Christopher Grilhault des Fontaines retweeted
Public blockchains showed everyone everything. Private blockchains hid too much.
For a decade, this kept capital markets offchain. @CantonNetwork was built to solve that problem. And last week, the world's largest securities depository started settling on it.
After Bitcoin and Ethereum, today we're looking at 𝗖𝗮𝗻𝘁𝗼𝗻. This is the third post in our network series.
Canton is different from the other networks we've covered. It's a network of networks. Each institution runs its own ledger and controls who can see its data, but can settle transactions with one another atomically.
Two banks settling a repo can see their trade. Nobody else can, not even the infrastructure connecting them. Securities and cash settle together or not at all.
The institutions that run these markets are now moving them to Canton.
→ Broadridge settles repo for most US primary dealers on the network.
→ Goldman Sachs settled a €100 million EIB bond on the same day, with legal title recorded onchain.
→ Euroclear runs collateral mobility around the clock.
→ Franklin Templeton, J.P. Morgan, HSBC and Circle have all brought products or cash to the network.
→ DTCC launched its Tokenization Service with Canton as one of its two networks from day one.
The article explains how Canton's privacy and settlement model works, the capabilities DFNS supports, what's already in production, the cryptography behind it and what's coming next.
That's what core banking for onchain finance is about.
📖 Read: dfns.co/article/canton
⌨️ Start building: app.dfns.io/get-started
Done ✅
On Canton, everything moves at once or nothing moves.
@dfnsHQ now supports 𝗖𝗮𝗻𝘁𝗼𝗻 𝗔𝗹𝗹𝗼𝗰𝗮𝘁𝗶𝗼𝗻𝘀. You can commit assets to a settlement and take part in atomic transactions involving multiple parties on the @CantonNetwork.
We support both versions of the Canton Network Token Standard: CIP-56 and CIP-112 (v2 approved in June). The addition in v2 is the “committed allocation.”
→ With V1, a party could still withdraw an allocation before settlement.
→ With V2, a committed allocation locks the assets on Canton until an agreed deadline.
The other parties know that those assets cannot be moved. This makes it possible to coordinate a settlement with another leg elsewhere 🤝
What DFNS does:
✔️ Applies policies to every allocation before assets are committed.
✔️ Signs the transactions with the key store of your choice (MPC, HSM, TEE)
✔️ Tracks every allocation and settlement so teams can follow the process and reconcile books.
✔️ Supports applications using either version with no DFNS-specific integration required on your side.
Institutions can now hold and govern their part of these transactions, including trades that extend beyond Canton through committed allocations.
That's what onchain core banking is for.
📖 Read: dfns.co/article/canton-alloc…
⌨️ Start building: app.dfns.io/get-started
Christopher Grilhault des Fontaines retweeted
With Bitget, the signer trusted the wrong host.
With NEAR Intents, the signer did everything right, but the ledger it trusted was wrong.
The result: $3.87 million stolen ⛓️💥
@dfnsHQ CISO, Thibault de Lachèze-Murel, has written another piece on the NEAR hack as a follow-up to his Bitget analysis. Together, the two incidents show two sides of the same problem:
Signers must verify who can authorize a transaction, and they must be able to trust the data behind it.
Here’s what happened to NEAR:
1️⃣ The system tracked what users were owed in an internal ledger, backed by funds held in vaults.
2️⃣ The attacker made 23 deposits that appeared in the ledger but failed to settle onchain.
3️⃣ The tokens were returned to the attacker… but the credits remained.
4️⃣ The attacker then withdrew the fake balance using real funds from the vaults.
The signers ran in secure enclaves and checked the ledger before signing.
But the ledger was wrong and nothing checked that the balances matched the actual funds.
The lessons here are simple:
→ Credit deposits only after onchain confirmation.
→ Continuously check that balances match available funds.
→ Set withdrawal limits that the ledger cannot override.
→ Treat external calls as untrusted and stop when they fail.
→ Monitor the system for inconsistencies, not just individual components.
A signer can control who authorizes a transaction. It cannot guarantee that the balance behind it is real. That needs a separate control.
That’s what onchain core banking is for.
📖 Read more: dfns.co/article/the-near-hac…
⌨️ Start building: app.dfns.io/get-started
Christopher Grilhault des Fontaines retweeted
Two years ago, we published our insurance policy when no one would.
Today, we’re sharing our newest insurance upgrade brought to us by Native.
On October 1, @dfnsHQ moved its insurance program to @LloydsofLondon. Both policies are now backed by Lloyd’s syndicates @Mosaic1609 and @markel_ger.
☑️ Technology and cyber: Coverage increased 4x, from $2.8M to $11.2M with Mosaic.
☑️ Crime: $11.2M in coverage, led by Mosaic and supported by Markel.
✅ Total coverage: Increased from $13.9M → $22.3M worldwide, covering DFNS and its subsidiaries.
Also: The two policies have separate limits, so a claim under one does not reduce the other.
What hasn’t changed? 𝘐𝘯𝘴𝘶𝘳𝘢𝘯𝘤𝘦 𝘩𝘢𝘴 𝘭𝘪𝘮𝘪𝘵𝘴. It is 𝗻𝗼𝘁 𝗮 𝗿𝗲𝗰𝗼𝘃𝗲𝗿𝘆 𝗽𝗹𝗮𝗻 and it 𝗰𝗮𝗻𝗻𝗼𝘁 𝗰𝗼𝘃𝗲𝗿 𝗹𝗼𝘀𝘀𝗲𝘀 𝗼𝗳 𝗮𝗻𝘆 𝘀𝗶𝘇𝗲. Exclusions still apply, and we’re happy to walk clients through the details.
▶️ What’s next: We’re arranging additional coverage and will announce it soon.
We’re also working with leading actors on specie insurance designed for multi-party compitation (MPC).
Clients can request the insurance certificate and policy wording under NDA.
We believe insurance should be clear, verifiable and part of taking responsibility for the risks we manage.
That’s what onchain core banking is for.
📖 Read more: dfns.co/article/insured-by-m…
⌨️ Start building: app.dfns.io/get-started
Christopher Grilhault des Fontaines retweeted
🇯🇵 In Japan, trust is built over decades.
NEC has spent more than 125 years building it with financial institutions.
Today, @NEC_jp and @dfnsHQ are partnering to explore digital asset infrastructure for Japanese financial institutions 🤝
The two companies have signed a Memorandum of Understanding to explore how DFNS can fit into NEC’s systems, including its planned custody offering.
The goal is to help Japanese institutions adopt digital assets without compromising their security, compliance, data residency or existing systems.
The partnership will focus on three areas:
1️⃣ Integrating DFNS wallets, key management, policies and transaction management into NEC’s digital asset infrastructure.
2️⃣ Adapting the platform to Japanese regulations and each institution’s security and operating requirements.
3️⃣ Supporting different deployment models, from SaaS to hybrid and fully on-premises, including air-gapped environments.
Institutions will be able to keep their keys, data and operations in Japan, in line with their requirements.
NEC will also explore support for digital securities alongside crypto assets, helping institutions develop new digital asset services.
That’s what onchain core banking is for.
📖 Read more: dfns.co/article/partnering-w…
⌨️ Start building: app.dfns.io/get-started
What a beautiful day in Lisbon!
Blessed to work with partners like @Nasdaq.
Thank you @HaglindMagnus @adenatfriedman and team 🤝
Welcome aboard, sir!
📈 He scaled a core banking platform to nearly 1M transactions a day.
Now he's building @dfnsHQ in Singapore.
Please welcome Zakarya Ali, our first software engineer in APAC.
Zakarya has spent more than ten years building systems where money, data and reliability meet:
→ At Majority in Stockholm, he ran core banking engineering. He lifted payment success and designed a double-entry ledger all under PCI and SOC 2
→ At Thales in Singapore, he led data and machine learning work for SMRT, Singapore's transit operator, and later led AI implementation for 15 engineers across Paris and Singapore
→ In six months there, he architected five production AI products, including a stablecoin payment agent, and an agentic system that cut its own running cost by 41%
→ He began at Accenture in Paris, building for clients such as Orange, La Banque Postale and EDF
Few engineers have worked on both sides of what DFNS does: the core banking systems that keep an institution's books, and the modern platforms that move value at scale. Zakarya has.
In Singapore, he'll work across our core platform and alongside clients in the region, helping institutions design and deploy on DFNS, and helping us build our engineering team in Asia.
Welcome, Zak. 🤝
📖 Read the announcement: dfns.co/article/welcome-zaka…
📮 See our open positions: jobs.deel.com/dfns
Christopher Grilhault des Fontaines retweeted
📼 Watch a transfer to an OFAC-sanctioned address get stopped.
Our CPO Chris Sutton demos the Elliptic KYT integration on @dfnsHQ, in under two minutes.
In the demo, Chris:
1️⃣ Confirms the @elliptic account on the new Integrations Hub card
2️⃣ Creates a wallet usage policy with the new rule: transaction prescreening with Elliptic
3️⃣ Sets a risk score threshold of five, and the action to block
4️⃣ Attempts a small ETH transfer to an actual OFAC-sanctioned address, signs with a passkey
🚫 Blocked by policy. The transfer details show Elliptic's pre-screening (risk score: 10, threshold: 5)
That's the whole point of screening in the execution path rather than after settlement.
Compliance that runs after the fact is a report. Compliance that runs before the signature is a control.
And it's your risk model doing the deciding. Set the score threshold your compliance team tuned in Elliptic, name the rule categories that trigger regardless of score, choose block or request approval.
The risk appetite you defined becomes enforcement behind the API. With the Elliptic assessment attached to every decision and persisted per transfer, the proof is the record whenever the examiner asks.
That's what onchain core banking is for.
🔘 Watch the demo: youtu.be/OSCyvoa0J-8
📖 Read the announcement: dfns.co/article/elliptic-int…
⌨️ Start building today: app.dfns.io/get-started
Done ✅
Creating a million wallets used to mean a million key ceremonies.
Now it takes one API call ✔️
Today, we’re launching 𝗕𝘂𝗹𝗸 𝗔𝗱𝗱𝗿𝗲𝘀𝘀𝗲𝘀 on @dfnsHQ.
Create up to one million custodial wallets in a single request, each with its own address, name, and tags.
Creating wallets securely with MPC takes time. That’s a problem when a payments platform needs deposit addresses for millions of users before launch.
Bulk Addresses solves this by running one MPC key ceremony per batch, then deriving each wallet address locally. No additional ceremony per wallet. No onchain activity until funds arrive.
Here’s how it works:
1️⃣ Create a batch with one API call.
2️⃣ Track progress as wallets are created in the background.
3️⃣ Retrieve the results in pages of 2,000 wallets.
Every wallet is ready to receive funds and use standard DFNS features, including webhooks and policies.
For payments, trading, and banking applications in need to swiftly create millions of deposit addresses, this makes a big difference.
Available at launch for Ethereum and its L2s, Tron, and Solana 🟢
⚠️ Bulk Addresses only works for org-controlled (“custodial”) wallets. Each batch shares a master key that cannot be exported, and the design prevents one wallet’s key from being used to reconstruct another’s.
📖 Read more: dfns.co/article/bulk-address…
⌨️ Start building: app.dfns.io/get-started
Christopher Grilhault des Fontaines retweeted
Creating a million wallets used to mean a million key ceremonies.
Now it takes one API call ✔️
Today, we’re launching 𝗕𝘂𝗹𝗸 𝗔𝗱𝗱𝗿𝗲𝘀𝘀𝗲𝘀 on @dfnsHQ.
Create up to one million custodial wallets in a single request, each with its own address, name, and tags.
Creating wallets securely with MPC takes time. That’s a problem when a payments platform needs deposit addresses for millions of users before launch.
Bulk Addresses solves this by running one MPC key ceremony per batch, then deriving each wallet address locally. No additional ceremony per wallet. No onchain activity until funds arrive.
Here’s how it works:
1️⃣ Create a batch with one API call.
2️⃣ Track progress as wallets are created in the background.
3️⃣ Retrieve the results in pages of 2,000 wallets.
Every wallet is ready to receive funds and use standard DFNS features, including webhooks and policies.
For payments, trading, and banking applications in need to swiftly create millions of deposit addresses, this makes a big difference.
Available at launch for Ethereum and its L2s, Tron, and Solana 🟢
⚠️ Bulk Addresses only works for org-controlled (“custodial”) wallets. Each batch shares a master key that cannot be exported, and the design prevents one wallet’s key from being used to reconstruct another’s.
📖 Read more: dfns.co/article/bulk-address…
⌨️ Start building: app.dfns.io/get-started
Time to leave Fireblocks while you can 🙂
streetinsider.com/dr/news.ph…
Now ➡️ dfns.co
Done ✅
The largest onchain order book now has its EVM.
@dfnsHQ now supports HyperEVM, the blockchain developed by @HyperliquidX ✔️
HyperEVM brings smart contracts to the Hyperliquid ecosystem. It shares the same validators, blocks and tokens as HyperCore, the order book behind one of the leading venues for decentralized perpetuals.
The key difference? Smart contracts can access live order book data, including prices and positions, and send instructions back without relying on an external oracle. This opens the door to lending markets that use live positions for liquidations and products that settle directly against order book data.
More than 170 projects were building on HyperEVM by early 2026, and Tether’s USDT0 has brought significant stablecoin liquidity to the network.
With DFNS, institutions can:
1️⃣ Create wallets and hold or transfer HYPE, USDT0 and other ERC-20 tokens.
2️⃣ Interact with HyperEVM smart contracts using their ABI.
3️⃣ Apply approval workflows, transaction limits and screening before signing.
4️⃣ Sign securely and track transactions through webhooks and a single audit trail.
Trading firms can manage assets across HyperCore and HyperEVM. Treasury teams can put stablecoins to work with clear controls. Platforms can create and manage wallets for their users at scale.
HyperEVM joins more than 100 networks supported by DFNS 🟢
📖 Read more: dfns.co/article/hyperevm-sup…
⌨️ Start building: app.dfns.io/get-started
Done ✅
Your own blockchain no longer needs a software release. Just an API call.
Today, we’re launching 𝗕𝗿𝗶𝗻𝗴 𝗬𝗼𝘂𝗿 𝗢𝘄𝗻 𝗖𝗵𝗮𝗶𝗻 on @dfnsHQ.
Banks and platforms increasingly run their own chains. Private Besu networks, consortium blockchains and appchains built on @OPLabsPBC Stack, @arbitrum Orbit, @avax, @0xPolygon, or @CantonNetwork.
Until now, adding one meant a code change and a new release, even for on-premises deployments.
Not anymore ✔️
Register a network through the API, and it works like any of the 100+ networks supported by DFNS.
1️⃣ Create wallets with the same key across compatible chains.
2️⃣ Sign, broadcast and track transactions.
3️⃣ Index blocks, decode contract events and monitor addresses.
4️⃣ Add networks on-prem without waiting for a DFNS release.
Each network is isolated by organization. RPC credentials stay encrypted, and retired network names cannot be reused.
We started with EVM chains. More chain types to follow.
Your chain. Your configuration. Ready to use 🟢
📖 Read more: dfns.co/article/bring-your-o…
⌨️ Start building: app.dfns.io/get-started
Christopher Grilhault des Fontaines retweeted
You give your Base address, but they send funds on Ethereum...
Same address, but wrong chain. Now what?
Our CPO Chris Sutton demos a simple fix:
➡️ Re-index a transaction by hash and network, directly from DFNS.
EVM addresses are the same across chains. Funds can arrive on a network DFNS wasn't tracking for that wallet.
In the demo, Chris:
1️⃣ Sends 20 USDC to his Base address on Ethereum Sepolia.
2️⃣ Creates an Ethereum Sepolia wallet for the same key, but sees a zero balance.
3️⃣ Re-indexes the transaction from organization settings.
✅ Returns to the wallet. The 20 USDC are there.
No support ticket. No waiting. Just re-index the transaction and move on.
A small feature that makes a real difference when you run digital asset operations at scale.
That's what onchain core banking is for.
🔘 Watch the demo: youtu.be/yn4KTZO3Rro
⌨️ Start building today: app.dfns.io/get-started
Christopher Grilhault des Fontaines retweeted
.@christophergdf, CEO of @dfnsHQ, says that by next year, you’ll be using tokens without even realizing it.
“It’s gonna be kinda normal to have an account, a wallet, etcetera, and it’s gonna be normal to send and receive tokens.”
Done ✅
Until now, if we missed a deposit, you had to file a ticket and wait...
That changes today. You can now replay transactions yourself from @dfnsHQ 🟢
Replay any missed transaction by hash, from the dashboard or API. Available to every customer, at no extra cost.
Indexers can miss events when a node drops a block, a chain reorganizes, or a wallet is added after a deposit arrives. When that happens, you need to deal with missing balances, uncredited users, incomplete records, and more.
Now you can fix it yourself:
✔️ Paste the transaction hash in the dashboard or API.
✔️ DFNS re-fetches the transaction and updates history and balances within a minute.
✔️ Standard webhooks trigger your existing deposit and sweep workflows.
✔️ Replays are idempotent: no duplicate records or webhooks.
✔️ Access is limited to your own wallets and rate-limited.
No support ticket. No waiting. Just a complete transaction record.
It's a small feature that makes a big difference in support, speed, and reliability.
That's what onchain core banking is for.
📖 Read more: dfns.co/article/transaction-…
⌨️ Start building: app.dfns.io/get-started
Christopher Grilhault des Fontaines retweeted
🛡️ A certification is a promise. A surveillance audit checks you still keep it.
In August, @dfnsHQ passed its first ISO/IEC 27001, 27017 and 27018 surveillance audit, with a positive recommendation from MSECB on all three.
Over four days, auditors reviewed our security controls across SaaS and on-premises deployments, from risk management and disaster recovery to backups, incident response and employee training.
The result: all three certifications maintained. No major findings. One minor documentation issue, now corrected and closed ✅
This follows another year of work: SOC 2 renewed with no exceptions, new security controls, better monitoring and recovery, and a detailed analysis of the limits every provider faces.
Security isn’t a certificate on a wall. It’s the controls you run, test and improve every day.
The full audit report is available to clients under NDA.
⏩ Next: ISO 22301 for business continuity and SOC 1 for financial controls.
📖 Read more: dfns.co/article/iso-27001-27…
⌨️ Start building: app.dfns.io/get-started
Christopher Grilhault des Fontaines retweeted
“A good business to be in is physical custody.”
Because every tokenized asset is backed by something real, someone has to keep it “in a secure location” and certify that it’s there.
Says, @christophergdf, CEO of @dfnsHQ on the live show.
Christopher Grilhault des Fontaines retweeted
Usually, a margin call is a lock increase.
Now it's only one atomic change, not an unlock-and-relock anymore.
Our CPO Chris Sutton demos our latest upgrade to Vaults, enabling you to modify a locked position.
In the demo, Chris:
1️⃣ Opens a vault with 5 USDC locked and scrolls to the lock entry
2️⃣ Changes the locked amount from 5 to 10 USDC
3️⃣ Signs with a passkey.
✅ Locked balance: 10. Available: 10. One operation, no intermediate state
The alternative to atomic changes is to release the lock and create a new one, which opens a window where the collateral is briefly free. For a lender raising a margin requirement, or a venue extending a trading line, 𝘵𝘩𝘢𝘵 𝘸𝘪𝘯𝘥𝘰𝘸 𝘪𝘴 𝘵𝘩𝘦 𝘸𝘩𝘰𝘭𝘦 𝘳𝘪𝘴𝘬.
Modifying in place means the funds are never unlocked on the way to being locked for more. The commitment only ever moves in one step, and the counterparty's guarantee never lapses.
The same permission model holds throughout. Increases route through the committing party's approval, so a lock can't be enlarged unilaterally, and only the lock owner can reduce, release, or settle against it. Nothing locks without you, nothing unlocks without them, and now nothing changes size without both.
Off-exchange settlement, collateral, escrow. The same primitive, now adjustable without ever letting go.
That's what onchain core banking is for.
🔘 Watch the demo: youtu.be/XRrw6UV5Gtw
📖 Read it: dfns.co/article/locks
⌨️ Start building today: app.dfns.io/get-started
Done ✅
👥 Most access controls don't fail in a breach. They fail quietly through drift.
On most platforms, approval policies name specific people. So when someone joins or leaves a group, like the “treasury team,” an admin must manually update every policy that mentions them. Do that for a year and you end up with dozens of hand-maintained user lists that no one fully trusts.
Today we're introducing 𝗨𝘀𝗲𝗿 𝗚𝗿𝗼𝘂𝗽𝘀, so that never has to happen again.
A User Group is a named team the platform understands.
✔️ Assign permissions to the group and every member inherits them.
✔️ Name the group as the approver and the quorum is drawn from that team.
✔️ Someone joins? Add them to the group once.
✔️ Someone leaves? Remove them once. Every policy and permission self-updates.
You can create a group with the same name as the one in your identity provider, and from there we follow your IdP (e.g. Okta, Microsoft) at every login. A match adds the user, an absence removes them, including for admin access.
Because a group is a way to grant power, it's also governed like one:
→ Adding someone to a privileged group grants the same rights as assigning them directly
→ Deleted group names stay reserved and can’t be recreated with different rights
→ A floor guard prevents removing the last administrator, directly or through group deletion
→ Every membership change is signed, audited, and traceable
The org chart and the platform now say the same thing, and your auditors can prove it.
That's what onchain core banking is for.
📖 Read it: dfns.co/article/user-groups
⌨️ Start building today: app.dfns.io/get-started
