Hierarchical TSS/MPC custody
Cold vaults hold the bulk of customer assets. The operating policy targets more than 90% of total holdings in cold storage at all times — a standing policy constraint audited against actual balances. Warm-tier signing uses threshold signature schemes across HSM shards, producing a single valid signature without any complete key in one location. Hot tier is a deliberately small operational balance with automated limits.
Shard rotation & recovery
Shards rotate on a fixed schedule and on any personnel departure. Recovery from a lost shard holder is rehearsed on the same cadence against a test environment — because a disaster recovery plan that has never been executed is a document rather than a capability.
Cryptographic proof-of-reserves
PoR answers a narrow question: at this moment, does the operator hold at least as much of each asset as it owes to customers, and can an individual customer confirm their own balance was included. The construction is a Merkle tree over customer balances per asset; roots and aggregate reserve ratios are published to a verification portal alongside independent custodial attestations.
ZK-PoR would reduce disclosure while proving the sum — useful, and not yet counted toward production claims in this edition.
User Protection Reserve
A segregated stablecoin buffer funded from a defined share of platform revenue sits alongside custody, with allocation policy and coverage parameters disclosed in the platform’s transparency portal.
No immunity claim
Nothing here supports a claim of immunity. Controls are layered, independently audited, and continuously tested — and a determined adversary with time and resources remains a residual risk.