How Secure Is El Salvador’s Bitcoin?

El Salvador made history last fall by becoming the first country to accept Bitcoin as legal tender. Since then, the country’s ballcap-wearing president, Nayeb Bukele, has boasted of buying more than 1,000 BTC for El Salvador’s treasury—and doing it all on his phone. 

Bukele’s big Bitcoin experiment can be seen as innovative, reckless, or both–it’s too soon to say for sure. But a broader lack of transparency surrounding the country’s accounting and cybersecurity practices may give both Salvadorans and foreign investors cause for alarm.

Putting Bitcoin on the government’s books

Since no other government recognizes Bitcoin as legal tender, El Salvador is in novel territory when it comes to managing the digital currency. But there are best practices that governments can employ when it comes to storing and reporting on the nation's finances.

The United States Federal Reserve, for instance, documents the reserve assets it holds every month. Those records cover not just foreign currencies but also physical assets like gold.

The Fed's records disclose where these assets are held—as well as the assets it holds that do not technically belong to it. For example, under “gold stock,” the Fed notes that gold held “under earmark” at Federal Reserve banks for “foreign and international accounts” is not included in its monthly tallies.

“It’s an accounting exercise, and something you can audit. It’s the balance sheet of the central bank, and the financial statements will tell you exactly what the assets of the central bank are, and in most cases where they are held,” Steve Hanke, applied economics professor at John Hopkins University, told Decrypt. “It’s a very straightforward, vanilla kind of thing. There’s no big secret to it.”

Yet when it comes to El Salvador’s Bitcoin, there is no such transparency or public accounting.

Bukele has said that he has bought over 1,000 BTC, though it’s unclear where these funds are stored. Bukele's press office did not respond to multiple requests for comment for this story.

For now, Salvadorans—who are entitled, in theory, to know what the government is doing with their collective wealth—can only guess what Bukele is doing with the Bitcoin that he claims to be acquiring.

El Salvador’s Bitcoin holdings

While Bukele is fond of splashy Twitter announcements about buying the dip, he has declined to provide answers to the most basic questions surrounding his government’s management of the Treasury.

“There are so many things that are not being disclosed. For example, who’s holding the private keys to these Bitcoin?” Nolva Serrano, head of operations at crypto wallet provider BlockBank, previously told Decrypt. 

“Also, what’s the criteria for saying, ‘Oh, today, we’re going to buy more Bitcoin, or we’re going to wait until next month.’ We don’t know that,” she added. 

In fact, despite Bukele tweeting that he buys Bitcoin with his phone, even that remains a point of debate in El Salvador. A recent news report suggested that, while the president might boast on Twitter of buying Bitcoin on his phone, he is relying on U.S.-based persons to carry out the transactions. 

This behavior and lack of transparency may be frustrating for some Salvadorans, but it may also have negative consequences for the country’s economic outlook.

Foreign investors, for instance, have become more reluctant to do business with the world’s first Bitcoin nation. Bukele’s behavior has placed the country in a difficult position when it comes to selling bonds and accessing international credit markets.

This is a problem for a country like El Salvador as it looks to refinance $800 million worth of bonds that are set to mature in January 2023. 

“I don’t know who is going to buy these bonds, but it sure as heck isn’t going to be us,” Kevin Daly, a fund manager at Aberdeen Standard Investments, told the Financial Times in November last year. 

It’s not just investment firms concerned about the impact of Bitcoin on El Salvador’s sovereign credit outlook, but credit rating agencies too. 

In January 2022, Moody’s Jaime Reusche suggested that El Salvador’s Bitcoin holdings do not pose a threat to the government’s financial obligations yet—but that may change. 

“If it gets much higher, then that represents an even greater risk to repayment capacity and the fiscal profile of the issuer,” Reusche said at the time. 

Bukele’s black-box management style means investors can only guess about the exact state of El Salvadore's finances. 

‘He could be robbing the treasury’

The unanswered questions surrounding El Salvador’s Bitcoin holdings clearly have financial or political implications—not least growing concerns about worst case scenarios.

“He could be robbing the treasury…that is an extreme, and there’s no evidence of that, but there’s no evidence of anything,” Hanke added, speculating on a hypothetical, disastrous scenario facing El Salvador. 

There are also security implications that arise out of the government’s lack of transparency.

According to research from blockchain analytics platform Chainalysis, crypto wallets are being increasingly targeted by a slew of malware attacks. Such malware puts hackers in positions to drain the victim’s crypto holdings.

At the same time, centralized exchanges—like the ones Bukele is likely using to buy Bitcoin—remain the chief target of hackers. While most employ elaborate security measures, some are more lax, including when it comes to protecting customers from phishing and other forms of attack.

It is possible, of course, to hold Bitcoin securely, especially if the owner relies on so-called cold storage or specialized custodians. And Bukele may well be using such measures. But given his government’s lack of transparency, Salvadorans might be right to worry that their country’s Bitcoin wealth is susceptible to hacking, embezzlement, or other misfortunes.