The problem
Businesses holding digital assets need custody where no single key can move funds, every transfer follows a policy, and the ledger always agrees with the chain.
What I built
A signing service in Go using threshold ECDSA (CGGMP21) and FROST, so a transaction is signed by key shares working together and the full key never exists.
Key shares kept out of the database, encrypted with KMS envelope encryption and referenced by pointer.
Approval policies with quorums, four-eyes rules (no self-approval) and biometric step-up, enforced under row locks so two approvals can't race.
An append-only ledger per wallet and asset. Every change goes through one service under a lock, and duplicate references are rejected.
Deposits credited once per transaction after a set number of confirmations, keyed by chain, asset, transaction and log index, so a rescan or restart never credits twice.
Transfer execution that claims the transfer atomically, debits before broadcasting, and posts a compensating reversal if the broadcast fails.
The result
Running at mpc.bitopayments.com across EVM chains, Bitcoin, Solana and Stellar, with integration tests for exactly-once deposits, signer outages and unknown broadcast outcomes.
Stack: TypeScript, Go, PostgreSQL, Drizzle, BullMQ, AWS KMS
0 likes · 2 views · Oct 30, 2026
Custody where the private key is never assembled. Go threshold signing, approval quorums and exactly-once deposits on EVM, Bitcoin, Solana, Stellar.
