What good is a high yield on an empty account?

Say there is an interest-bearing account that pays even say some exorbitant number, 10%, 20%, whatever. Do you know what the interest payment is if there's no money in the account?

Zero, of course. Which is something to keep in mind when you think about competition from stablecoins and other digital assets.

In case you missed it, a bitcoin-only "wallet" called Coldcard suffered a major data breach that cost users at least $100 million worth of their bitcoin. It may be the biggest exploit of a wallet maker in crypto's history. Usually attackers go after big targets, centralized exchanges, decentralized exchanges, gaming platforms, those kinds of things. Somebody tried to extort Coinbase last year, for example. The website Rekt maintains a hack leaderboard, and the largest climb into the billions of dollars. Going after individual wallets is a much harder way to get big money, unless you figure out some way to compromise the security of the wallets themselves. 

Coldcard is a little piece of hardware that stores bitcoin balances (and only bitcoin balances; one of its security features is this bitcoin-only focus). The idea is that rather than, say, having your crypto stored in a Coinbase account, you have this physical piece of hardware that can be disconnected from the internet. Safe, right? The company that makes it, Coinkite, calls it "a Swiss bank account in your pocket," and prominently displays all the declarations from outside sources that Coldcard is the best bitcoin wallet, like, ever. 

The hackers found a way to access what's called the seed phrase, a 12-word combination, to these wallets. Think of it like a physical key to a physical lock. But the hackers figured out a sure-fire way to manipulate Coinkite's code to figure out the seed phrases to scores of wallets. The reason this works so well with bitcoin specifically is that the entire network is set up such that once a transaction is confirmed it can never, ever be reversed. It's part of the way the network ensures nobody controls it. In other words, this is a feature, not a bug. But it's a feature that can be, and often is, exploited.

Okay, let's come back to the real world, and why this matters to banks. Now, if my bank were to fail on Friday, my money would still exist and I'd still get it back after the bank's resolved. This is what FDIC insurance guarantees. If my bank account gets compromised, the account can be frozen and (depending on details) transactions can be reversed. This is what security in the real world looks like. Bad things can still happen, but there are safeguards.

In the crypto world, security looks like Coldcard. A single product is all that stands between you and the hackers. If they get into your device, it's all gone. No FDIC insurance. No chargebacks. It's just, gone. This is what "getting rekt" means in the crypto world, and it is a very real risk. I know two people personally who were early bitcoiners, really smart, knowledgeable guys who both built businesses – the kind of people to whom you don't need to explain the meaning of "seed phrase" – who both got hacked and lost small fortunes. If even professionals struggle to secure their assets in the crypto world, amateurs have virtually no chance. 

This is a headline problem for crypto as it tries to get into the mainstream. A 4% annual yield is a nice enticement but it's easier and safer to get the same thing from a CD. Which is why, ultimately, no matter what happens with the CLARITY act (and it's getting awfully close to nothing happening), crypto firms will have to offer more than just a high-ish yield to attract mainstream depositors.