A custody platform where no single machine ever holds a private key. MPC sharding plus an HSM-backed policy engine secures $1.2B+ across 20+ chains with zero incidents.
Private keys are never generated, stored or reconstructed in one place. Each signing operation is a distributed MPC computation across network-segmented shard nodes, so stealing any one node, or even a few, yields nothing usable.
The threshold scheme means a quorum, not a single secret, authorizes movement. Rotation and resharding happen without ever materializing the full key.
Every withdrawal passes the HSM-anchored policy engine first: allowlists, per-asset velocity limits, value thresholds and human quorum approvals are enforced in tamper-resistant hardware. A signature is only computed once policy clears.
Because the policy root of trust lives in the HSM, even a fully compromised application layer cannot forge an approval or bypass a control.
| Component | Technology | Why |
|---|---|---|
| Signing core | Rust + MPC (threshold ECDSA/EdDSA) | Memory safety and no single point of key compromise. |
| Policy engine | HSM-backed rules | Tamper-resistant root of trust for every approval. |
| Orchestration | Kubernetes | Isolated, attestable nodes with rolling, zero-downtime upgrades. |
| Ledger | PostgreSQL (append-only) | Immutable audit trail reconciled against chains. |
| Shard nodes | Network-segmented pods | Each holds one shard; quorum required to sign. |
Signatures are produced jointly by shard nodes so the full key never exists in memory.
Allowlists, thresholds and quorum rules are checked in tamper-resistant hardware before signing.
Pluggable per-chain modules support 20+ networks behind one signing core.
Every request, approval and broadcast is recorded immutably in PostgreSQL.
Internal ledger state is continuously verified against confirmed chain state.
Shards rotate and rebalance across nodes without reconstructing the underlying key.
“If no one machine ever holds the key, there is no single machine worth attacking.”
The result is institutional-grade custody that holds up to scrutiny: $1.2B+ secured across 20+ chains with a clean, zero-incident record. By combining Rust's memory safety, distributed MPC signing and an HSM-rooted policy engine on Kubernetes, the platform removes the single points of failure that custody systems are usually breached through, and backs every action with an immutable, reconciled audit trail.