Lior Lamesh and the value of a locked door

Lior Lamesh looked at a cryptocurrency wallet and noticed the entrances. There were cables, ports and ways to move information. For someone buying a wallet, those were conveniences. For someone trained to investigate security, each deserved a closer look. The word “cold” on the packaging could only do so much. A locked door remains an interesting proposition when somebody has thoughtfully installed a letterbox.

That suspicion became the starting point for GK8, the company he founded with Shahar Shamai in 2018. Their particular corner of crypto was custody: the technology institutions use to control access to digital assets. It was a business built around the less photogenic part of finance. Prices could perform their daily acrobatics. Somebody still had to look after the keys.

By August 2026, the argument had reached a familiar place: a bank. Galaxy and Bank Leumi announced plans to put digital asset trading inside the Leumi Trade application, with custody infrastructure formerly known as GK8 supporting the arrangement. Lamesh, now leading Galaxy Israel, was helping sell established institutions on a financial future whose security he had once approached by looking for its weaknesses.

Two founders, one uncomfortable question

Before GK8, Lamesh and Shamai worked in cybersecurity at Israel’s Prime Minister’s Office. Their subsequent company carried that technical background into a commercial question: how could an institution use a blockchain without exposing its most sensitive signing machinery to the same network risks as an ordinary connected computer?

Lamesh’s education crossed the border between engineering and management. He studied computer science at Bar-Ilan University from 2013 to 2016, followed by an MBA in information systems and entrepreneurship from 2016 to 2018. His LinkedIn profile also records volunteering as a youth soccer coach through the Jewish Agency in New York. There is a pleasing range there: code, business and the organizational demands of a youth team.

GK8 emerged from stealth in September 2019 with a $4 million seed round. Backers included Check Point co-founder Marius Nacht, aMoon and Discount Capital; EdenBlock, iAngels and the Israel Innovation Authority also participated. An institutional investment arm and a cybersecurity founder made a useful pair of constituencies for a company proposing to connect those worlds.

The division of labor was clear: Lamesh served as chief executive, Shamai as chief technology officer. Their names continued to appear together as the business changed owners. For a story that would acquire quite a few corporate names, this partnership provided continuity.

A quarter-million-dollar invitation

In early 2020, GK8 offered a $250,000 Bitcoin bounty to anyone who could break into its cold wallet. Lamesh later described publishing transaction information in advance and taking precautions against physical theft. The preparations even included escorting employees to and from bus stations. A software demonstration had acquired the logistics of protecting actual money.

His account said the wallet resisted the attempts. A bounded test establishes what happened during that test; the entertaining part of the episode is the founder’s willingness to invite scrutiny in public. Security companies sell confidence. Here was a chief executive trying to give an audience something more concrete than an adjective.

The next audience had a different vocabulary. By June 2020, GK8 clients could seek insurance through an Aon arrangement with insurers led by an Arch syndicate at Lloyd’s, with potential coverage up to $500 million. Coverage depended on the policy and how clients used the technology. The move brought custody into the territory of underwriting, operational processes and terms that somebody would actually read.

This is where Lamesh’s work becomes recognizably financial. A clever device has to fit into an institution’s procedures. Its operators have to understand what they control, which approvals are required and what happens when something goes wrong. Insurance is one part of that conversation. It also supplies a wonderfully unsentimental audience for a sales pitch.

The company changes hands. The founders stay.

In November 2021, Celsius agreed to buy GK8 for $115 million. At the time, the company had raised about $10 million. Lamesh celebrated joining the new parent while keeping GK8’s independent brand, describing a team of more than 30 people. It was the kind of announcement that gives a young company’s early bets a very public price.

Celsius subsequently entered bankruptcy, and GK8’s next chapter took shape through that process. Galaxy announced its agreement to acquire the business in December 2022. In February 2023, it announced completion of the purchase of substantially all GK8 assets for approximately $44 million. The two transaction figures belong to different moments and deal circumstances; neither is a measure of Lamesh’s personal wealth.

For Galaxy, the acquisition brought a Tel Aviv office and nearly 40 employees, including cryptographers and blockchain engineers. Lamesh and Shamai stayed to lead its custodial technology offering. An acquisition announcement can make a company sound like a suitcase changing carousels. Here, the people doing the technical work were an explicit part of the purchase.

The move placed Lamesh inside a broader financial business led by Mike Novogratz. Custody could sit alongside trading, lending and other institutional services. His product now had neighbors with customers who might need it, and customers with problems extending beyond storage. The commercial context had expanded around the original security question.

The keys behind the transaction

GK8’s design combines a cold vault with a multi-party computation vault, or MPC. Galaxy describes the cold vault as enabling blockchain transactions without an internet connection to the vault, while the MPC component supports automated transactions. That pairing addresses a practical tension: an institution wants protected reserves and the ability to carry out ordinary business.

Think of it as a question about permissions. Who may propose a transaction? Who must approve it? Where does the signing happen? How much activity should be automated? Those questions are less glamorous than a chart moving upward, but they become rather absorbing when the assets on the chart belong to clients.

In April 2024, GK8 introduced its Tokenization Wizard. The application extended its work from safeguarding existing digital assets to helping institutions issue and manage tokens. The launch described tools for handling ownership transfers, tracking transactions and managing permission lists, without requiring users to write smart-contract code themselves.

Issuing a token gives its administrators consequential powers. They may need to create or retire units and manage who can participate. Protecting those permissions matters throughout the token’s life. The proposed AllUnity venture involving DWS, Flow Traders and Galaxy was named as the first intended customer for the Wizard. Lamesh’s custody business was moving closer to the machinery of issuing money.

A wider map, with a bank at home

In April 2025, Galaxy and South Korean custodian BDACS announced a partnership covering institutional prime services, ETF infrastructure and liquidity, and stablecoin research. BDACS planned to incorporate GK8 technology into services for Korean institutions. The arrangement placed local delivery and regulatory knowledge alongside Galaxy’s infrastructure, rather than treating a piece of software as an entire market-entry strategy.

That structure suits the work Lamesh has increasingly discussed in public. In a fireside conversation with State Street’s Kim Hochfeld, he emphasized the combination of a traditional financial institution, a digital asset specialist and a technology partner. The approach gives his original engineering problem a set of organizational counterparts. Each participant brings something the others need.

The Leumi announcement in August 2026 supplied a particularly tangible example. Customers of Leumi and its PEPPER digital banking arm were expected to be able to buy, hold and sell selected assets, including Bitcoin, Ether and Solana, through Leumi Trade. The anticipated availability was early 2027. At the time of this profile, that remained a planned service.

GalaxyOne Institutional would provide trading infrastructure, with Galaxy’s custody platform supporting the digital asset infrastructure. For the customer, the intended point of entry was an existing banking application. Years of specialized engineering would sit beneath a recognizable screen. There is a certain professional satisfaction in building something complicated enough that other people can use it simply.

“The future of finance will run on open, programmable rails”Lior Lamesh · August 2026

Making security ordinary

Lamesh has continued to explain his field as well as sell its tools. His Forbes Technology Council writing has addressed evaluating custody providers, implementation challenges and misconceptions about institutional custody. His public conversation with Galaxy research head Alex Thorn ranges from the origins of GK8 to MPC and tokenization. These are recurring attempts to make technical choices legible to financial decision-makers.

His ambitions now reach beyond a vault. In the Leumi announcement, he described an integrated trading and custody platform for banks around the world. The direction follows the career: investigate the weak point, build the product, find an institution willing to put it to work. Each step introduces more people whose confidence has to be earned.

There is a quiet reversal in the destination. Lamesh entered this story as someone bothered by the connections on a wallet. He now works on connections between banks, markets and blockchains, while trying to keep the dangerous ones away from the keys. Opening access and controlling access have become parts of the same job.

The next meaningful test will be ordinary use: a bank customer opening an application, placing an order and expecting the assets to remain where they belong. The early bounty needed an audience. Banking infrastructure earns its place through repetition. For the founder who began by inspecting the door, a day with nothing remarkable to report would be a useful result.