The layer that talks to the chains. Inside your perimeter.
Nine blockchain bridges with RPC pools and failover, node and sync monitoring, hot/warm/cold wallet tiers, a policy engine with M-of-N approvals, and a reserve monitor that compares the ledger with the chain around the clock. Custom tokens on any supported chain. Full nodes optional. Self-hosted only.
- blockchains bridged
- 9
- custom token standards
- ERC-20 · BEP-20 · TRC-20 · SPL
- mandatory, TOTP against Vault
- 2FA
- ledger vs chain reconciliation
- 24/7
Nine chains. RPC pools by default, full nodes when you want them.
Each chain has a bridge: a small service that scans blocks, credits deposits, builds and broadcasts withdrawals, and reports health. Bridges run under systemd with restart-loop protection.
| Chain | Type | RPC pool | Full node (optional) | Custom tokens |
|---|---|---|---|---|
| Bitcoin | UTXO | included | bitcoind · ~700 GB | — |
| Ethereum | EVM | included | geth/nethermind · ~1.2 TB | ERC-20 |
| BNB Smart Chain | EVM | included | bsc-geth · ~2 TB | BEP-20 |
| Avalanche C-Chain | EVM | included | avalanchego · ~400 GB | ERC-20 (C-Chain) |
| TRON | account · energy | included + solidified guard | java-tron · ~1.5 TB | TRC-20 |
| Solana | account | included | validator RPC · 2 TB+ NVMe | SPL |
| XRP Ledger | account · tags | included | rippled · ~100 GB | — |
| Dogecoin | UTXO | included | dogecoind · ~150 GB | — |
| Litecoin | UTXO | included | litecoind · ~150 GB | — |
Disk figures are approximate for pruned-where-possible nodes at time of writing. Other chains are quoted per project.
Health reporting.
RPC pool and failover
Multiple endpoints per chain; if one goes down the next takes over. Actual success rate and latency are measured per endpoint and shown in the panel.
Sync tracking
The chain’s real height is compared with the height in the database. Even when the process is up, nothing shows green while the chain is behind.
TRON solidified-block guard
A separate measurement prevents a reversible block from being credited if TRON keeps producing blocks but stops solidifying them.
Confirmation depth per asset
Deposits credit at a configurable depth; the customer sees the depth on the deposit screen.
Address validation
Format and network checks before a withdrawal is built; same-asset wrong-network destinations (USDT TRC-20 vs ERC-20) are flagged.
Keystore consistency
Signing addresses in the database are compared with keystore files on the host, an existence check only, without reading any key.
List your token, or a client’s, on any supported chain.
Standards
ERC-20 on Ethereum and Avalanche C-Chain, BEP-20 on BNB Smart Chain, TRC-20 on TRON, SPL on Solana. Add a token from the admin: contract address, decimals, confirmation depth, min deposit, withdrawal fee.
Contract verification
Before a token goes live the contract is read on-chain and its metadata compared with what the operator entered. Mismatches block listing.
Deposit collection and gas
Token deposits land on per-user addresses and are collected to the hot wallet; the collection gas tanks are monitored, with thresholds derived from the chain’s own fee parameters.
Your own token
Pair this with the Token Launch module: issue on Ethereum/BSC/TRON, list on the exchange at TGE, run vesting and claim from the same custody core.
Listing requests
Project owners submit a listing request from the exchange site; it lands in a queue in the admin with the contract check attached.
Hot, warm, cold, fee, deposit.
Hot
Pays withdrawals. Target balance and ceiling per asset; above the ceiling, funds sweep to warm or cold automatically.
Warm
Operator-approved top-ups to hot; one signature plus 2FA.
Cold
Air-gapped, or HSM-backed where an HSM is integrated. Moves need the full quorum and a time lock.
Fee
Native-coin accounts that pay gas for token collection and withdrawals, kept separate from customer funds.
Deposit
Per-user addresses; collection to hot on thresholds.
Separate from Mirror and Earn
Market-maker float and Earn treasury have their own accounts; nothing is mixed with customer custody.
How funds move between tiers, and who signs.
Deposits sweep down to colder storage; withdrawals climb back up only through the policy engine.
- Deposits collect to the hot wallet once confirmed.
- Above the threshold, funds sweep to warm and cold storage.
- A user or treasury officer requests a withdrawal.
- Rules decide how many officers must approve, and who.
- The signer signs and the transaction is broadcast.
- Every balance checked against the chain · unknown is never shown as fine
Policy as configuration.
Thresholds and quorums
Approval requirements per asset and amount band: 1-of-3 below a floor, 2-of-3 for the middle, 3-of-5 with a delay above. Every approval is a TOTP event by a named officer.
Whitelists and delays
Withdrawal address whitelisting with a 24-hour delay on new addresses, on by default. Daily caps per asset and per customer tier.
Four-gate automation
Automatic replenishment and sweeps sit behind four gates: environment switch, live mode, per-key flag, per-asset policy row. Plus a daily USD cap and a justified record.
Break-glass
Documented procedure, leaves a record, pages the whole officer group.
Versioned
Policy changes are versioned and logged with who/what/when; the previous version is one click away.
Books vs chain, continuously.
Independent service
Reads on-chain balances for every custody address and compares with the ledger. A mismatch alerts; a check that cannot complete is reported as unknown, never as fine.
Stuck money
A single screen collects every transfer that was paid on-chain but looks wrong in the records, or that is waiting for approval and has been forgotten.
Proof of reserves
Exports on demand: addresses, balances, liabilities, timestamp, signed.
Alerts
Telegram and email channels configured from the panel; a real test message is sent before a token is saved.
By design, it moves no funds.
Observe and manage nodes
Node lifecycle, sync, endpoint health, keystore consistency. It cannot withdraw, generate addresses or rotate keys. A deliberate boundary that shrinks the attack surface.
2FA required
Even with the correct password and role, no session starts without a TOTP code verified against HashiCorp Vault.
Read-only in the admin
Node and chain health are mirrored read-only into the operations console so support can see state without custody access.
Audit
Every sign-in and action recorded; export for your auditors.
Optional. For when RPC providers are not enough.
Why
Data residency, provider independence, lower latency on deposit detection, or a regulator asking where your chain data comes from.
What we install
Node software, pruning where the chain allows it, monitoring, and the bridge pointed at your node first with the RPC pool as fallback.
Sizing
From one NVMe server for Bitcoin and the UTXO chains to a dedicated box for Solana. Figures in the chain table.
Pricing
Per chain, one-time setup plus hosting you already pay for. In the configurator as “Full node”.
Read moreCustody, as seen from the panels.
Screens from the running system.
Some figures in these screens are sample data; layouts and features are the running software.
Custody at a glance
- Chains
- Bitcoin, Ethereum, BNB Smart Chain, Avalanche C-Chain, TRON, Solana, XRP Ledger, Dogecoin, Litecoin
- Tokens
- ERC-20, BEP-20, TRC-20, SPL · contract verification before listing · listing-request queue
- Nodes
- RPC pools with failover included · full nodes optional per chain · sync and solidified-block guards
- Keys
- Keystores apart from applications · HashiCorp Vault · HSM integration on request (Thales Luna, YubiHSM 2)
- Policy
- Per-asset quorums and delays · whitelists · daily caps · four-gate automation · versioned
- Monitoring
- Reserve monitor · stuck-money screen · Telegram/email alerts · proof-of-reserves export
- Stack
- FastAPI + per-chain Python bridges · systemd · MySQL · Vault
- Deployment
- Self-hosted only (bare metal or your cloud) · source-code licence available
- Pricing
- From €15,400 one-time · HSM, standby site, full nodes optional — build an estimate
Custody review with your security team.
Architecture document and a guided session on a dedicated environment, under NDA.