Built to lose nothing
DFNS is the core banking platform that secures hundreds of banks, fintechs, and institutions onchain. Full stack, end to end.
Audited by 
Deloitte and more
No layer left undefended
Each layer is secured on its own terms, and each one assumes the others can be breached.
01Cryptographic core
No single point of failure
DFNS runs by default on multi-party computation (MPC) and threshold signature schemes (TSS). A complete private key is never created, stored, or held. Anywhere, by anyone.
-
Distributed trust
Compromising one signer is not enough. An attacker must breach multiple isolated environments at once to achieve anything.
-
Attack tolerance
As long as the threshold quorum holds, signing can continue under active attack and survives signers going offline.
-
Data sanitization
Repair one share, refresh all shares, or rotate the pair to invalidate the stolen key. On a schedule or on demand.
02Key hosting & custody
Keys are network-protected
Most vendors put the private key on the user’s device. Lose the device, lose the funds. DFNS holds keys across a network, so a lost passkey is a lost credential—not a lost private key.
-
Managed (SaaS)
Fully managed key storage with remote controls via passkey authentication. All key material held in Tier 3+/Tier 4 data centers.
-
Hybrid (cloud)
Keep key shares and policies on-premises, and ask us to deploy DFNS-managed services in your preferred jurisdiction.
-
On-premises
Run every key and service in your own hardware, your infrastructure, your enclaves—Intel TDX, AWS Nitro, IBM HPVS.
03Platform controls
Security needs holistic thinking
Cryptography protects the key, not the user. Policies, unphishable authentication, and verified communications close the gap between a valid signature and a legitimate one.
-
Programmable policies
Velocity limits, address allowlists, ABI-aware approvals, multi-party quorums are enforced. One device can’t drain a wallet on its own.
-
WebAuthn
Passkey authentication creates unphishable in-device credentials with native MFA. Bypasses are designed out.
-
Attested communications
Code integrity verified against malicious deployments via remote attestations and mTLS, inside tamper-proof enclaves.
04Infrastructure & operations
Engineered for critical workflows
DFNS was designed for the resilience standards your risk team expects, hardened against the OWASP Top 10, defended against DDoS, and shipped through secure SDLC.
-
Secure SDLC
CI/CD pipelines and code reviews under 4- and 6-eye principles. Quarterly audits by certified external experts.
-
Real-time detection
Continuous code scanning and behavior monitoring flag anomalies in human and system activity, with rapid response.
-
Strong SLAs
Tier-one cloud, over 99.95% availability, and resilience controls that drive downtime risk toward zero.
Learn how we think about security
Turning key loss into a minor incident
Blockchains were built so a single lost key is final and irreversible. A core banking system cannot inherit that fragility. DFNS optimizes for fund access under every scenario, even the worst ones.
Credential recovery
We recommend multiple recovery paths, all meeting high-security two-factor standards. Add extra verification steps, or request a custom recovery flow for enterprise deployments.
Disaster recovery
A four-tier plan inspired by IANA and following NIST guidance, each tier designed for a different critical scenario, safeguarding data, preventing misuse, and guaranteeing functionality.
Certified, licensed, and audited on the record
DFNS is built for buyers whose regulators ask hard questions. Every certification and audit below is independently verifiable through the Trust Center.
| Standard | Verified by | Status |
|---|---|---|
 Type II | Deloitte | Completed |
 | | Completed |
 | | Completed |
 | | Completed |
| Operational Due Diligence | DiggOpp | Completed |
| W3C WebAuthn | — | Completed |
| NIST Cybersecurity Framework | — | Completed |
| CCSS Level 3 | — | Ongoing |
| ISO 22301 | — | Ongoing |
| SOC 1 | — | Ongoing |
| ISAE 3000 | — | Ongoing |
| Year | Scope | Auditor |
|---|---|---|
| 2025 | Blackbox pentest |  |
| 2025 | Cloud |  |
| 2024 | Infrastructure | |
| 2024 | Authentication pentest | |
| 2023 | CGGMP21 library | |
| 2023 | Whitebox pentest | — |
| 2022 | Security model | Distrust |
| 2022 | MPC signers | |
| 2022 | Blackbox pentest | Yogosha |
| 2021 | Blackbox pentest | Yogosha |
Compliance-ready operations
AML / KYT integrations
Real-time transaction monitoring and Travel Rule tooling, integrating into your risk stack.
Deliberately unlicensed
We provide pure technology. Custody and client asset protection stay within your perimeter.
No vendor lock-in
Key export and import, with PKCS#11 interfaces. Move assets between vendors freely.
Insurance coverage
Cyber, E&O, and crime coverage through our insurance partners.
We help write the standards we’re audited against
The DFNS research team writes the protocols. Frontier cryptography work and standards contributions with NIST, the W3C WebAuthn Working Group, the Linux Foundation Decentralized Trust, and the MPC Alliance. Award-winning papers, open-source code, and leading authorities in threshold cryptography applied to authentication, networking, encryption, blockchain security, and more.
Discover our lab- 01 NIST
- 02 W3C WebAuthn Working Group
- 03 Linux Foundation Decentralized Trust
- 04 MPC Alliance
Found something? Tell us.
Bug bounty
With a PGP-secured message, email
We welcome good-faith research and take no legal action against responsible reporters. Expect timely responses and live updates through resolution.
Scam & phishing
Forward suspicious messages to
To verify a caller, email DFNS a random phrase and ask them to confirm it. Beware urgency, always verify sender authenticity, and never share credentials over email.