Imagine you have 2 sets of keys to your house and if you lose both then your house is not yours anymore. That's what keeping your money outside an exchange seems like to me. Exchanges are easy and familiar to people.

If there was some secure way to do password recovery that was built into the currency that might be a game changer. That might be impossible by definition, not sure.

I think you definitively could make something like Keybase on Bitcoin, by using multiple third-party institutions (chosen by the user) as a fallback.

When sending coins to your storage address, you'd say "anyone can use this money if they have this private key OR if they get a digitally-signed certificate from 3 out of 4 of these keys (A, B, C, D)". Those keys could belong to different institutions (or persons) that would declare they vouch for your identity.

Then if you lost your key, you'd go to each of them to get your certificate signed and could then use the coins again.

--

Of course, this means that if those institutions colluded, or all got hacked, you could still lose your coins, but it'd be harder than just keeping them in an exchange.

It's called "multisig wallet", and a lot of reputable online wallets implement this.

Instead of doing what you suggested, normally it's 2 of 3 where it's your cold wallet, your hot wallet, and the online wallet provider.

Too bad Bitcoin uses ECDSA instead of Ed25519 (or any other signature algorithm supporting threshold signatures). With threshold signatures, you don't even need something in the wallet saying "any N of the following M", you could just give secret shares to those M parties, and any N of them could collaborate to sign something using your single public key.

You could just do that anyway by running Shamir's Secret Sharing Scheme on a Bitcoin private key, splitting the key into M parts where any N of M parts can be combined to recover the original private key.

That's a fair point, but threshold signatures are more generally useful, such as N of M board members authorizing payment to X, without having to place trust in a single board member not to change the transaction to a different amount or address.

Do you have M friends, of which you're certain at most N-1 would collaborate to steal from you and/or get hacked? In that case, you can do secure password recovery.

Shamir's secret sharing algorithm can be applied over many groups other than GF(2^N). In particular, you can generate a polynomial of degree N where F(0) is your ECDSA private key, and for 1 < x < M, tell trusted party number x that they're party x and F(x) = y. Cooperation/collusion among any N of the M parties is sufficient to reconstruct the polynomial and calculate F(0). However, N-1 collaborators learn nothing about F(0), as long as you've generated all of your coefficients randomly and uniformly over the size of the subgroup generated by your elliptic curve's generator.

You can even have N parties each generate their own secret random polynomial f of degree N, and publicly share f(0)*G and privately share f(x) with party x. You add up all of the publicly shared elliptic curve points to get a public key for which no one party knows the secret key. Each party remembers the sum of the f(x) secrets they've been told. For polynomials, f(x) + g(x) + h(x) = (g+g+h)(x), so any N of the participants can collaborate to calculate the previously unknown polynomial for which f(0) is the private key. You need to first share Pedersen commitments of the public f(0)G values, perform a sanity check on those, and then reveal the f(0)G values and perform some more sanity checks in order to rule out cheating. See https://duckduckgo.com/?q=gennaro+distributed+key+generation

Once you have your public key for which nobody knows the private key, you can perform the same procedure to generate the random R value of the (R,S) pair of a Schnorr signature. Each party can then perform a Schnorr signature on H using their secret share of R and their secret share of the public key. They each reveal their signatures, and any N of those signatures can be used to reconstruct a polynomial where F(0) is the S value in the (R,S) signature on H. At the end, all of the sub-signatures and the final signature can be made public without anyone learning anything about the secret values. This is called a threshold signature scheme. (There are other threshold signature schemes. I had to implement threshold RSA in Rivest's 6.857 class.)

Unfortunately, ECDSA isn't a Schnorr signature scheme, but Ed25519 is. Any coin built using Schnorr signatures for wallets would allow you to construct threshold wallets where any N of M parties can collaborate to spend from the wallet, but generating transactions doesn't leak information to anyone about how to generate transactions alone.

I should add that with Schnorr signatures, if you have a bunch of signatures on the same H, you can add up all of the (R,S) pairs of signatures, and the result is a single signature where the public key is the sum of all of the public keys of the N signers. This allows very compact storage and verification of multi-party signatures. All of these nice properties are just consequences of the linear composability of Schnorr signatures.

BitCoin, at present, only supports ECDSA signatures, which aren't linearly composable.

I can't believe this is downvoted; this has been a mantra in the cryptocurrency community for years. If you don't control your private keys, you don't control the coin.

Traders take a risk in putting funds, fiat or otherwise, on an exchange. Many use domestic exchanges that have higher fees in an attempt to mitigate this risk. They are all well aware, but see the reward to be worth it.

Bruh if it's accepted then why did people just lose over a half a billion $ storing their cryptocurrency in one.

I don't hold a lot of crypto or anything but one of the most repeated sentiments in communities, guides etc is "don't store money in an exchange". People do it, just like people sometimes buy drugs on DNMs without using PGP encryption, and /usually/ it doesn't end badly for them, but the worst-case scenario (exchange hacked or exit scams and arrest respectively) is pretty bad.

The worst-case scenario of losing access to your personal wallet is pretty bad, too.

Why do people drink and drive?