Lava, the Bitcoin-backed loans software company, sparked controversy among Bitcoin CEOs recently, after a series of announcements following a $200 million fundraise. The company, led by Shehzan Maredia, had previously been marketed as a self-custody wallet and platform, mirroring the functionality of DeFi or decentralized finance products. The new update to the Lava app changed the custody model to a fully custodial and trusted fintech platform, raising questions about the lending company’s legal status.
The announcement about the fund raise drew the attention of Bitcoin industry leaders, who raised questions about the nature of the investment and the implications of the change in custody model, which Shehzan confirmed in follow-up X posts.
“The security of our users and their funds is our top priority. Every change we’ve made is guided by that. Lava no longer uses DLCs — discrete log contracts — for loans because the technology doesn’t meet our security standards. Our team built the largest application using DLCs, but we discovered vulnerabilities that we weren’t comfortable having (ex., client-side key risk, hot keys).”
Shezhan added that “Risks we previously thought were impossible, such as thinking oracles couldn’t be manipulated to liquidate individual users, we figured out were possible in practice. We are unwilling to compromise on security for our users at any level, and we take a very holistic view on removing trust, dependencies, and counterparty risk.”
DLCs are a kind of Bitcoin smart contract that can anchor the spendability of a bitcoin balance to an external event, such as the price of bitcoin in dollar terms, through the use of a third-party “oracle”. Oracle-based decentralized finance technology (DeFi) was recently exploited, resulting in a 20 billion dollar liquidation event, specifically targeting Binance’s stablecoin orderbook.
Their previous technology, which Shehzan says is still used by users who did not choose to update to the new version of the software, gave end users cryptographic control over part of the account via 2 of 2 multi-signature DLC smart contracts, limiting how the Bitcoin put up by users as collateral could move.
Lava’s terms of service still claim — as of the time of writing — that the company has “no exclusive custody or control over the contents of your wallet and has no ability to retrieve or transfer its contents.” Yet this contradicts statements made by Shehzan in recent days regarding the company’s pivot to a cold storage custody model.
Despite Shehzan’s clarification and posts on X, critics were skeptical of the reasoning. Some users were alarmed at the fundamental change in the custody model, which caught many by surprise and was communicated poorly, if at all.
One user, Owen Kemeys of Foundation devices, wrote, “Did Lava get my informed consent?” sharing a series of screenshots of the app update messaging, which says nothing about the change in custody model.
Will Foxley of Blockspace media complained, “Why did they roll legacy loans over without contact first. Plus, how did they do this if it was DLCs? Did I sign a bunch of pre-signed transactions that gave them control over the entire loan?”
The pivot has also raised questions about the company’s regulatory status and licenses, as centralized and custodial bitcoin-backed loan providers are arguably regulated under more traditional frameworks. Such regulations tend not to apply to DeFi-style self-custody products, precisely because user funds remain under user control, rather than under the complete control of a third party. With trust custodial trust becoming the Lava model overnight, what regulatory status does the company fall under?
Jack Mallers, CEO of Strike — a competing Bitcoin company with a Bitcoin-backed loans product line and a market leader — questioned the move, particularly in terms of licensing, which Strike has been working to acquire for years:
“If they’re custodial, how is what they’re doing legal?
Strike has been acquiring licenses for years. You can’t just “flip a switch” from non-custodial to custodial and start offering brokerage, trading, or lending services. That’s unlicensed activity, and it’s very illegal.
What licenses does Lava actually have that allow them to do what they’re doing?”
Bitcoin Magazine has not independently verified Lava’s licensing status. When asked for comment on the legal strategy and status of Lava, Shezhan pointed Bitcoin Magazine to the company’s FAQ, which does not appear to address the questions directly at all.
The nature of the investment announced by Lava was also called into question last week, as Cory Klipsten, CEO of Swan — a likely competitor to Lava — has also been actively engaging the story, suggesting it is specifically a line of credit agreement rather than an equity-style VC investment into the company. When asked, Shehzan told Bitcoin Magazine, “we raised both venture and debt,” referring to the 200 million raise announcement, though he did not go into details.
While the story is still developing and mostly involves discussions and debate on Bitcoin Twitter, the drama highlights the high value Bitcoiners place on self-custody and the risk of closed-source crypto applications, which can be updated without proper transparency or information being delivered to users about how their capital is secured.