CUSTODY
Withdrawals are signed by a threshold of independent parties — a single compromised server cannot move funds. New addresses wait out a time-lock before they can receive.
The legacy custody leaned on a distributed key over cryptography nobody outside could inspect. The new stack is built in-house, signs across more networks, and never lets one machine hold the whole key.
Legacy · before
Now · in build
A withdrawal needs a threshold of independent parties to cooperate before it can be signed — t of n. Compromising one server is not enough, by design.
01 · Threshold signing
The signing power is split across n independent parties; a valid signature needs at least t of them. No single party — and no single compromised server — can produce a withdrawal signature alone.
Mechanism: t-of-n threshold signature.
02 · No whole key, anywhere
The private key is never assembled in one place. Each party holds only its share, and the shares cooperate to sign without ever reconstructing the full key on any one machine.
Mechanism: key shares, never reconstructed.
03 · Audit as a release gate
An independent external crypto-audit is a release gate: withdrawals do not switch on until it passes. The audit report will be published — making the gate a feature of the trust model, not a formality.
Mechanism: external audit · mainnet release gate.
A withdrawal is not a single click. It passes through step-up confirmation, a whitelisted destination, a time-delay hold, and only then a threshold signature — each step an independent gate.
Withdrawal flow
A withdrawal demands fresh, strong proof at the moment you request it — not just a logged-in session.
Funds can only go to an address you have added to your withdrawal whitelist.
A new address or a changed setting freezes withdrawals for a holding period of a day or more (T+N) before they can receive.
Only after the gates clear does a threshold of independent parties sign the transaction.
Each gate is independent — clearing one does not clear the next.
The custody stack signs across six networks for the relaunch wave — wider coverage than the legacy system, all under the same threshold scheme.
How the keys are held and how withdrawals are approved — the parts worth reading before you move funds out.
No single party. The signing power is split across n independent parties under a t-of-n threshold scheme, and the full private key is never assembled on any one machine. A withdrawal can only be signed when at least t of those parties cooperate.
A new address enters a time-delay hold before it can receive — a holding period of a day or more (T+N). The same applies when you change sensitive settings. The delay gives you a window to notice and stop an address you did not intend to add.
Because withdrawals are the highest-stakes path, an independent external crypto-audit must pass before they switch on for mainnet. Gating the launch on a published audit means the security claim is checked by outsiders, not just self-asserted.
At launch the custody stack signs for six networks: BTC, EVM chains, SOL, TON, Tron, and XRP. That is wider coverage than the legacy system, and every network runs under the same threshold-signature scheme.
Custody holds the funds; identity guards who can ask to move them, and transparency lets you check the books behind both.