Overview
An Australian Solana trading product that operates under a currency exchange licence. From a chat interface, a user could create a wallet, deposit Australian dollars, get a quote, confirm a trade and see it filled. The interface was a chat, but behind it was a licensed exchange holding customer funds on a public chain.
IO Corp's work covered the custody architecture and the security work leading up to external review. The product is owned and operated by its own team.
Custody architecture
If an exchange's keys leak, customer funds can be taken, so custody got the most attention. The version we shipped to production works like this.
Private keys are not in the database
An early version stored the private key on the wallet record. Before going live, we removed that column entirely. The database holds the public address and metadata only, so a snapshot does not leak funds.
Encrypted at rest with KMS envelope encryption
Encrypted key material lives in object storage, wrapped in AWS KMS envelope encryption with HSM-backed master keys. Decrypting a key takes a KMS call, which is logged and controlled by IAM.
Signing happens in an isolated function
The API that handles conversations never touches plaintext keys. A separate function fetches, decrypts, signs and returns the signed transaction. A compromise of the chat-side API cannot, on its own, move funds.
A last-mile guard on the response
The signing function scans its own response for anything that looks like a private key before returning. If a future change ever bundles key material into a response, it refuses to send it.
Audit
A third party ran a formal penetration test on the platform before launch. We fixed what it found and shipped the fixes before the product went live.
The product is operated, owned and licensed by its own team. The client name and product brand are withheld under a non-disclosure agreement.