Custody architecture.
Customer stablecoins are held in a multi-signature treasury structure on Solana. The architecture is built so that no single key, person, or system can move funds — and so that the operational keys most often touched are the ones with the least money behind them.
Hot, warm, and cold — sized for purpose.
Operational liquidity for everyday deposits and withdrawals. Smallest balance. Signers required to authorise any outflow.
Working capital for strategy deployment and rebalancing. Higher threshold; multiple signers and time-locks on movements out of tier.
Bulk of the book. Air-gapped key material. Movements require quorum from senior signers and operate on a defined schedule, not on demand.
What protects every outflow.
Authorisation is layered. A single compromised key cannot move funds. A compromised operational system cannot bypass approvals. Withdrawal destinations are filtered, and first-time addresses face additional friction by default.
Outflows require a quorum of signers — never a single key. Quorum size scales with tier value.
User-side allowlists for destination addresses, with a 24-hour review window on first-time additions.
Every outflow event is mirrored to monitoring channels with on-call response. Anomalous activity triggers a hold.
Periodic rotation of operational keys. A documented recovery procedure for cold-tier signers, audited internally.