Digital asset custody
Oryx
Custody with a quorum and no heroes
- Sector
- Digital asset custody
- Location
- Dubai, UAE
- Year
- 2025
- Kickoff to production
- 22 weeks
Institutional custody where every withdrawal needs a quorum, a whitelist and a time lock, and no single person can move anything.
The desk held client assets in a wallet controlled by two people and a shared password manager. Approvals happened on a phone call, transaction policy existed as a document, and an auditor had no way to test either.
- 01
Policy in hardware, not in a memo
Limits, whitelists and time locks are enforced by the signing devices themselves, so a policy cannot be talked around at eleven at night.
- 02
A quorum by role
Approvals are bound to roles (operations, treasury, risk, compliance) with separation of duties enforced technically rather than by trust.
- 03
Recovery rehearsed, not assumed
The key ceremony, backups and recovery path were documented and rehearsed with the client twice before a single asset moved.
The desk passed its licensing review using control evidence the system produces itself, and now onboards institutions that had previously refused it on custody grounds.
What changed
- Signing quorum
- 4-of-6
- Withdrawals
- Whitelist + timelock
- Control evidence
- Licensing-ready
Stack
- Rust
- Postgres
- Next.js
- Kubernetes
- HSM
Disciplines applied
- Financial technology
- Technical consulting
