Security
Defense in Depth
Multi-layered security architecture designed to protect assets against nation-state adversaries. Battle-tested infrastructure securing over $12B in digital assets.
Cryptographic Architecture
No single point of compromise. Private keys are never whole, never online, and never in one place.
Threshold Signatures (TSS)
Private keys are split across geographically distributed HSMs using Shamir's Secret Sharing. No single device ever holds complete key material.
t-of-n threshold ECDSA/EdDSASecure Multi-Party Computation
Transaction signing occurs via MPC protocols where key shares never leave their respective secure enclaves during computation.
GG20 / FROST protocolsHardware Security Modules
All cryptographic operations execute within FIPS 140-3 Level 3 certified HSMs with tamper-evident seals and active zeroization.
Thales Luna Network HSM 7Key Derivation & Rotation
Hierarchical deterministic wallets with BIP-32/44/84 derivation paths. Master keys rotate quarterly with zero-downtime migration.
Argon2id / HKDF-SHA512Cold Storage & Custody
98% of assets secured offline with institutional-grade custody controls.
Air-Gapped Infrastructure
Cold wallets exist on completely isolated systems with no network connectivity. Key ceremonies conducted in Faraday-shielded rooms.
Geographic Distribution
Multi-signature vaults distributed across 5 continents with independent custodians. No single jurisdiction controls enough keys.
Time-Locked Withdrawals
Large withdrawals require 72-hour time locks with multi-party approval. Velocity limits enforced at the protocol level.
Proof of Reserves
On-chain attestations published monthly using Merkle tree proofs. Verified by Armanino LLP with real-time reserve tracking.
Withdrawal Authorization Flow
User + 2FA verification
ML-powered analysis
Velocity & limit checks
3-of-5 HSM signing
Signed TX submitted
Network & Infrastructure
Zero-trust architecture with defense-in-depth across every layer of the stack.
DDoS Mitigation
- Cloudflare Magic Transit with 280+ Tbps capacity
- Anycast network absorbs volumetric attacks
- L7 rate limiting with behavioral analysis
- BGP Flowspec for upstream filtering
Edge Security
- Web Application Firewall (OWASP Top 10)
- Bot management with ML classification
- mTLS certificate pinning for APIs
- HTTP/3 with encrypted SNI (ECH)
Threat Detection
- 24/7 SOC with SIEM correlation
- EDR/XDR across all endpoints
- Network traffic analysis (Zeek/Suricata)
- Honeypots and deception technology
Infrastructure Hardening
- Immutable infrastructure (no SSH access)
- CIS benchmarks for all systems
- Kubernetes with gVisor sandboxing
- Service mesh with Istio mTLS
Application Security
Security embedded at every stage of the development lifecycle.
Secure Development Lifecycle
Threat modeling (STRIDE/DREAD), security requirements in every sprint, and mandatory security sign-off for production deployments.
Code Analysis
SAST (Semgrep, CodeQL), DAST (Burp Suite Enterprise), SCA (Snyk), and fuzzing (AFL++) integrated into CI/CD pipeline.
Smart Contract Audits
All smart contracts audited by Trail of Bits, OpenZeppelin, and Consensys Diligence. Formal verification for critical paths.
Dependency Management
SBOM generation, reproducible builds, pinned dependencies, and automated CVE scanning with <4hr patch SLA for critical vulns.
Bug Bounty Program
We partner with HackerOne and maintain one of the highest-paying bounty programs in the industry. Over 200 security researchers have contributed to our security posture.
Account Security
Multiple layers of authentication and fraud prevention protecting every account.
Authentication
- Hardware keys (FIDO2/WebAuthn)
- TOTP authenticator apps
- Biometric verification
- Passkey support
- IP allowlisting
Session Security
- Device fingerprinting
- Session invalidation
- Concurrent session limits
- Automatic timeout
- Login notifications
Fraud Prevention
- Behavioral analytics
- Device risk scoring
- Transaction monitoring
- Withdrawal delays
- Address whitelisting
Certifications & Audits
Independently verified compliance with the highest security standards.
Responsible Disclosure
Found a vulnerability? Report it through our secure channels. We respond within 24 hours and do not pursue legal action against good-faith researchers.
Asset Protection & Insurance
Comprehensive coverage protecting your assets against all scenarios.
Crime Insurance
Coverage against theft, including employee dishonesty, third-party theft, and both hot and cold wallet compromises.
SIPC Protection
Securities accounts protected by SIPC up to $500,000 ($250K cash) through our broker-dealer partner.
Questions about security?
Our security team is available to address enterprise security requirements and compliance questions.