Overview
A Solana trading product operating under a regulated currency exchange licence. From a chat interface a user could create a wallet, deposit fiat, get a quote, confirm a trade and see it filled. It looked like a chat app, but behind it was a licensed exchange holding real user funds on a public chain.
I was the founding engineer. My responsibilities included the custody architecture, the security setup and the work to get ready for audit. The product is owned and operated by its own team.
Custody architecture
For a licensed exchange holding user funds on a public chain, custody is the part that can sink the company if it goes wrong. The version that went to production had four properties.
Private keys are not in the database
An early version stored the private key on the wallet record. Before launch we removed that column entirely. The database holds only the public address and metadata, so a database snapshot can't leak funds.
Encrypted at rest with KMS envelope encryption
Encrypted key material lives in object storage, wrapped with AWS KMS envelope encryption. KMS holds the master key, backed by an HSM. Decrypting a private key takes a KMS call, which is logged and controlled by IAM.
Signing happens in an isolated function
The API that handles user conversations never sees a plaintext private key. When a trade needs signing, the API passes the user and wallet IDs to a separate function. That function is the only part of the system that fetches the encrypted key, decrypts it through KMS, builds the keypair in memory, signs the transaction and returns it. Someone who compromised the chat-side API still couldn't move funds with that alone.
Last-mile guard on the response
Before it returns, the signing function scans its response for anything that looks like a private key. If a later change ever put key material in a response by accident, the function would refuse to send it.
Audit
An external firm ran a formal penetration test before launch. We worked through the findings and shipped the fixes before the product went live.
The product is operated, owned and licensed by its own team. The client name and product brand are withheld under a non-disclosure agreement.
