.png){kind=logo}
.png)
Community AMA Recap: Security and Self-Custody in COCA
On November 6, we went live on X for an AMA on security and self-custody. Vasili Paulau, our CEO, answered your questions, and Kate Alippa, our CMO, hosted the session.
In our recent survey, over 60% of you said privacy and security matter a lot to you. So we gave the topic a whole session: where your money actually sits, who holds the keys, how to protect your account and what's coming next. We started with the questions you submitted in advance and the ones we hear most often in our community chats, and closed with a question from the live comments.
You can watch the full stream on X. Prefer to read? Here's everything you need to know 👇
💸 Is my money safe?
Q: Sometimes I can't see my balance or transaction history, or stake and sell my $COCA. Is the app still secure, and can bugs like these put my money at risk?
Vasili Paulau:
We should separate two things here: what you see in the app and what happens on-chain. Some operations take a while to process, and sometimes the blockchain itself doesn't work the way it should. We've had a few issues with Base, for example. In those cases, the app can lag behind, but your funds are safe at every stage. You might get a push notification about a deposit and not see it in your balance right away, because it isn't fully processed on-chain yet. I know this can be confusing. We're working on an update that will show you every step of a transaction while it's being processed, and I hope the team can improve this within the next few months.
Q: What happens if my money seems to disappear during a USD to EUR exchange? Is it still safe?
Vasili Paulau:
This is one of the cases I just mentioned. The exchange runs through a set of smart contracts: your USD, which is USDC under the hood, is exchanged for EURC. You send your USDC to the smart contract, and it can take some time for the EURC to appear in your balance. So you might see, say, 500 USD leave your balance before the euros show up. Within the next few updates, we plan to credit the exchange in advance at the preliminary rate, so you'll see the funds while they're still being processed. And since the whole logic runs on-chain through autonomous smart contracts, your funds are safe and nothing will be lost. Even if something goes wrong with Base or another blockchain, the exchange will still go through in the end.
Q: Where exactly are my funds kept: in the wallet, on the card or in a bank account?
Vasili Paulau:
Your funds sit in your smart contract wallet, which is created for you when you set up COCA. It's a little different from the classic non-custodial wallets you might know, like Trust Wallet or MetaMask. It's still non-custodial, just a different standard. Both your USD and EUR are stored there until you make an operation that needs processing. Say you send a SEPA transfer to the IBAN we've created for you. The money arrives as euros in your COCA account, and from that moment it sits in your smart contract wallet, not with the bank provider that processed the transfer and issued your IBAN. Then you pay for groceries with your card. Only the amount you've authorized for that payment is deducted from your smart contract wallet, and Visa processes it, to simplify a bit. So if a bank or card provider ever denies a service, only that specific transfer can be blocked. The rest of your funds stay in your smart contract wallet, which you own and which you have the private keys to in the Security section.
Want to go deeper? Vasili recommends our docs: Where is my money stored and who controls it?
🔐 How self-custody works in COCA
Q: COCA never gave me a seed phrase. So who holds my keys, and can Privy or COCA move my money?
Vasili Paulau:
There's indeed no seed phrase in COCA, and you don't get one with Privy either. It comes down to how distributed signatures work. With a classic non-custodial wallet, a seed phrase is generated first, and your private key comes from it. A distributed signature works differently: several shards together form your private key, so there's no seed phrase in the equation. Does that make it less secure? No, it's completely secure, and I'd call it the next level of private key generation. So who holds the keys? You could say Privy does, but that's an oversimplification. Privy holds the keys in a distributed way: the shards are stored across several devices in secure enclaves, so neither Privy nor COCA has access to your private key. The only time your full private key appears in plain text is when you export it, and that happens locally on your device. Right now, you can do it in the COCA app or directly through Privy. If something happens to COCA, any of you can go to Privy's portal and access your keys at any time. Your keys aren't locked in with COCA, and only you have access to them. So today, COCA is fully self-custodial.
Q: When will COCA be fully self-custodial, so I can use third-party software to control my Banking contract? I'm thinking about sending unsupported tokens by mistake, or COCA suddenly shutting down.
Vasili Paulau:
COCA is already fully self-custodial: any of you can get your keys at any moment. In the Security tab of your profile, you can view the keys for both your Crypto and your Banking account. The tricky part is that your Banking account is a smart contract wallet. You do have the private key, but you can't simply import it into MetaMask and see all your funds. To simplify, that key is an authorization key for your smart contract wallet, and most traditional wallets like MetaMask or Trust Wallet don't support smart contract wallets by default. So we plan to release an open-source tool on GitHub, most likely next year, possibly as early as the first quarter. You'll be able to import your Banking private key and do whatever you want with your funds, locally. If you're experienced, you can already work with those keys yourself. If you're not a crypto guru, it's harder to do manually if something happens, and that's what the recovery tool is for.
You can read more about your Banking key and the recovery tool in How private keys work?
Q: I exported my private keys. Is my COCA account still safe to use?
Vasili Paulau:
Yes, as long as you handle the exported keys carefully. If you store them somewhere others can get to, the key gets exposed and your funds could be wiped out. Ideally, write your private key down and keep it in a secure place, for example a password manager: most of them can already store crypto wallet keys. Don't keep it anywhere public, and don't send it to yourself in a messenger, by email or in any public chat. As long as you handle the export properly, your funds are safe.
📱 Protecting access to your account
Q: If I lose my phone or someone gets into my email, can they access my COCA account? What should I do first?
Vasili Paulau:
Right now, you sign in to COCA with your email through Privy. So make sure your email is secure and nobody else has access to it. Almost every email service lets you add an extra layer of authorization, and I highly recommend all of you do that. If something gets exposed, the first step is to change the access to your email. In the near future, we plan to add two-factor authentication to COCA: passkeys and authenticator apps like Google Authenticator. We also plan to let you freeze your account yourself, with your permission and for a set period of time. There's a lot more coming for security, and I'm happy to share our plans in a separate AMA or roadmap session.
Q: Will COCA add 2FA for card payments and transfers?
Vasili Paulau:
For card payments, 3D Secure already works. I've seen questions from the community about why some services don't ask for it. That's how Visa works: certain authorized services are whitelisted by Visa and other payment networks, so you don't need to enter a 3D Secure code there. Most services still ask for it, and that keeps your online payments secure. For transfers, we plan to add 2FA with passkeys, which are common nowadays and super convenient in my opinion. We'll also add authenticator app support for those of you who want this additional layer of security.
Q: Are you planning to add a way to see all devices logged into my account and log out of them?
Vasili Paulau:
Short answer: yes, we want that. We call it session control. You'll see every session where COCA is running and which devices have access to your account. You'll be able to end those sessions, add new ones and see when someone last logged in from a specific device. We plan to add it, and we'll keep you posted.
🪪 KYC and taxes
Q: Why do I need KYC if COCA is self-custodial?
Vasili Paulau:
This goes back to how your funds are stored. When you create a fresh new COCA account, the first thing you get is your self-custodial smart contract wallet, and as many of you remember, you don't need KYC for it. You can bring your assets to COCA, earn APY on them and send them back out, all without KYC. But bank accounts and cards live under the compliance umbrella. To get access to them, you pass KYC with our banking and card partners, and more features will come with it later. Those providers get very limited access: only to the specific payments you authorize. So by default, no KYC is needed, but to use COCA as your everyday payment and banking solution, you'll need to pass it.
Q: Does self-custody mean I don't have to report crypto taxes?
Vasili Paulau:
No, you still need to report. COCA doesn't report for you: it's a self-custodial solution, so we don't control your funds and don't have access to them. Reporting is your obligation, and it depends on the country you live in. We're exploring ways to help those of you who want support with tax reporting, for example through an AI integration that takes your country into account. It's still early, and I'll be happy to share more once we have the details.
🤝 Who is behind COCA
Q: Who is behind COCA, and why should I trust this app?
Vasili Paulau:
Two of the people behind COCA are right here on this call, and many more help keep the app working and support you. The team isn't huge, but it's not small anymore either: we're getting close to 30 people working full time on the product. We keep expanding, especially the support team, because we want to give you the best support possible, and we're working on bringing live chat. We're open about who builds the product, and you can come and chat with us at the conferences we attend. We've been in crypto for a long time, and we think in a self-custodial way. That's what unites the COCA family, both the people building the product and the people using it. Personally, I'm a big fan of the zero-trust concept: you shouldn't need to trust the company or the people behind a product, because everything is transparent and you can see how it works. It would be great if we were already zero trust. We're not yet, but we're getting closer every month. In April, we moved COCA to self-custodial infrastructure and switched to Privy for key management. Next, we plan to open-source the whole app, so anyone can check the code and see that it works the way we say it does.
Kate Alippa:
We're also working on a new website, where you'll soon be able to learn more about the team behind COCA.
🚀 Looking ahead
Thank you to Vasili for his time, to Kate for hosting, and to everyone who joined the stream and sent questions.
Your questions show us what matters most to you, and this time it was the safety of your money. We'll keep holding these sessions so you can hear straight from the people building COCA. Next up are more AMAs, including one looking back at everything we've built in 2026.
Got a follow-up question, or something you'd like us to cover next time? Drop it in our Community Chat, and the team will get back to you.
And one last reminder: COCA will never ask you for your private keys, passwords or verification codes. If someone does, it's not us.
See you at the next AMA!
Team COCA 💙
.png)
Comments