Nathan McCauley and the trouble with keeping the keys

A person can possess a fortune and still be unable to spend a cent of it. In cryptocurrency, the difference may be a private key: the secret that authorizes a transaction. Lose access to it and ownership becomes a particularly expensive abstraction. Nathan McCauley and his future cofounder, Diogo Mónica, kept encountering people who needed help with precisely this problem. Eventually, the requests began to look like a business.

The two security engineers founded Anchorage Digital in 2017. Their proposition was practical: institutions needed a way to hold digital assets without making the safety of an investment depend on someone's talent for keeping a secret. Before a fund could consider what a token might be worth, someone had to settle who could move it, under what conditions, and how to prevent a disastrous mistake.

That premise would take McCauley from software security into federal banking supervision, and eventually into congressional hearing rooms. It also gives his career a pleasingly awkward shape. Here was an engineer working in an industry famous for escaping financial gatekeepers, choosing to build a bank. A charter, it turns out, can be an entrepreneurial ambition. It simply requires more paperwork than the usual version.

A town called Economy

McCauley grew up in Economy, Indiana, a small Midwestern town he described to senators as having about 150 residents. One of his early jobs involved grilling burgers at McDonald's. His ambitions were already pointed elsewhere: he wanted to become a computer engineer and an entrepreneur. The name of his hometown would make an overenthusiastic biographer positively unbearable. Fortunately, the computers are the more useful clue.

In a later conversation with Marc Beckman, he described a childhood surrounded by farming and factory work. His father worked at Hill's Pet Nutrition. An interest in computers gradually suggested a different route, and the West Coast looked like the place where much of that work happened. He also spoke warmly of Indiana, even entertaining the possibility of returning someday. Leaving supplied an opportunity; it did not erase his attachment.

His early professional work was unusually concrete preparation for a financial company. At Arxan Technologies, he worked on anti-reverse engineering and cryptographic key management for commercial and military applications. These are jobs concerned with what happens when someone deliberately tries to defeat a system. In that line of work, an attractive demonstration is only the opening argument. The interesting questions begin when somebody tries to break it.

Two engineers, several coffees, one long bet

In 2011, McCauley and Mónica joined Square during the same week. Square was making card payments accessible to merchants through a small reader and the systems behind it. McCauley worked on its security infrastructure and led security engineering. Payment security gave him a setting in which technical decisions had immediate financial consequences: the code was part of the machinery that let businesses get paid.

The partnership developed beyond the office. Mónica has recalled their friendship growing over coffee at Sightglass in San Francisco. Both wanted to start a company. More significant was the discovery that they could trust one another over the sort of timespan a company actually requires. A cofounder relationship has to survive considerably more than the afternoon in which the idea seems brilliant.

They went on to Docker, where they built and led its security team. Docker's container technology belongs to the less visible machinery of software: the tools developers use to package and run applications. The move broadened their experience from payments into infrastructure used by other businesses. It also gave them another workplace in which to test the partnership before putting their names on a company together.

In a 2023 interview, McCauley explained that the Docker move had another purpose. Before founding something themselves, they wanted to understand business-to-business sales, marketing, and development. Security expertise was their starting asset. Learning how organizations buy software was part of the preparation. Their eventual customer would be an institution with budgets, procedures, and people who could say no for several entirely different reasons.

The missing piece was permission

By 2017, their professional background and the requests for help with crypto wallets had converged. They understood a problem that sophisticated investors were encountering outside their own area of expertise. Knowing how to evaluate an investment did not automatically mean knowing how to safeguard its cryptographic credentials. Anchorage began in the space between those two competencies.

Custody sounds passive. Digital assets make it a surprisingly active occupation. Institutions may want to stake assets, participate in governance, settle transactions, or trade. Keeping the keys secure has to coexist with allowing authorized activity. Anchorage expanded from custody into services surrounding those holdings. The engineering question became how to make assets usable while retaining controls over who could authorize their movement.

McCauley also pursued a form of assurance that no software feature could provide. On January 13, 2021, the Office of the Comptroller of the Currency conditionally approved the conversion of Anchorage Trust Company into Anchorage Digital Bank, a national trust bank. The decision put the bank under federal supervision. The company became home to the first federally chartered crypto bank in the United States.

This was a choice about the customers he hoped to serve. An institutional buyer has obligations that extend beyond enthusiasm for a new technology. Its counterparties, governing bodies, and advisers need a structure they can examine. McCauley's wager was that formal oversight would help make participation possible. He was adding an institutional foundation beneath the cryptography.

“We’ve believed from day one that digital assets would only scale through secure, regulated foundations.”Nathan McCauley · February 2026

A charter comes with an examiner

The wager had consequences. In April 2022, the OCC issued a consent order against Anchorage Digital Bank after finding that it had failed to adopt and implement an adequate Bank Secrecy Act and anti-money-laundering compliance program. The regulator said the bank had not met requirements attached to its operating agreement. Winning the charter had been an achievement. Operating under it imposed a continuing test.

That distinction matters in McCauley's story. Technical security and banking compliance are different disciplines, and strength in one does not settle the other. A bank must maintain the processes, controls, and accountability that supervision demands. The consent order makes the company's regulatory history more complicated than a founding slogan. It also shows what accepting supervision means when the examiner disagrees with you.

The OCC terminated the order in August 2025. Its termination document, signed August 18, said the bank's safety, soundness, and compliance no longer required the order's continued existence. McCauley subsequently described years of work, substantial investment in compliance infrastructure, specialist hiring, and repeated engagement with the regulator. The resolution belonged to the operating business as much as to its public argument about crypto.

There is a less glamorous version of entrepreneurship hiding here: recruiting people whose expertise differs from the founder's, paying for systems that customers may never see, and doing work whose most satisfying outcome is an examiner deciding an order can end. McCauley's career now included precisely that kind of building. The keys were still central. They were surrounded by a much larger organization.

When a bank needs a bank

A second banking problem brought him before the Senate Banking Committee on February 5, 2025. McCauley testified about Anchorage's experience losing access to banking services. In his account, seeking a federal charter had not prevented the company from being shut out by other parts of the financial system. He argued for fair access and clearer rules.

The distinction between his account and a regulator's finding deserves care. Debanking was the subject of his testimony and his subsequent advocacy. The OCC's compliance action was a separate, documented proceeding. Together, the episodes explain why he became such a persistent participant in policy discussions: regulation affected both the company's obligations and its ability to obtain services from other institutions.

His public role widened further in February 2026, when the Commodity Futures Trading Commission appointed him to its Innovation Advisory Committee. The group brought together executives from exchanges, financial infrastructure businesses, and crypto companies. For someone whose early work involved protecting software against attack, it was a different room and a familiar concern: how a system should behave when the stakes become financial.

The next customers may be software

The company attracted capital along the way. A $350 million Series D led by KKR in December 2021 valued Anchorage at more than $3 billion. In February 2026, Anchorage announced a $100 million strategic investment from Tether at a $4.2 billion valuation, alongside its first employee tender offer. These were company valuations, reflecting particular transactions at particular times.

The employee offer added a human detail to the financing announcement. Long-serving team members would be able to sell a portion of their equity. McCauley described rewarding people who had believed early and stayed. A founder can discuss endurance indefinitely; an opportunity for employees to realize some value gives the idea a more practical expression.

His ambitions were also moving beyond holding crypto. In May 2026, he introduced Anchorage's Agentic Banking offering in an essay about software gaining the ability to act on behalf of institutions. He described infrastructure for identity, policy enforcement, and settlement that would give AI systems governed access to capital. The proposal extended his recurring interest in authorization: determining what an actor is allowed to do with money.

By August, he was writing about AI regulation too. His argument favored disclosure, examinations, and accountability over permission systems that could prevent new participants from entering a market. It was the perspective of a founder who had sought oversight and then spent years experiencing its demands. He wanted rules that made participation workable, and he was willing to argue over their design.

There is a consistent problem beneath these changes in job description. At Arxan, Square, and Docker, McCauley worked on the security of systems people depended on. At Anchorage, he had to make that dependence acceptable to institutions, employees, counterparties, and regulators. The scale changed. So did the number of people entitled to ask difficult questions. His business began with people needing help keeping their keys. It has grown around everything else that must be kept in order.