Transcript

Alison Proctor:

Welcome to To Be or Not To Be, from blockchain to Bitcoin and everything in between. My guest today has spent decades working at the point where complex technology meets ordinary human life. And Wasim Ahmed is a serial entrepreneur, founder, and author. And across eight startups, he's helped to raise more than $100 million and he's delivered five successful exits. Wasim has helped turn groundbreaking cryptography into commercial technology. So it's used by organizations such as JP Morgan Chase, Lloyd's, Walmart, and Wells Fargo. That was before the company was acquired by HP. Today, Wasim works at Vault12, which is really a pioneer of crypto inheritance. So it helps people protect and eventually pass on digital assets. His new book, Who Holds the Key, which I'm delighted to have a copy of, it's an everyday guide. It's regarding cryptography, passwords, crypto wallets, and really the invisible technology protecting our privacy, identity, money, and our memories.

So it asks one deceptively simple question that can really reveal who has control. So who holds the key? Wasim, welcome to, to be or not to be.

Wasim Ahmad:

Thanks so much, Alison. It's great to be here.

Alison Proctor:

Excellent. Well, before I actually open the book, I want to begin with you. And that's because you encountered AI language, I think it was prologue as a school boy. You studied physics and French, and you even became a candidate for the Juno space program. So I have to ask you, where did all that curiosity come from for technology?

Wasim Ahmad:

I think I've always been curious. And I think growing up in Britain in the '70s and '80s, there was so much sci-fi on TV, everything from Doctor Who, Blake Seven. I mean, there was so much promise. I think a lot of entertainment was about the future, and I don't know whether we have all of that today. Everything is very dystopian now. And I think there was this sort of idea, this ideal that things will be so much better in the future. And I think the other thing, looking back on my career, if you will, which I think none of us do that often enough, but it became really obvious to me that when you're young, you don't have blinkers, you don't have this attitude of, oh no, that's too hard, and you just go for it. So yes, when the Juno project, which was an Anglo-Russian space project, put out an advert saying astronauts needed no experience necessary and they got like 13,000 or I don't know how many applications, I applied and I got through to a couple of the different levels, but unfortunately I was a little too young.

They wanted people that had been in industry. And about 10 years later, I went to a conference in Edinburgh and the woman that did get selected and went up to one of the space stations was the keynote speaker. So I just sat there like this because she got to do what I had wanted to do.

Alison Proctor:

Wow. I mean, that's incredible. And after spending years alongside some of the world's leading cryptographers, why did you decide that this book needed to be written for ordinary people?

Wasim Ahmad:

Well, I think that I started writing it. My two brothers are barristers and they do a lot of very complicated cases which involve surveillance and all kinds of things. And they would ask me, they'd phone me up and say, "Oh, well, face ID, it captures your face and then can someone steal that face and then use it for other things? Is that a trajectory that criminals can go through?" And of course that's not how face ID works. It's not saving your face. And so I though, let me just write down all of the things that are kind of relevant. And then I though, well, yeah, there's an awful lot of it now in today's day and age with our phones. Apple just came out with a new phone. Google just came out with new phones last month. They have a tremendous amount of technology that's to do with security and privacy and people don't understand it.

They don't necessarily switch all of it on. And maybe I should start from scratch and write about it. And then in Britain, the government, all of the different variations of government that we've had in the last 50 years have had this attitude that we want to see what people are doing. And everyone knows we have more cameras in London than anywhere else, but they want to see our photographs, our emails, our messages. And while there are merits to why that is necessary, there are some fundamental rights here that should not be trampled on. And so I though, well, let me write about all of this and just put it in really, really simple terms. And then once I started doing that, it turned into explaining a few foundational things about how cryptography works.

Alison Proctor:

And again, it's so beautifully written for anybody who holds a phone. It is a practical guidebook, but it also highlights so many of the things that we as an ordinary person not thinking about cryptography go through throughout the whole day, not even realizing what we actually have in our pockets, that small computer. The book itself, to me, it rests on that four ideas, the keys, who holds the keys. I mean, that's pivotal in this book, isn't it? And the signing and where the keys physically live. I mean, my question is why can a simple framework be more useful than trying to understand all of the mathematics?

Wasim Ahmad:

Well, I don't really go into the mathematics, so you don't have to learn any algorithms or anything like that. I don't even go into the history. Most people start with, "Oh, Julius Caesar, in his day, there was this way of encrypting information." I think what I found was that we are faced constantly with new platforms, whether it's a new offering from Meta or something from Google. A lot of our government services in the UK have gone online with gov.uk more and more. It's actually quite impressive the speed at which that's happening. And they all take you through very complicated security procedures. And I think people need to understand, well, should I click that tick box? On WhatsApp, if I go into profiles, should I click on end-to-end encryption? I don't really know what that is, but should it be on or off? Because it's not on by default.

And so that's the level that I wanted to talk to people about and say, look, here's how you can make a decision, what you have to ask yourself, and you can get the answers from ChatGPT, who holds the key? Who is controlling this conversation or encrypting this conversation? And once you start asking those questions, you can very quickly arrive at, is this the right thing for me? Because a lot of security, unfortunately, is about how convenient it is.

Alison Proctor:

And you compare three familiar things, which again is what is very relatable in this book, your bank account, your photographs that are stored in the cloud and the cell custody wallet. So I'm going to ask, what does asking who holds the key, what does that reveal about the trade-off between the convenience, the control, and the recoverability?

Wasim Ahmad:

I think it's easiest to talk about it in terms of crypto just because the outcome of making a mistake is so severe. You can literally have all your assets drained. But I think I saw you a few weeks ago at Crypto Mondays where they talked about someone having their phone stolen, and that is also equally devastating for certain people. And so I feel like what happens is there are scenarios where you control everything, and in that scenario, unless someone is able to grab hold of your keys that are under your control somewhere, you're pretty safe.

But in other scenarios, if they can get past your password or you're already logged in and they can go straight to your bank account or your crypto wallet on an exchange, they can transfer money out very, very easily. So in the case of the exchange and the bank account, the person that holds the keys is actually the bank or the exchange. It's not you. So if that is somehow compromised, then you really can't do anything about it. There's nothing that you can do. And so one of the reasons why a lot of people have been attracted to cryptocurrency in the past has been, well, you kind of control your assets and some people love that idea, but what it does is it means that you have to worry about all of your security and that can be really, really complicated.

Alison Proctor:

Yeah. There was a line in the book that's basically, this is both freedom and terror in the same sentence, and it really resonated with me because you want to have self-sovereignty, you want to have control, but the book really points out where you have complete control and where you have to be aware and you have to self safeguard almost. And the signing was... There were a few things that I was... Again, it's really well written and clearly written for you to understand it without having to know any of the maths, but there are important distinctions. And the book says the keys do two jobs. So the keys protect the secrets, the cryptography, and they protect the communication, but they also authorize actions, say for agents, for example. I'm trying to find out what's potentially dangerous when you give these authorizations and whether you gave examples in the book, say for example, was it by bit where nobody actually stole the keys and the cryptography was not broken?

I have to revisit this, but it was all about the screen that what people were seeing wasn't the truth. So there's the trade-offs, I suppose, between the secrets that are held and the keys. Could you define that for me because I'm not doing a great job?

Wasim Ahmad:

No, no, that's quite right. It is complicated, and I think that I often struggled explaining signing to people myself. And so now when I sat down and was like, okay, I need a good example of what this is, I think it becomes clearer. So signing is the process that you go through typically when you're trying to do some kind of transactions, you're trying to move money from one place to another. It could be cryptocurrency, it could be other things too. And it is the explicit authorization that you are who you say you are and that this transaction is approved. Your keys are used to do that. But in the case of Bybit, like you said, no cryptography was broken, no security really was broken except one thing, and that was they put a fake screen in front of the people that were authorizing the transactions and they looked at the screen and said, "Oh yeah, this looks like one of those transactions that we do every day." They didn't double check it and they just pressed yes.

And behind the scenes, it was millions of dollars worth of assets that got transferred. The reason this happened was right now in 2026, we are discovering that criminals are using AI to figure out holes in every single system that ordinary people use every day. And so there is a lot of activity going on, which is one of the reasons why on your phone every day there's like 50 updates or I just turned on my iPad, there were 105 updates just from the last three days because every developer is working on fixing these holes that AI exposes. Well, they're holes that are there in the code, so it's exposing them. But criminals are moving very, very quickly. They're always two steps ahead. And so in the case of Bybit, they discovered that yes, there was a hole here and they could insert something that would lead people to press yes.

And so that's what happened.

Alison Proctor:

Wow. And again, it's those sort of real life examples, and not to frighten anybody, but like you've just said, the good guys are working so quickly that those updates come to reinforce the security within the phone. But again, the irony of reading this, I'm almost halfway through or a little bit further through the book, and then I read about the cold card case, which is actually ongoing, and I'm just getting towards the end of the book, but would that perhaps shape any of your work in the future?

Wasim Ahmad:

Well, yes. So I literally, I had pressed send on the publishing of the book, and then that weekend everything exploded. There was the cold card hack, which was basically due to, we'll be charitable and call it an error on the part of the company where they used some algorithm that was incorrect, and hackers exploited that. It looks like they knew about it for five years and they waited so that there'd be lots and lots and lots of customers, and then they hacked them. So a lot of people have claimed that maybe it was an inside job. I don't know. I'm sure that's going to come out. It was all to do with random number generation, which is an essential component of generating the encryption that you need and the signing that you need. I updated the chapters really hardly that weekend and then republished it.

Alison Proctor:

Yeah.

Wasim Ahmad:

The beauty of modern day publishing. But I think it requires a little more work, more explanation on my part. And so I am in the process of finishing up my second book, which is called Everyday Crypto, and it specifically focuses on cryptocurrency. And again, it has this very pragmatic angle of how do you make the choices? What choices do you make? Should you use a hardware wallet? Should you use this hardware wallet that is the most well-known in the world? The answer is no, not necessarily. It really depends on what kind of person you are and goes into a lot more details of those kinds of things. But there were many mistakes, and I think since that day,

Wasim Ahmad:

There's

Wasim Ahmad:

Been many, many other, I'm going to call them problems because they are hacks, but they're not necessarily hacks of the wallet. Treza had a supply chain hack where they hacked into the company that when you buy a Treza wallet that ships it to you. So they hacked into that aspect of it, and they got the names of addresses of a whole bunch of people who presumably have enough crypto that they thought that they would buy a wallet to protect it, which is a hugely dangerous type of information. And then it happened again to Ledger. They had some code problem somewhere in their code, and they actually didn't make too much of a big deal about it, but it is a problem. I think there's been four or five, and that's in August of 2026. Wow. Yeah, it's a continual problem for everyone, I think.

Alison Proctor:

And to put it in perspective as well, this is not just the digital asset industry, the crypto industry or Bitcoin or anything like that. It's actually the fact that we as a whole global society are moving forward through computers and the digital financial space is still a very small ratio, but we've picked out those red flags that are almost like warning signs for the industry that we can get so much better at our security from a commercial basis, but also from a personal basis through a lot of the advice in this book that you can pick up, and it explains what the differences are and what your choices are and where you are on what I would call the security ladder. You mentioned a ladder in here, which rung on that ladder are you on from full self sovereignty and a hundred percent responsibility to passing some of that responsibility to trusted keepers.

And we're only used to the financial banking system as what we are as a society and ordinary people put our trust in the banks. So you have a great way of explaining the various levels of trust through various different platforms. Again, it's a complicated explanation from me, but the credible corporate custody policies that go beyond naming custodians and where the assets are held, these are all explained in your book and does a much better job than I do.

Wasim Ahmad:

Well, yes, it gets pretty complicated, especially when you start thinking about more complicated financial transactions. And many people don't want to... Maybe they're dealing with their corporate accounts and they don't want to deal with the day-to-day, and so they will use trusted third party custodians. And the challenge with that is I think each individual institution in financial services, people work very, very hard to make sure that what they're doing is secure. But what can often happen is, forget about hackers for a moment, businesses change their partnerships, they fall out with each other. Things can happen, and there are consequences when you've purchased some level of protection from one company, from your main company, but they offloaded it onto two other companies to deal with, and then something happens. I'll give you an example. I had a cryptocurrency account with Gemini. Gemini is the company that was founded by the Winklevoss Brothers.

And they're investors in my company, Vault 12, and so of course I had an account with Gemini and I would buy a little bit of Bitcoin, a bit of Ethereum every month. They had a scheme that they introduced, which was you'll get some interest, you'll get some yield on your balance. I was like, "Yeah, well, I'm not using it. I'm just buying it to hold it. It's a savings for me."

So I signed up, I called all my friends and said, "Hey, there's a great deal. Go sign up." What I didn't read was the fine print, and I think that even if I had read all through the fine print, I probably wouldn't have made the connection that that program to get the interest would send your money, your currency over to a third party and they would be responsible and that Gemini was not responsible. So I was like, "Yeah, I really want the 5%. It's better than the bank." So I did it. And then a few years ago, if you recall, there was the FTX scandal. Of course. Yeah. So they went down and the intermediary company between Gemini and FTX was a company called Genesis, and they also went down and had to wind up operations. And so all of my Bitcoin that I had been buying for a few years was then locked up, and they said, "No, we're not going to give it back.

We don't... Sorry." I mean, they should have just given it back. They had the money to give it back, but they didn't. And so the Winkelvas brothers fought them for 18 months.

Wasim Ahmad:

Wow.

Wasim Ahmad:

They did not give up, and they got every single penny back. It's remarkable. I haven't seen anything like it, but they got every single money back. But that money was locked up for 18 months. So yes, I got the interest, but in the end, there was a danger that I just was not fully aware of, and that danger is all about business relationships being broken and then the consequences that come from that.

Alison Proctor:

What I really wanted to get to the book that absolutely encapsulates where everybody is today, and I mean everybody has some form of digital legacy to pass on to their heirs. I'll say we're, as ordinary folk, are not quite there yet. We're not okay with what we should be doing, and yet there's a whole chapter, I think, in this book that sets out how we should be looking at it and why a will is not always the best transaction and what the options are. So this is something that Vault 12 is specialist at. I was really wanting to find out a little bit more about the work that you do on the people's legacy and their digital inheritance.

Wasim Ahmad:

Yeah, so I think that in general, people don't do everything that they should be doing from the perspective of looking after the next generation. It got better after the pandemic because people were faced with very serious consequences, and unfortunately people passed away and they weren't in contact and all kinds of things. But with cryptocurrency and digital assets, it becomes a little more complicated because there's no bank that is going to... There's no institution that you're going to go to and say, "Well, so-and-so's passed away or is incapacitated and we need access to the assets," because there is not meant to be any kind of intermediary. That's the whole point. And so what that means is that the information that someone else would need to access your assets needs to be transported to that person. And while it's waiting, while you're alive, while everything

Wasim Ahmad:

Is

Wasim Ahmad:

Fine, it needs to be very, very secure because anyone who has access to that can drain your account. And then when it's transported, that also needs to be a secure thing. We were thinking about this in 2014 just as Coinbase was being funded and had just started trading, and was very clear that we, as an ordinary people, would have to worry about security and think about what happens to Bitcoin when they die. And so we've basically been the pioneers of crypto inheritance since that point. It's been over 10 years now.

Wasim Ahmad:

Wow.

Wasim Ahmad:

We were probably a little early to the market, but this now feels like a really good time to start really talking about it because we've got legislation, regulations that will go through in the US. We'll have fantastic regulations in the UK next year, so this is a good time. The trick really is, it's very simple. Cryptocurrency, again, there's no one that's governing it, so you have to provide the keys to the next person. And so that's what we do. We give you a vault, a very secure vault that uses quantum-resistant encryption to protect that information, and then we give you a way to designate who should get that and some safeguards in case they jump the gun, and then that transport happens, and then they can then move ahead. And this is independent of whatever legal structures that you might put in place, and so you do still need to go talk to a lawyer and sort out whether it's a trust or a will.

There's many different ways to structure this. An interesting statistic I found when I was looking into this was 35% of men sort out wills, 65% of women, which is good to know, but even 65% is not the majority of people. It's not a good situation. So people do need to think about this.

Alison Proctor:

And there is another book in the pipeline for people that are just beginning to understand cryptocurrency or invest in it for the first time. And again, similar in that it's going to have practical advice. It's going to be easy to read. It's written for the ordinary man or woman on the street. So that's the one in the pipeline?

Wasim Ahmad:

That's the one in the pipeline. Hopefully next month it'll come out. Okay. Well, I've finished it. I'm doing all the editing and fact checking. It's a little longer. It's 26 chapters. There's a chapter on what to do if you lose your phone, what are all the... And it's horrendous. There's 15 things that you have to do pretty much in parallel. And you'd think there should just be a button that you can press that sorts that out. So I feel like there's room for improvement from Apple and Google, but it is scary. And again, the Crypto Mondays that we were both at in August was a horrific tale of loss of all kinds of assets, including traditional bank account assets. Yeah.

Alison Proctor:

And that's when it put it in perspective that the normal banking system has a huge problem with this. We're talking about it today, so we're highlighting it, but it's a bigger problem for the normal banking system. But yeah, when you hear the story of what you need to do, because if your phone's stolen and your mind goes blank, who do you contact? What do you do? Everything's on that phone. Having that checklist and practical advice is just having the book on the shelf is going to be a great help for people as well. I mean, this is fascinating, and I know I would love to talk to you further. I'm conscious of the time, and I also don't want to let you go without my quick fire round, which perhaps I haven't mentioned this to you, but it's a little bit of fun. The reason that I really enjoy it is that it's your second nature, your choice, so it's really personal to you.

So are you ready, Wasim, for a quick fire round from me?

Wasim Ahmad:

I am.

Alison Proctor:

Excellent. Okay. Well, let's just go for it. What would you choose? Password or pass key?

Wasim Ahmad:

Oh, passkey.

Alison Proctor:

Self custody or qualified custodian?

Wasim Ahmad:

That depends on how much money we're talking about. I think it's best to split up your assets and there's going to be scenarios where it makes sense to have a trusted custodian, but not for 100%. And I think that's some of the choices that people need to make. Yeah.

Alison Proctor:

Okay. In that case, single key or multi-sig?

Wasim Ahmad:

I think that there are other ways of protecting your... There's other algorithms and choices, but yes, I think the idea of having multiple keys that are distributed amongst multiple people is a safer bet. It's less convenient. But multi-sig as a protocol has its limitations and I think that there's better ways to do things. And that's what we do in Vault 12 with Shamir's secret sharing.

Alison Proctor:

That's a really good point that you touched on there. So privacy or convenience?

Wasim Ahmad:

Well, that's the $64 million question. Everyone has to answer this for themselves. There are things that should be convenient. And I think the great thing is that Apple and Google continue to make things that should be very, very secure. They try to make them convenient. So using face ID, touch ID, using the passwords app in Apple or something equivalent is amazing. There are improvements coming in the latest operating systems that will continue to make security more and more convenient, but you don't want to just prioritize convenience. No. You don't want to write it down on a post-it note underneath your laptop. It's not a good approach.

Alison Proctor:

Yeah, absolutely. Okay. London or New York?

Wasim Ahmad:

Well, I do love London and I do love New York, but you can't beat London. It's come such a long way from when I was growing up there and I was lucky enough to be at the Olympics in 2012 and it was just so marvelous. And I think London has continued to grow and New York in the US is the greatest city in the US.

Alison Proctor:

I mean, I've got to agree, you have the best of both worlds. I just think it's an amazing position to be in. So that leads me to startup or boardroom.

Wasim Ahmad:

Well, startups have boardrooms too, but I love, love, love startups and the smaller, the better. It's a lot of hard work, but the thrill of growing a company, there's nothing like the thrill of growing a company.

Alison Proctor:

Yeah, having that small dynamic that can move quickly. So I think I'm with you on that one. Physics or French?

Wasim Ahmad:

Well, I think that in hindsight, French has been the most impactful thing that I did in terms of using it in subsequent years. But at the same time, if you look at the different types of technologies that are being developed, and when you look at the backgrounds of the people developing, for some reason they're all physicists, not every single one, but there is a tremendous number of physicists, mathematical physicists, which is what I started to do at Sussex. So I think I got an ideal mix, a language and the language of the world, which is physics, like the physical world.

Alison Proctor:

Gosh, which give you an amazing view of the world as well. So really, I think my final question for you, circling right back to your childhood, would it be earth or space?

Wasim Ahmad:

Well, I've not given up on space. I have my shares of Virgin Galactic. I don't know if they're going to be the ones, but I think I have a chance and I will take it if it comes my way.

Alison Proctor:

Wow, that's amazing. So I am actually going to say thank you so much for your time. Perhaps we can speak again in the future when you have your second book, because I want to come back also to those secrets that Bulb 12 does and dig down a little deeper. But for now, I just want to say thank you so much for your time and how enlightening it's been for me as well.

Wasim Ahmad:

Thank you so much, Allison.

Alison Proctor:

If you enjoyed this episode, please like, share, and subscribe and join me for more conversations from blockchain to Bitcoin and everything in between.

Wasim Ahmad:

This podcast is for information and entertainment purposes only and does not constitute financial, investment, legal, tax, or any other form of professional advice. Nothing in this episode or any other should be taken as a recommendation, endorsement, or invitation to buy, sell, or hold any cryptocurrency, tokenized asset or other investment or to engage in any specific strategy. Views expressed by the hosts and guests are personal opinions only and do not represent the views of any organizations they are affiliated with. The content may be inaccurate, incomplete, or become outdated at any time, and no liability is accepted for any loss or damage arising from reliance on it. Listeners should always do their own research and seek advice from an appropriately regulated professional before making any financial decisions.