Sunny Ray sits down with Loïc, cofounder of BitVault, to discuss how people actually lose their Bitcoin and what can be done to protect them. BitVault is a multi-signature security setup with time delays built into the transaction itself, so that a stolen key or a coerced transfer can be noticed and cancelled before funds move. Loïc explains that attackers typically need only minutes, whether they are hackers or people showing up at the door, and that a delay of hours to two weeks changes that equation. He walks through a theft scenario with a spouse or business partner, explains why a seed phrase in a shoebox is a single point of failure, and describes how users can split funds across several vaults with different delays. He also covers the early community-driven launch, the use of air-gapped signing devices, and the risks seen in France, where physical attacks on holders are a growing concern. The conversation closes with plans to build tools for professionals such as financial advisors and notaries, who could hold one key for clients without being able to move funds alone.
Thieves need minutes to drain a wallet. BitVault's time-delayed multisig gives Bitcoin holders days or weeks to stop them.
What is BitVault and what problem are you solving?
I believe holding your own key shouldn't mean betting everything on never being hacked, robbed, or making a mistake. BitVault is multi-signature security with time delays built into the transaction itself. If someone steals a key or forces you to send Bitcoin, the delay gives you time to see it and stop it.
When did you realize time delays change everything about theft?
When we looked at how theft really happens, an attacker needs only a couple of minutes, whether it's a hacker or someone at your door. With BitVault, every payment has to wait for the delay you choose, by default from a couple of hours to two weeks. You get warned right away and can cancel.
Can you walk me through a theft attempt?
Take you and your spouse or business partner. Your signing devices are in different places. If you're attacked, your partner gets a secret notification and could even send the police. During the delay, say two weeks, you can cancel or redirect the funds. The transaction is a pre-signed PSBT, so signing and settlement are separated in time.
How many people keep their seed phrase in a shoebox?
More than I'd like, often from an older generation. It feels safe, but a seed phrase is everything or nothing. If the shoebox burns, the Bitcoin is gone, and if a burglar finds it, it's theirs. That's why every BitVault vault has at least three keys, so losing one doesn't stop you and one stolen key isn't enough.
How do you choose the right delay without making everyday transfers frustrating?
You can have as many vaults as you wish. For example, 80% of your holdings might sit in a vault with a two-week or two-month delay, 5% in a vault with a two-day delay, and a small part with an hour or two. You must decide the conditions before sending Bitcoin to the vault.
What kinds of attacks does this protect against?
In France and elsewhere in Europe, people are researched online and attacked at home. Those attackers aren't in the business of waiting two weeks, so they move on if it takes too long. It also covers remote hacks like the Coincard case, where there were no enforced time delays and funds were lost directly.
If someone already uses multisig, what risk does the delay cover that extra keys don't?
A robber who knows you use multisig can grab you, take your first signing device, then force you to go to the second one, and the funds are gone. The time delay adds a separation between the moment you wish to send funds and the moment the transaction is actually confirmed.
What do the next 90 days look like?
We'll focus on professionals. We are building solutions for institutions, financial advisors, notaries and others so they can hold one key for their clients. Families or businesses get a trusted professional on their side, and the professional can never move the Bitcoin alone, which is an extra layer of security.
Building something daring? Sunny talks to founders like this every day. Fifteen minutes to see if your story belongs on the stage.
Claim your pre-interviewSend a founder here and we will know it was you.