Cubist’s write-up of the Ankr deployment is the best description I have found. The only deposit transaction an attacker who compromises a staking machine can sign is one that targets Ankr’s own deposit contract. The only staking is on behalf of validator keys Ankr previously generated. Unstakes are limited per day. The validator will only ever sign unslashable messages, because “CubeSigner refuses to sign two conflicting messages, even if the messages come from different validator clients.” And a stolen signing token raises an alert and can be revoked immediately (Cubist, on LinkedIn). Lombard, the largest Bitcoin liquid-staking protocol by value locked when it signed, put it in one sentence in September 2024: deposits can only be used to stake Bitcoin, and nobody can touch the private keys.
Lombard's cryptographers work with the @cubistdev team to secure the protocol and LBTC from breaches, hacks, and insider threats.
One way is with Cubist’s CubeSigner which safeguards keys in secure hardware and restricts how these keys can be used with policies.
This means that deposits can only be used to stake Bitcoin and no one — not attackers, not Consortium members, and not Lombard developers — can ever touch the private keys that power the protocol.
Read more…
Lombard (@Lombard_Finance) · September 28, 2024
Why this matters beyond crypto is the number under it. TRM Labs counted $2.2 billion stolen in hacks and exploits in 2024 and attributed nearly 70 percent of it to infrastructure attacks, “primarily private key and seed phrase compromises” (TRM Labs). Chainalysis put North Korea’s share of the year at $1.34 billion across 303 incidents (The Defiant). Then Bybit. Sygnia’s interim forensics found that attackers had compromised a Safe developer’s machine, pushed malicious JavaScript to the storage bucket that served the Safe{Wallet} interface, and altered what the signers saw only when the transaction came from Bybit’s contract address, so that the signers approved a “disguised malicious transaction” and the attackers replaced the scripts with clean ones two minutes later (The Block). The signers were not careless. The screen lied. Which is the whole case for evaluating the policy on the transaction itself, inside hardware the browser cannot reach, rather than on what a person saw. I am not claiming any product would have stopped that attack, and neither does Riad on the tape. I am claiming that “the key says, wait a second, that’s not allowed” is the category of control that could have, and that the same category is what signing approvals from a registered device means for a company that will never touch a blockchain. On episode 85, Channi Greenwall of Olympix calls the same theft a classical Web2 exploit, from the smart contract side.
Find yourself an Ann
I asked how he met his co-founder Ann, and the answer started with the other two.
“Yeah, yeah. So, so Fraser and Deian were both PhD students with me at Stanford. We all worked together doing research stuff, like, way before we had any thought of building a company. At some point, Deian went and founded a company that was working on JavaScript security. Cool stuff, really. And he, you know, so he was sort of in San Francisco and kind of in the SF startup scene. And he met Ann. She was working as a COO at another startup in kind of, in a fintech, like, really kind of heavily compliance and kind of anti-fraud type stuff.”
Riad Wahby at 5:06
The four, by Cubist’s own page: Riad, chief executive, an assistant professor of electrical and computer engineering at Carnegie Mellon. Fraser Brown, chief technology officer, an assistant professor at Carnegie Mellon who works on systems security, automated bug finding and formal verification and co-developed the CirC compiler for cryptographic proof systems. Deian Stefan, chief scientist, an associate professor at UC San Diego who co-founded Intrinsic, the runtime security startup VMware acquired in 2019. And Ann Stefan, chief operating officer, a former fintech COO with seven years in a high-risk consumer segment, covering payments, fraud prevention and anti-money-laundering, with a chemical-biological engineering degree from MIT (Cubist). All three technical founders did their doctorates at Stanford. The Block’s March 2023 piece described the company as computer security professors who had taught at Carnegie Mellon and UC San Diego plus a former fraud operations specialist, which undersells what Riad says Ann actually is.
“I claim to know how to, like, prevent somebody from breaking into my computer, but it’s actually a very different thing, right? Like, you kind of have layers of security, and one of those layers really is, like, here are our processes for preventing fraud. And so, having somebody who knows that sort of thing [cold], and who’s really done it in a high-risk industry for many years, is a superpower. So, go find it. If you’re starting a company, find yourself somebody who is excellent at operations, because your company is a machine and they know how to make it run.”
Riad Wahby at 5:06
That is the advice I would pin above every security founder’s desk, and it is why question seven of the scorecard is about process rather than hardware. A fraud-prevention process is a security layer. The person who has run one at scale knows things about who should be allowed to do what, and when, and with whose approval, that no amount of cryptography teaches you. Michael Nov of Prime Security said something similar about his co-founder from PayPal on episode 76: the practitioner who has done the manual version of the job is the one who knows what the product has to do.
The enormous red book
I asked whether he had always thought of himself as a security person, and he said cryptography first, and then told the bookstore story.
“I kind of started out thinking of myself as something, well, more like cryptography. Okay, so long ago, in the mists of time, in middle school, I was at a bookstore with my dad, and I somehow convinced him to get me this enormous red book called Applied Cryptography by Bruce Schneier, which is, like, you know, a classic. You see it on everyone’s shelf.”
Riad Wahby at 7:19
I interrupted to point out that Sasha had one standing right there. Riad’s father looked at the book and said, “what? Come on.” From there Riad found the cypherpunks and, for a while, administered the cypherpunks mailing list, then went to college and “saw this other bright, shiny thing, which was circuit design,” and became an analog engineer. The resume confirms it: nearly a decade as a staff engineer at Silicon Laboratories, from June 2004 to January 2014, designing analog and mixed-signal integrated circuits, before a stint at NYU and UT Austin, a Stanford doctorate from 2015 to 2021 under Dan Boneh and Keith Winstein, ten months as a cryptography researcher at Algorand, and the Carnegie Mellon faculty position he has held since July 2021 (LinkedIn, Cubist). The research is not a footnote to the company. He is a co-author of RFC 9380, the standard for hashing to elliptic curves published in August 2023, and a contributor to the BLS signature draft that Ethereum and Avalanche use, and a co-inventor of the Hyrax, Brakedown and Lasso proof systems (IETF). His description of the gap between his two fields is the one I give people who confuse them: “computer security, cryptography, they’re not quite the same thing, of course, as I tell my students, but they’re close, and both are super interesting.”
If you perfect it, you’re wasting time
Sasha asked when they pulled the plug on building and took what they had to customers, and why. The answer is the best thing a startup founder will take from this episode.
“I think if you’re ever, like, taking a product to a customer and feeling really comfortable about it, you’re probably missing an opportunity, because it means you should have done it, like, six months ago, when you were less comfortable about it. I don’t know, six months, something. Because, you know, I think if you’re talking to the right people, they’re not expecting to see something that’s perfect and polished. And meanwhile, you could very easily have spent that six months or whatever polishing something that nobody in the end wants, right?”
Riad Wahby at 11:28
His own practice is to be frank about the weaknesses: “hey, I know that it’s a little rough around the edges and it doesn’t work with all the chains that you’re interested in.” And then the credit, again, to Ann: “look, if you perfect it, you’re wasting time.” Sasha’s reply was the engineer’s confession, that we look for the perfect function and the perfect class, and that the eighty-twenty rule is usually enough to get to the next stage. For security products this is the harder discipline, because the whole pitch is correctness, and a founder who ships a key manager that only supports three chains feels like a founder shipping a lock with two of the pins missing. The resolution is in what Riad shipped: the first CubeSigner did one thing, Ethereum validator keys, for one customer, with a policy engine that could be formally checked, and added chains after (Cubist). Narrow and correct beats broad and polished. We make the same argument about the first security hire in In-house, on-demand or YOLO.
The good thing happened
I asked for the best day, and it was the one after six months of adrenaline.
“You’re just in that state where it’s like you sleep for four hours, you dream about the code that you were writing before you went to sleep. You wake up, you, you know, write code for 20 straight hours, maybe there’s food in there somewhere, and then you just rinse and repeat, right? First of all, I love, there’s almost nothing that’s as pure as that. Just, like, here’s six months of adrenaline, right?”
Riad Wahby at 13:25
The customer was launching a product on a timeline Riad calls insane, the thing did not exist yet, and they built it together and launched on time. The product generated signatures from a fleet of machines, and one rare event was the good one. So they wired the good event to PagerDuty. “At three in the morning, my phone goes off and it’s PagerDuty. And I’m like, oh no, what’s happened? And I look and it’s like, oh, oh, the good thing happened.” The good thing was an Ethereum validator proposing a block, which pays a reward, and they got paged for every proposed block until the team “quickly put, put the damper on that.” My question on tape was the one I still think about: “why are the interrupts always, like, negative? They should be positive.” The customer is not named, and I will not guess, but the timing lines up with the April 2023 launch, where Ankr’s chief technology officer Stanley Wu said the company chose Cubist because “their team includes preeminent experts in applied cryptography and systems security” (Cubist).
The second week of the raise
I asked for the most challenging moment, and Riad said that one was also easy, and that it came early, “which, I mean, I guess that’s a good thing. Like, the low point should come as early as possible.”
“And then, do you remember a little, a little thing called Terra and Luna? Maybe this was in the news, where these two cryptocurrencies crashed, the bottom fell out. That was the second week that we were raising funds. And so this, I don’t remember exactly the day, but let’s say it happened on a Tuesday. You know, the next day we had, like, a meeting with, like, a really important person who, by the way, is fantastic. We had this kind of really important meeting, and we show up at the meeting, and he kind of shows up, and you could just immediately tell something’s not right. And we’re like, hey, man, how’s it going? He’s like, it’s terrible. I’ve been awake for 36 hours. What do you want to talk to me about?”
Riad Wahby at 16:48
The dates fit. Riad’s profile puts Cubist’s founding in May 2022 (LinkedIn). TerraUSD slipped to $0.985 on May 7, fell to $0.35 on May 9 as Anchor’s deposits drained, and on May 12 LUNA lost 96 percent in a day and the chain was halted twice (CoinDesk). “That whole week of meetings was basically just people who hadn’t slept, because, like, half their fund was gone.” The round closed anyway, ten months later: $7 million led by Polychain Capital with dao5, Polygon, Axelar, Amplify Partners and Blizzard (The Block). The part I would want every founder to hear is what the helplessness felt like: “at least if I’m gonna fail, I wanna have been the reason for the failure. But in this case, it’s like, no, just, like, some random stuff happened that really has nothing to do with me, and now the world is just, like, burning down.” Michael Nov’s October 8 on episode 76 was the same lesson from a far worse day: the shock is external, the decision to proceed is yours.
Seven layers removed
Sasha asked for the main pain point, and Riad gave the answer in layers, which is the right way to explain any infrastructure product.
“If we had to reduce everything too much to a single pain point, it’s, like, well, it’s just too darn hard to do this stuff, especially if you’re trying to use secure hardware to do it. Like, the hardware systems tend to be slow, they tend to be inflexible, all that. But that’s not what the customer feels directly, right? Like, they’re seven layers removed from that. What they feel is: well, I’ve got to integrate this new system that I’ve never seen before. It’s got this weird key format, and who knows how key derivation works. And my customers really want to be able to log in with their Gmail account or whatever it is.”
Riad Wahby at 19:11
The bottom layer is two pieces of secure hardware locked to each other. “One is, like, a kind of classic FIPS 140 bank-type HSM, hardware security module. And then the other is a secure enclave. Effectively, the property that we need is we’re able to say, here is some code that’s identified by its hash, by a signature, whatever it is. Only that code is able to access this key, this sort of master key that lives inside of the HSM. And so we lock those two things together.” Cubist’s own description at the November 2023 launch was “bank-grade Hardware Security Modules cryptographically sealed to AWS Nitro enclaves,” with millisecond latency and support for hundreds of millions of wallets on any chain, by the company’s claims (Cubist, on LinkedIn). The choice of enclave was deliberate. When the Downfall attack on Intel’s SGX enclaves was disclosed in August 2023, discovered by a researcher who had started the work as a postdoc with Deian Stefan, Cubist’s post said what most vendors would not: “Intel has never shipped a processor with a secure SGX implementation,” and the reason Cubist does not use it is that “SGX tries to do too many things, which means it’s too complex, which means it’s too hard to get right.” If you build on secure hardware, that is the question to ask your vendor first.
The layers above the hardware are the product, and they are where most key management fails in practice: an API to generate keys, secure import of the keys customers already hold (“Most of our customers aren’t starting from zero, they’re starting from tons of keys”), backup and export, and the non-custodial case where each end user owns their own key and the company providing the wallet can prove that “none of our employees can touch it, we can’t touch it.” Then performance, then breadth, then the speed of adding new chains, which is where he says the traditional competitors lose: “those folks tend to fall really far behind on adding new support or on supporting workflows that don’t look like the workflows that they envisioned.” The structure of that answer is worth stealing for any product that sells trust. Name the property at the bottom, then list the hundred details above it, because the customer only ever touches the details.
Web3 grows up
I asked what smashing success looks like, and Riad answered for the industry rather than the company, with the warning that it would sound self-important.
“A lot of the newest developments, you know, people are like, God, don’t worry about security. There’s not enough time for that. Right. And so, you know, you end up in a situation where the newest, hottest project is, like, of course, like, it’s a minimum viable product, right? And so security was not one of the parts of minimum viability. And so it tends to be something that gets built on later.”
Riad Wahby at 25:49
The future, in his telling, is the industry hitting its stride, enterprises adopting, and the engineering process maturing: “I think, you know, people in Web3 will think that this is a bad thing, but I don’t. The engineering processes will start to look a lot more like they do in Web2.” At which point “a product like ours is essentially inevitable,” because “Web3 is so mediated by cryptographic keys” that every company’s assets, every API and every user wallet pass through a key manager. Sasha’s summary got the laugh of the episode: “So it turns out the classical security principles apply to Web3 as well.” “It turns out, it turns out.” The record since reads like the forecast. In 2023 and 2024 Cubist built anti-slashers with Babylon and EigenLabs, so that an honest operator with a buggy deployment cannot be penalized for double-signing, because the signer will not produce two messages for one height even when asked, a stronger guarantee than hoping “People do a deployment wrong, they accidentally get the Kubernetes configuration wrong” never happens (Blockworks). In November 2024 the Sui Foundation, Babylon, Lombard and Cubist announced the plumbing to bring staked Bitcoin to Sui, with Cubist handling the deposits, minting, staking and bridging (IBTimes). In October 2025 Avalanche’s Bitcoin bridge moved to Lombard with CubeSigner underneath.
As @avax’s Bitcoin bridge moves to @Lombard_Finance, BTC.b expands its reach.
Cubist’s CubeSigner and Bascule Drawbridge will play key roles in the bridge’s trust-minimized, multi-layered security model—powering key management, minting, and withdrawal operations.
Cubist (@cubistdev) · October 30, 2025
Then the grown-up phase arrived on schedule. On December 16, 2025 Cubist launched Confidential Cloud Functions, verifiable off-chain code that runs in a trusted execution environment, attests that it ran unmodified and reports its result on-chain, which Fraser Brown described as “applying custom, auditable signing rules to high-value transactions” (Brief Glance). On January 22, 2026 the company named Rohan Chauhan, formerly the chief executive of Gemini’s prediction-markets business, as president, to run institutional go-to-market as banks move tokenized deposits and stablecoins into production, with Polychain, dao5, Blizzard and Paxos listed as backers (Business Wire). Riad’s one-line reaction is below, with the company’s post that explains the moment better than the press release.
This is huge---I'm beyond thrilled that Rohan is joining Cubist!
Riad Wahby · January 2026
Cubist: A lot changes when people start relying on what you build.
Over the past few years, Cubist has gone from helping teams experiment onchain to running systems that institutions depend on to move billions of dollars. Rohan C. stepped away from a compelling role as CEO of Gemini's prediction market to help Cubist meet rising institutional demand, and we’re honored by the conviction behind that choice.
On March 19, 2026, Hashi, a Bitcoin lending protocol on Sui built by Mysten Labs, announced commitments from BitGo, Bullish and FalconX, with Cubist’s infrastructure moving the Bitcoin collateral in and out and Chauhan calling Cubist “the de facto infrastructure layer and developer platform for native Bitcoin on Sui” (Cointelegraph, Sui). Whether Web3 has grown up is not a question I can answer. Whether the companies doing the growing have started to behave the way Riad predicted, with a key manager in the critical path and a fraud-operations veteran on the founding team, is.
Your agent finally gets its own wallet
The thing Riad did not predict on tape, and the reason this episode matters to a company that has never held a token, is what the key manager turned out to be for. On June 8, 2026, MetaMask opened early access to its Agent Wallet, a self-custodial wallet for AI agents: a user connects an agent, sets spending limits and allowed protocols, and the agent trades, provides liquidity and enters prediction markets on its own. In the default Guard Mode every action passes policy checks, daily spending caps, allowed protocols and chain allowlists, and a violation triggers a two-factor prompt that the human has to approve. The key isolation is Cubist’s (Genfinity). On August 6 it went live for everyone.
One of the most rewarding parts of being an infrastructure provider is watching customers ship products that move the industry forward. Congratulations to the @MetaMask team on today's launch of 🦊 MetaMask Agent Wallet.
In order to handle real assets, AI agents need clear guardrails outlining what they can and can’t do. MetaMask Agent Wallet lets users define spend limits, allowlisted protocols, and risk profiles while staying in control of their own keys.
We’re delighted to have CubeSigner and Confidential Cloud Functions (C2F) powering the self-custody key management, transaction signing, and policy enforcement behind MetaMask Agent Wallet. Something we’ve always been proud of is the customizability of the Cubist platform and it’s exciting to see MetaMask Agent Wallet put that customizability directly in their users’ hands to let them shape their own agentic experiences.
Cubist (@cubistdev) · August 6, 2026
Even though the concept of an agent wallet terrifies me, I feel safer when knowing that @cubistdev is involved!
Kostas Ferles (@KFerles) · August 6, 2026
Read Riad’s 2:02 answer again with an agent in the chair instead of a trader. The agent needs speed, because it acts at machine pace. The owner needs the key to refuse, because the agent can be wrong, or prompted into being wrong, and a refusal from the model is not a control, as we wrote in Your AI agent said no. Your API key said yes.. The policy on the key is the only part of that system that does not care what the agent believes. It is the same shape as the read-before-write ladder and the least-privilege floor we recommend for agents that never touch a blockchain: the credential, not the model, carries the limit. And it is the reason who signs for the agent is the first question an enterprise buyer will ask about yours. Ben Colman said on episode 71 that companies want to engage your agent for information sharing but maybe not for authorization. A spend cap enforced inside an enclave is what “maybe not for authorization” looks like when it is implemented.
Not five years, not a hundred
Sasha brought up forward secrecy and crypto-agility, and Riad took the opening to put a window on the quantum question.
“Personally, I think it’s probably a bit further out than some people say. But, like, I wouldn’t say that I’m kind of the, in, in the, in the group who thinks it’s, you know, happening in the next five years. I think that’s probably not likely. But I don’t think it’s never. I don’t think it’s a hundred years. I don’t think we get to say, like, ah, our grandkids will solve that problem. Like, we’re going to be the ones, like, all of us are going to be the ones who are solving it.”
Riad Wahby at 29:04
A year later Kevin Kane of American Binary argued the opposite case on episode 96, that Google’s 2029 migration target is already too relaxed, and I wrote up the deadlines in Harvest now, decrypt later: Google’s own target of 2029, NIST’s plan to deprecate classical public-key algorithms after 2030 and disallow them after 2035, which NIST finalized on October 27, 2026, the week before this page (Google, NIST, Quantum Computing Report). The two positions are less far apart than they sound. Riad’s floor is the year the deprecation begins. His point is about the machine, and the deadlines are about the migration, and a migration for a company whose entire asset base is a set of elliptic-curve keys is the kind of thing you start a decade early, which is exactly what Sasha’s “agile crypto” question was reaching for. Riad’s last line on it is the attitude I want from a cryptographer: “here’s a kind of nice problem that all of us are gonna get to solve someday, and we know it, but, but maybe we don’t have to worry quite yet.”
The founder notes
One foot on both sides of the line. He is faculty at Carnegie Mellon in electrical and computer engineering, and the first thing he and Sasha had been discussing before we hit record was “the dizzying array of departments that all have some claim to teaching computer science. And mine is one of them.” His defense of the hardware department: “something about hardware, I think, is important when we start talking about computers, right?”
Investors who click. “A little more than that nowadays,” he said of the $7 million on his profile. What he wanted to talk about was the kind of investor, “super technical,” who hears the pitch and says “oh, yeah, we understand that. And by the way, here’s a couple other points. And here are a couple of people you should talk to.” Sasha’s addition is the one founders forget: when you take the money, the fund becomes part of the team, and the help that matters is the introductions you have not had years to cultivate yourself.
Would he go back? “I’m kind of an adrenaline junkie.” The advice to his younger self is to enjoy the quiet, “especially enjoy the parts where the pressure turns down a little bit. You can relax and maybe have a hobby, because in a few years, you’re going to lose your mind. You’re going to go to grad school, where you’re not allowed to have hobbies.” Then faculty, then founder, neither of which allows a hobby either. When I translated it as “oh, you think this is hard? Just wait,” he accepted the translation: “I guess apparently I would taunt my past self. That’s what we’ve just discovered together. Enjoy this. This is easy, actually.”
There’s never a dull day. Sasha called it a very difficult problem on many levels, made fun and made into a viable business. “It feels good to hear you say that. But it is definitely true. Like, we get to have a lot of fun. The technical side, there’s always something interesting. There’s always a kind of a small problem that’s very satisfying to solve.”
The exit. Sasha: “an absolutely, absolute joy.” Riad: “Thanks for having me. This has been super fun.”
Did you catch it? A six-question quiz
Interactive · six questions
Did you catch it?
Six questions on what Riad actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.
-
How much faster than the rest of the industry does Riad say CubeSigner responds?
- Ten times
- 100 to 200 times
- A thousand times
b. "Compared to others in the industry, we're 100 to 200 times faster to, you know, actually respond." Transcript, 2:02.
-
What did Cubist build first, before key management?
- A hardware wallet
- A smart-contract auditing service
- A development suite for multi-chain Web3 applications
c. "We're going to build this sort of development suite that's going to help people build complex Web3 applications, handle multi-chain interactions." The seventh customer changed the plan. Transcript, 2:53.
-
Which book did Riad talk his father into buying in middle school?
- Applied Cryptography, by Bruce Schneier
- The Art of Computer Programming
- The Cuckoo's Egg
a. "this enormous red book called Applied Cryptography by Bruce Schneier, which is, like, you know, a classic." Transcript, 7:19.
-
What woke Riad up at three in the morning on the best day?
- A breach alert
- A PagerDuty page for a good event: a validator proposed a block
- A customer escalation
b. "At three in the morning, my phone goes off and it's PagerDuty. And I'm like, oh no, what's happened? And I look and it's like, oh, oh, the good thing happened." Transcript, 14:59.
-
What collapsed during the second week of Cubist's fundraise?
- FTX
- Silicon Valley Bank
- Terra and Luna
c. "do you remember a little, a little thing called Terra and Luna?" and then: "That was the second week that we were raising funds." Transcript, 16:48.
-
Which two pieces of secure hardware does Cubist lock together?
- A FIPS 140 hardware security module and a secure enclave
- A smart card and a phone's secure element
- Two hardware security modules from different vendors
a. "One is, like, a kind of classic FIPS 140 bank-type HSM, hardware security module. And then the other is a secure enclave." Only code with a known hash can touch the master key. Transcript, 19:11.
Who can sign with your keys?
Cubist’s customers are staking operators and wallets. Yours is a startup with a deploy key, a payments API key, a cloud root credential and, increasingly, an agent that holds some of them. The question Riad answers for blockchains is the question for all of those: when software asks the key to do something, can the key say no? This scorecard asks eight questions about the keys your own systems hold, each tied to a point on the tape, and tells you which one a compromised server or a misbehaving agent would find first.
Scorecard · eight questions
Who can sign with your keys?
Answer for the keys that can move money, deploy code or read customer data, as they are held today, not as the policy document describes them.
-
Where does the private key or secret that can move money or deploy to production actually live?
- In an environment file, a laptop, or a shared vault anyone on the team can read
- In a cloud secrets manager, readable by whatever has the role
- Inside hardware or a managed signer that never exports it, and signs on request
"All of the key management, key generation, key usage, everything happens inside of secure hardware." A key that can be copied has already been copied. The .env file is where most startups' security program starts.
-
Is there a policy on the key that limits what it will sign: destinations, amounts, rates, environments?
- No. If you hold the key, you can do anything it can do
- Limits in the application code that calls the key
- Limits enforced at the signer, outside the application, so a compromised app still cannot exceed them
"when the bad guy says, hey, no, give me the money, the key says, wait a second, that's not allowed." Ankr's deposit key will only sign deposits to Ankr's contract. The limit lives at the key, not in the code that asks it.
-
If one server or one engineer's laptop is fully compromised tonight, what is the most an attacker can do with the credentials on it?
- Everything the company can do
- A lot, but we would see it in the logs eventually
- A bounded amount, and the attempt beyond the bound alerts us
Cubist's design assumption is that every component is untrusted, so a hacked organization's systems still cannot sign a malicious withdrawal. The blast radius playbook is the same exercise for the rest of your stack.
-
Are signing sessions and API tokens short-lived and revocable in one action, with an alert when one is used from somewhere new?
- Long-lived keys, rotated when someone remembers
- Rotated on a schedule
- Short-lived, revocable, and a new-location use pages someone
CubeSigner hands out short-lived, revocable privileges to sign instead of the raw key, and a stolen token raises an alert. Start with the inventory of which tokens exist at all.
-
Do your AI agents hold their own scoped credentials, with spend or action limits, or do they share a human's or the service's key?
- They use whatever key was in the environment
- Their own key, same permissions as a human
- Their own key, with caps and allowlists enforced outside the agent, and a human prompt on a violation
MetaMask's agent wallet checks daily caps, allowed protocols and chain allowlists on every action and asks a human on a violation. One shared key for every agent is the opposite.
-
Can you import, back up and export the keys you already hold into whatever you move to, without the migration itself exposing them?
- We would paste them into the new system
- An encrypted export someone decrypts along the way
- A documented, tested path that never puts the plaintext key on a laptop
"Most of our customers aren't starting from zero, they're starting from tons of keys. How do you securely import keys into the secure hardware?" The migration is the moment keys most often leak.
-
Is there a fraud-operations process around the keys, not only a technical one: who may request a transfer, who approves, and what happens on an unusual request?
- No, the engineers decide
- An informal rule the finance lead knows
- Written, rehearsed, with a second approver for anything above a threshold
"you kind of have layers of security, and one of those layers really is, like, here are our processes for preventing fraud." Find yourself an Ann.
-
Do you know which of your keys would need to change if elliptic-curve signatures were no longer safe, and how long the change would take?
- No idea
- A rough list
- An inventory, the long-lived ones flagged, and a plan with a date
"all of us are going to be the ones who are solving it." NIST's deadlines are 2030 and 2035. Harvest now, decrypt later has the four-step migration.
Your keys are copies on laptops and in environment files, and the only limit on what they will sign is the honesty of whoever has them. Fix the first two questions this month: move the keys that can move money or deploy to production behind a signer that never exports them, and put the limit at the signer, not in the application. Then make the tokens short-lived.
The keys are in a secrets manager and the application checks limits before it asks, which means a compromised application asks without checking. The medium cases bite here: the agent that inherited a service key, the migration that put a plaintext key on a laptop for an afternoon, the transfer nobody had to approve. Move the policy to the signer and give the agents their own capped credentials.
Keys never leave hardware, the policy is enforced where the signature is made, sessions are short and revocable, agents are capped, migrations are tested and a human process sits on top. What is left is the inventory for the post-quantum migration, which an enterprise buyer will ask about before 2030, and the same discipline applied to every new credential your next agent needs.
What a policy on the key is worth
Riad’s argument is that the limit belongs at the key, because then a compromised machine can only do what the policy allows. Put your own numbers in and see what that is worth against a key that will sign anything. Every default below is an assumption, chosen to be easy to argue with.
Calculator
What a policy on the key is worth
One key or credential, the value it can reach, the odds it is compromised this year, how much an attacker takes before you revoke it, and the cap a policy at the signer would put on the same attack. Rough by design. Change the numbers to yours.
At these numbers, a key that will sign anything loses most of what it can reach in one compromise, and a key with a daily cap loses only the cap times the days before you revoke it. The difference, weighted by the odds of a compromise, is what the policy on the key is worth a year.
The 5 percent, the 80 percent and the 24 hours are placeholders, not research. TRM Labs attributed nearly 70 percent of the $2.2 billion stolen in 2024 to private key and seed phrase compromises, which is the case for the first number being higher than you think. Not counted: destination allowlists, which stop most attacks outright rather than capping them, and the key that deploys code rather than moving money, where the cost is a breach rather than a transfer.
Twenty years on one line
Everything on this page sits on one timeline, from Riad’s first job designing circuits to the week this page was written. Filter it by thread.
Timeline · 2004 to 2026
Twenty years on one line
Filter by thread. Dates are from the public record except where marked as Riad's own account on the tape.
- The enormous red book
Applied Cryptography, bought by a skeptical father at a bookstore, then the cypherpunks mailing list.
- Silicon Laboratories
Nearly a decade as a staff engineer designing analog and mixed-signal integrated circuits, through January 2014 (LinkedIn).
- Stanford
A doctorate in computer science under Dan Boneh and Keith Winstein, finished in 2021, then ten months as a cryptography researcher at Algorand (Cubist).
- Carnegie Mellon
Faculty in electrical and computer engineering, which he still holds alongside the company.
- Cubist is founded
Four co-founders: Riad, Fraser Brown, Deian Stefan and Ann Stefan. The pitch meetings are compressed into two weeks.
- Terra and Luna
UST loses its peg on May 7 and LUNA falls 96 percent in a day on May 12. "Half their fund was gone" (CoinDesk).
- The Cubist SDK
Version zero: a multi-chain developer suite, in alpha, then open-sourced in February, and a place in Beacon's first cohort (The Block).
- $7 million seed
Led by Polychain Capital with dao5, Polygon, Axelar, Amplify Partners and Blizzard (The Block).
- Ethereum's Shanghai upgrade
Staked funds become withdrawable, and the keys that can withdraw them become worth stealing.
- CubeSigner for staking
Short-lived signing privileges, policies, anti-slashing, and Ankr as the first public customer (Cubist).
- No Silver Bullet
Ten minutes on key management technology at DeFi Security Summit (YouTube). RFC 9380, hashing to elliptic curves, is published in August (IETF).
- Downfall
A new attack steals keys from Intel SGX enclaves. Cubist's post: this is why it does not build on SGX (LinkedIn).
- Wallet-as-a-service
HSMs sealed to Nitro enclaves, millisecond latency, any chain, by the company's claims (CoinDesk).
- Anti-slashers for Bitcoin and restaking
Babylon and EigenLabs collaborations: the signer will not produce two messages for one height, whatever the client asks (Blockworks).
- Lombard
The largest Bitcoin liquid-staking protocol by value locked runs on CubeSigner policies: deposits can only stake Bitcoin (X).
- Bitcoin to Sui
Sui Foundation, Babylon, Lombard and Cubist, with Cubist handling deposits, minting, staking and bridging (IBTimes).
- $2.2 billion stolen in 2024
Nearly 70 percent through private key and seed phrase compromises, per TRM Labs (TRM Labs).
- Bybit
About $1.5 billion from one cold wallet, through a disguised transaction served by a compromised Safe developer's machine (The Block).
- Episode 69 airs
This conversation, with Sasha co-hosting. "The key says, wait a second, that's not allowed."
- Storing crypto safely
Forty-four minutes with Ripple on key management infrastructure (YouTube).
- Avalanche's Bitcoin bridge
BTC.b moves to Lombard with CubeSigner and Bascule Drawbridge in the security model (X).
- Confidential Cloud Functions
Verifiable off-chain code in enclaves, reporting on-chain, in production on mainnets (Brief Glance).
- A president from Gemini
Rohan Chauhan joins to run institutional go-to-market. "Institutions are ready to move trillions onchain" (Business Wire).
- Hashi on Sui
Bitcoin lending with BitGo, Bullish and FalconX committed, and Cubist moving the collateral (Sui).
- "They just need to wait"
Kevin Kane on episode 96: Google's 2029 target is already too relaxed. Our post on harvest now, decrypt later follows the next day.
- MetaMask Agent Wallet, early access
Two hundred spots, Guard Mode policy checks on every action, Cubist's key isolation underneath (Genfinity).
- "Your agent finally gets its own wallet"
Live for everyone, with CubeSigner and C2F doing the key management, signing and policy enforcement (X).
- NIST finalizes the transition
Classical public-key algorithms deprecated after 2030 and disallowed after 2035, the week before this page (Quantum Computing Report).
What to do this week
Four things, in the order a compromised server would test them.
- Find the key that can do anything. List every credential that can move money, deploy to production or read all customer data, and where each one physically lives. The one in an environment file on a laptop is the first fix. Move it behind a signer, a hardware module or a managed service that never hands the private key back.
- Put the limit at the signer. For each of those keys, write the policy in one line: which destinations, how much, how often, from where. Then enforce it where the signature is made, not in the application that asks. A compromised application should be able to ask for anything and get a no.
- Give the agents their own keys, with caps. No agent shares a human’s credential or the service’s root key. Each gets its own, with a spend or action cap and an allowlist enforced outside the agent, and a human prompt when it hits the limit. MetaMask’s Guard Mode is the consumer version of exactly this.
- Write the fraud process down. Who may request a transfer, who approves, what counts as unusual, and what happens then. Then rehearse it once. Riad’s superpower was a co-founder who had run that process in a high-risk industry for years. Until you have one, the document is your Ann.