

Jonathan Galea
1.2K posts

@ImpermanentGain
Lawyer who survived multiple winters, and lived to tell the tale. Partner at @CahillNXT (ofc, my views only here).




1/ Yesterday’s bipartisan vote on the Clarity Act was a historic step forward. But digesting 309 pages of technical legislation – how’s that going to work!? To help everyone dig in, we developed in interactive map of Title 1: static.cahill.com/cahillnxt-clar…. Come play!



Clarity Act will enable buying and selling bitcoin without KYC/AML, it’s a roundabout repeal of the BSA by way of stablecoin secondary markets, with deposit banks as collateral damage.

Jonathan Galea, Partner, Cahill Gordon & Reindel (UK) LLP "Multi-jurisdictional compliance may therefore prove considerably more complex in practice than the shared principles might initially suggest.”

The US has Uniswap, Circle, Chainlink, Hyperliquid, Phantom, MetaMask, etc. Asia has PancakeSwap, Tron, Trust Wallet, SushiSwap, Meteora, Aster, etc. EU has _______?














PROTOCOLS SHOULD USE DEDICATED COMPUTERS FOR MULTISIG OPERATIONS Many protocols are not doing this right now - if this is you, adjust with urgency An "everyday computer" is one that is used for browsing the internet, coding, running Claude Code, joining meetings, reading telegram, etc. A "dedicated signing computer" is one that has the bare minimum set of tools for preparing transactions, handing them off to a hardware wallet, and sending the signed version to the blockchain. It is not used for ANYTHING other than this. In the wake of any major hack, there are a variety of storylines and contributing factors. The Drift hack had many contributing storylines, but in my opinion the single most important action item for other teams (and one which currently many teams deviate from) is - use dedicated signing computers. Why? Because everyday computers can easily be compromised. (The Drift hack featured several interesting examples of how an everyday computer got compromised, and we hear about others on a nearly daily basis.) When a computer is compromised, hackers have full control and can make anything appear to be true. The rest of the multisig procedure (e.g. verifying that a particular set of instructions produces a particular hash) becomes unreliable, since the computer from which you are viewing the operation is no longer a reliable narrator. When you plug a hardware wallet into a compromised computer and proceed to sign, all bets are off. The hacker can present a malicious payload to the device, causing you to sign what the hacker wants. DeFi Protocol teams have a massive checklist of items to harden their security. (Two great checklists are linked in the next thread.) But the checklist can be overwhelming, and it is important to prioritize. If your team is using everyday computers for signing, make it a priority to switch to dedicated devices asap. We'll have more to say shortly on how the Monad Foundation is encouraging teams to adopt this practice.