Jack Kubinec

Quantstamp is rolling out DeFi hack protection for US-based users.



The product will recoup clients of the crypto asset security firm in the event their funds are lost in an exploit, and is the latest such attempt to insure users as hacks remain a prevalent risk. But previous hack coverage products have encountered hurdles, and it remains to be seen whether Quantstamp can clear them.



Quantstamp was founded after the 2016 DAO hack as a security auditing platform and began considering providing hack coverage as early as 2018, according to Sebastian Banescu, the company’s head of insurance. The product, which Banescu compared to Apple Care for <a href="https://blockworks.co/tag/defi">DeFi</a>, is launching in the US with approval from the North Carolina Department of Insurance.



Users can pay Quantstamp to guarantee their holdings on Aave, Compound, Curve, Lido and Uniswap. The company said the product would cost 2.55% to 4.28% of the covered amount.



Quantstamp is not the first company to try insuring users against hacks. A report from the DeFi protection provider Opencover <a href="https://www.certik.com/resources/blog/1dloJV023Tm4ajXiluRctb-hack3d-the-web3-security-quarterly-report-q3-2023">listed</a> 23 DeFi risk coverage projects and $34.4 million in claims paid out last year. <a href="https://blockworks.co/news/mixin-network-200m-loss-hack">Hacks remain a major risk for DeFi investors</a>, with $699 million being <a href="https://www.certik.com/resources/blog/1dloJV023Tm4ajXiluRctb-hack3d-the-web3-security-quarterly-report-q3-2023">lost</a> to hacks in the crypto space in Q3, according to a report from Certik. Still, hack coverage has seen uneven success so far.



Jeremiah Smith, CEO of Opencover, said that there is currently more capital available to underwrite hack risk than there is demand for hack coverage.



Read more: <a href="https://blockworks.co/news/upbit-cold-wallet-policy-hackers">Upbit updates cold wallet policy in bid to thwart hackers</a>



“So far, the main challenges [are] on the risk pricing,” Smith said. “If the yields are low, and the premiums are high, it’s not always worth it to insure a position on one of these protocols.”



Banescu said users will be drawn to Quantstamp because of its regulatory status.&nbsp;



“If we as an entity who’s offering this service don’t want to pay out, there’s a regulator who can force us to pay out,” Banescu said.



Smith said prices for DeFi coverage should decrease as protocols stop updating as frequently, since exploits often happen as a result of updates. Uniswap v3, for instance, has yet to be hacked since going live in 2021, meaning insurance providers face less risk when underwriting assets on the protocol. 



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

hack

DeFi security firm Quantstamp pilots hack protection program

Ben Strack

Just days after a judge ruled on the years-long case involving SEC and Ripple, the regulator hit a blockchain security company with charges of alleged violations going back six years.



The SEC charged Quantstamp with conducting an unregistered initial coin offering (ICO) of crypto securities in 2017, according to a July 21 cease-and-desist order.



Quantstamp allegedly raised more than $28 million by selling QSP tokens to roughly 5,000 investors, according to the legal <a href="https://www.sec.gov/files/litigation/admin/2023/33-11215.pdf">documents</a>. The company had planned to use the ICO proceeds to develop a protocol on the Ethereum blockchain that would provide automated security audits of smart contracts, it added.



A spokesperson for Quantstamp did not immediately return a request for comment.



The firm allegedly led QSP purchasers to expect the tokens’ value to increase with the success of Quantstamp’s enterprise. It took steps to make the tokens available for trading on third-party digital asset trading platforms after the ICO, the SEC said in a news release last week.&nbsp;&nbsp;



Quantstamp claimed that the unregistered sales of QSP were exempt, but “failed to qualify for any exemption to registration,” the SEC said in a news release last week.&nbsp;



It agreed to settle the charges without admitting or denying the SEC’s findings — paying nearly $2.5 million in disgorgement and prejudgment interest in addition to a $1 million civil penalty.&nbsp;



The settlement came about a week after a <a href="https://blockworks.co/news/judge-rules-ripple-xrp-not-security#">US district judge made a long-awaited ruling</a> on SEC allegations that Ripple’s sale of its XRP token was an unregistered security offering.



The Howey test — named for the 1946 case SEC v. W.J. Howey Co. — is used to <a href="https://www.sec.gov/corpfin/framework-investment-contract-analysis-digital-assets">assess</a> whether a transaction is an investment contract, and therefore a security, under federal law. Part of the test is whether a purchaser has “a reasonable expectation of profits to be derived from the efforts of others.”



The court found that while XRP is <a href="https://blockworks.co/news/judge-rules-ripple-xrp-not-security#">not a security when traded on exchanges</a>, institutional sales of the asset constitute an unregistered securities offering.&nbsp;



Read more: <a href="https://blockworks.co/news/exchanges-relist-xrp">Exchanges rush to relist XRP, but an SEC appeal is possible</a>



The judge noted that “reasonable investors…in the position of the institutional buyers, would have purchased XRP with the expectation that they would derive profits from Ripple’s efforts.”



The SEC said in its claims against Quantstamp that QSP purchasers “reasonably expected to profit from Quantstamp’s efforts.”



“Quantstamp indicated that the protocol it planned to develop would be lucrative because ‘the potential costs of smart contract failures will also grow,’” the cease-and-desist order states.



The company’s automated smart contract security auditing platform, completed in June 2019, is no longer in operation.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>