We do not build for today. We build for the day the custodians fail. Morgan Stanley just announced a dual ETP tracking Ethereum and Solana, a move hailed as institutional adoption. But from my seat—after three weeks auditing the Parity Wallet multi-sig and watching decentralized promises collapse into centralized custodial trusts—I see something else: a new attack surface hidden beneath the marketing.
Hook: The Custody Disconnect
Here’s the first anomaly. The ETP does not hold ETH or SOL directly on-chain for each investor. It issues a paper representation—a tokenized IOU—backed by a pool of assets held at a custodian. This structure creates a fundamental disconnect: the investor does not own the hash; they own a claim. The art is the hash; the value is the proof—but the proof here is a balance sheet, not a Merkle root.
During my 2018 audit of the Parity Wallet, I learned that multi-sig schemes fail when the ownership update sequence is flawed. The same principle applies here: the ETP’s ownership update is the legal title, and the smart contract that governs the underlying is irrelevant. If the custodian’s hot wallet is drained, the ETP holder gets a discount on their loss. Reentrancy doesn’t care about your brand.
Context: The Product Mechanics
Morgan Stanley’s ETP is a regulated fund that buys and holds ETH and SOL, likely with a custody partner like Coinbase Custody or Fidelity. It trades on traditional exchanges, giving pension funds and family offices exposure without managing keys. This is a classic “wrapped” model—similar to WBTC but with a centralized issuer. The yield? None. There is no staking. The validator sets get their fees from the underlying chain, but the ETP holder does not participate. It’s a frozen asset: no staking yield, no DeFi composability, no on-chain governance.
The Solana choice is significant. Solana was labeled a security by the SEC in their lawsuit against Binance. Morgan Stanley’s legal team must have found a structure that sidesteps that—likely using a Cayman trust or relying on the Howey test’s “common enterprise” loophole. But the risk remains: if the SEC wins that case, the ETP becomes a bag of illegal securities. That’s regulatory reentrancy.
Core: The Technical Debt of Custodial ETPs
Let’s go deeper into the custody model. Most institutional crypto ETPs use a “cold storage” approach: the custodian holds private keys in hardware modules, air-gapped from any network. But the logistics of daily creation/redemption force periodic moves to hot wallets. In 2022, I was part of a due diligence team reviewing a major custodian’s infrastructure. We found that the transition from cold to hot introduced a window of vulnerability—the same kind of state transition error I saw in the Parity reentrancy bug.
The ETP’s underlying asset—say, 10,000 SOL—is moved to a hot wallet to facilitate a redemption. For a few blocks, that SOL sits in an address whose private key is online. If that key leaks, or if a smart contract on that network has an exploit (Solana’s history includes multiple), the funds vanish. The ETP’s insurance may cover it, but insurance is not a cryptographic guarantee.
I ran a simulation of this scenario with a custom Solidity model last year. The probability of a custodial failure over a 5-year period, given 100 custodian hot-wallet transfers per year, is higher than many risk managers assume. It’s not a matter of if, but when.
Moreover, the ETP removes liquidity from the underlying DeFi ecosystem. When institutions buy through an ETP, they are not providing liquidity to Uniswap or lending on Aave. They are pulling tokens into a custodial black box. This reduces the on-chain liquidity depth, making the network more susceptible to slippage during black swan events. The ETP is technically a drain on the public mempool.
Contrarian: The Hidden Centralization Vector
The market celebrates this as institutional validation. I see it as a centralization vector. Morgan Stanley’s ETP concentrates a large volume of ETH and SOL into a single legal entity’s control. That entity can be compelled by a court order to freeze assets—something that happened with Canadian convoy protests and crypto wallets in 2022. The chain itself becomes censored at the application layer.
Compare this to self-custody or a properly designed staking derivative. A staking derivative like Lido’s stETH maintains composability and allows the underlying asset to remain active in the ecosystem. The ETP does not. It’s a dead token. The only proof of ownership is a piece of paper—or a digital record on a traditional settlement system. That is not the promise of blockchain.
Another blind spot: the ETP’s creation and redemption mechanism. If the ETP is open-ended, authorized participants (APs) can create new shares by depositing ETH/SOL with the custodian. This process involves a delay—often T+1 or T+2. During that delay, the price of the underlying can move significantly. This exposes APs to arbitrage risk, which they hedge by shorting the underlying. That short pressure can suppress the price during periods of high creation. The ETP becomes a drag on the market, not a driver.
Finally, the Solana ETP is particularly fragile. Solana’s network has experienced multiple outages, often due to validator coordination failures. An ETP that relies on the network for price discovery or settlement is vulnerable to these outages. If Solana goes down for 6 hours, the ETP’s NAV becomes stale. The market maker cannot arbitrage properly. This creates a discount or premium that harms retail holders.
Takeaway: The Real Test Is Staking
The true technical judgment on this product will come when (if) Morgan Stanley adds staking. Without staking, the ETP is a fancy IOU. With staking, it becomes an active participant in the protocol, but also introduces slashing risk—the ultimate reentrancy failure for a custodial entity. I have seen staking service providers lose millions due to misconfigured validators. Can a centralized entity handle that complexity over decades?
We do not build for today. We build for the day the custodians fail, the regulations shift, or the network halts. Until the ETP holds the hash itself—or at least passes the staking yield through—it is just a certificate of victimhood in waiting. The art is the hash; the value is the proof. And proof, in this case, is not a custodian’s ledger. It’s a checkable on-chain state.
