Key & transaction security
Secure key management and transaction signing for enterprises
BitFashioned designs and reviews how enterprises hold keys, sign transactions, and approve them: MPC and multisig setups, HSM-backed key management, and the policies and approval flows around every signature. The goal is simple: no single person, device, or vendor can move funds alone, and every transaction can be explained after the fact.
Who this is for
- Funds, treasuries, and fintechs moving into on-chain assets that need a signing setup an auditor will accept
- Teams already on a custody or MPC provider that want an independent review of how it is configured
- Protocols and foundations managing treasury, upgrade, or bridge keys
Who this is not for
- Individuals looking for a personal wallet recommendation
- Teams that want a custody provider resold to them. We stay vendor-neutral.
What we actually do
Signing architecture
MPC, multisig, and HSM-based designs chosen for your threat model, chains, and operations, including key generation ceremonies and recovery.
Transaction policy and approvals
Quorums, spending limits, allowlists, time locks, and separation of duties, enforced in the signing path instead of in a spreadsheet.
Transaction verification
What signers actually see before they approve: decoded calldata, simulation, and checks against blind signing and address poisoning.
Setup review and incident readiness
Independent review of an existing custody or wallet setup, plus key rotation, compromise playbooks, and supply-chain checks on signing hardware.
Proof
Public, verifiable work. Follow the links.
- Critical vulnerability in the Avalanche protocol, responsibly disclosed through the HackenProof bug bounty program
- Incorrect ordering of fees and tips in Substrate's transaction payment module on Polkadot mainnet, disclosed via xx labs foundation
- qVault: open-source quantum-secure vault for EVM wallets (Solidity)
- W-OTS(+) up my Sleeve! Secure Fallback for Wallets (IACR ePrint 2021/872)
- Ledger Hardware Implant Incident: What We Know So Far (blog)
- Rethinking Chain Abstraction for Safer Crypto UX Flows (blog)
- KelpDAO, LayerZero, and When RPC Trust Became Debt (blog)
Networks, institutions, and companies we have worked alongside include the Ethereum Foundation, Polkadot, Avalanche, xx network, BIS, the Inter-American Development Bank, the State of Wyoming, Cayman Enterprise City, Lamina1, Parfin, and ai.moda. Names refer to collaboration, research, or engineering relationships, not endorsement.
How we work
We map who can move what, through which keys and devices, and where a single failure becomes a loss. Then we design the target setup, help you implement it with your provider or in-house, and test it with dry runs before real funds move.
How we compare
- Custody and MPC platforms
- Provide the signing infrastructure. Their defaults still need configuring for your policies, chains, and people.
- Smart contract auditors
- Review on-chain code. Most signing failures happen off-chain, in keys, devices, and approval flows.
- BitFashioned
- Vendor-neutral engineers who design the whole signing path, from key generation to the approval screen, and can build what is missing.
Start here
Tell us what assets you hold, on which chains, and how a transaction gets approved today. We will tell you quickly where the weak points are.