Agents Propose, Humans Approve: Ledger's Kasper Luyckx on Custody After Coldcard

Every crypto holder relies on one thing and rarely thinks about it until it fails: how the keys are kept safe. Just days after the Coldcard hack drained over $100 million from users who appeared to do everything right, Ledger's Head of EMEA Kasper Luyckx joins Stefan to explain what really keeps digital assets safe, from hardware signers to bank-grade HSMs. Kasper, who has seen custody from both sides after years at UBS and Crypto Finance, walks through what actually went wrong at Coldcard (a seed generated in software instead of the secure chip, with far too little randomness), why it was an isolated firmware failure rather than an indictment of self-custody, and how Ledger's in-house attack lab, the Donjon, works. From there the conversation opens up: the real gap between retail and institutional custody, where multisig, MPC and HSMs fit, and the big shift from simply storing crypto to on-chain payments and tokenized securities. They also dig into AI on both sides of security, including Ledger's new Agent Stack, where AI agents can propose transactions but a human still approves each one on the device. The throughline: as AI makes vulnerabilities cheaper to find, keeping a human in the loop matters more than ever, and most people will end up holding value in a hybrid of self-custody and trusted custodians. Enjoy the episode.