Keep Your Funds
Safe From Here On
Safeheron offers enterprise-grade digital asset self-custody services and MPC privatization solutions, ensuring the highest level of security for your assets.
Secure, Efficient, Scalable
Top-tier, battle-tested security solutions for 260+ institutions since 2021.
RAISED
PEAK AUC
SECURELY TRANSFERRED
Committed to the highest standards of security and compliance.
Certified and Insured
Partner with Top Security and Compliance Partners
Compliance in Action
Explore Our Trust Center
MPC Self-Custody
Enterprise-grade digital asset self-custody services
Eliminate single-point failures to manage digital assets
- MPC and TEE technologies protect your digital assets with the highest level of security.
- Manage wallets and transfer funds on multiple terminals, including the mobile App and Web Console.
- Policy Engine flexibly controls access authorization.
- Off-chain multisignature enhances approval privacy and significantly reduces on-chain transaction fees.
Interact with dApps under multi-party control
- Supports all public EVM-compatible blockchains and DeFi protocols.
- Policy Engine meticulously delegates transaction permissions.
- Real-time contract monitoring and phishing detection safeguard every transaction.
- Customize RPC nodes for diverse business scenarios.
- Collaboratively manage smart contract owner’s permissions to reduce single-point risk in critical operations.
Enterprise-grade digital asset self-custody services
- Seamlessly create and manage millions of MPC wallets with APIs.
- Automatic gas fuelling and sweeping significantly improve integration efficiency and accelerate your business success.
- Web3 API securely controls the entire lifecycle of smart contracts.
- API Co-Signer automates transaction approval and signing.
- MPC and TEE technologies provide multi-layer security to eliminate single-point-of-failure risk for private keys.
MPC Node Suite
White-label MPC privatization solutions
Flexibly build MPC wallets for seamless integration into your applications
- Fully privatized, with hardware-level data security and privacy protection under your control.
- A secure, universal, and cross-platform MPC-TSS key management solution.
- Support diverse business scenarios to accelerate your success.
Safest software is
open source
Safeheron independently developed MPC algorithms and is now the world's first company to open-source the mainstream MPC-TSS algorithm in C++.
Why choose us?
100% control over assets
3-of-3 MPC-TSS key management eliminates the single-point failures with full asset control.
Open-source algorithms
Safeheron open-sourced the world's first MPC-TSS algorithm library implemented in C++.
Maximum security
Safeheron’s multi-layer security defenses against state-level attacks.
Certified and insured
Safeheron is certified with ISO/IEC 27001:2022 and SOC 2 and is insured by Lockton.
Extensive features
Safeheron offers one-stop management for Web3, DeFi, NFTs, and smart contracts.
Governance and policy
TEE Policy Engine customizes multi-dimensional policies and approval workflows.
Technical support
Robust technical support encompasses use cases, solutions, technologies, and security expertise.
Diversified solutions
Battle-tested SaaS services and MPC privatization solutions.
Hear from our customers
Our partnership with Safeheron has unlocked new possibilities in digital payment through advanced MPC and TEE technology. This collaboration strengthens our security, scalability, and compliance, enabling us to meet the highest standards. With Safeheron’s powerful MPC self-custody solution, dtcpay continues to provide our users with institutional-grade security, seamless transactions, and an intuitive user experience, reinforcing our commitment to advancing the future of digital payments.
As a trusted financial service provider, we have strict standards when choosing our security infrastructure provider. Safeheron turns out to be a great match. Its MPC self-custody solution eliminates private key risks while providing enterprise-grade security with ease of use. With Safeheron’s sophisticated technology, we are confident to provide our customers with a reliable and secure digital payment experience.
The Safeheron team has in-depth expertise and extensive practical experience in blockchain security. With a highly robust security mechanism, a comprehensive permission management system, and an excellent user experience, Safeheron has provided strong support for our institutional trading services in the Asia region. We look forward to further deepening our collaboration.
UXUY has developed a highly secure key management service powered by Safeheron's MPC technology. In today's challenging cyber environment where digital assets face numerous security threats, Safeheron's mature solution provides us with robust technical assurance. Through this innovative MPC solution, we have effectively reduced the risks of private key leakage and asset theft, delivering users a seamless experience that combines both security and convenience.
With Safeheron’s hardcore MPC technology, we ensure the highest level of security for our clients' crypto funds within our crypto-to-fiat feature. In addition, Safeheron's customer support exemplifies excellence, promptly resolving issues to maintain our uninterrupted operations.
Partnering with Safeheron has been transformative for AlphaYield. Their MPC + TEE platform delivers the enterprise-grade security and operational efficiency we need to execute large institutional trades with complete confidence, while their exceptional team consistently goes above and beyond to support our evolving needs.
Security, flexibility, and compliance — all solved on one platform. Since integrating Safeheron, our business volume has tripled.
Latest Updates from Safeheron
What Is a DPT License in Singapore?
What is a DPT license in Singapore? It is the license the Monetary Authority of Singapore (MAS) grants under the Payment Services Act to firms providing digital payment token (DPT) services. Bitcoin, ETH and most stablecoins are digital payment tokens in Singapore, so any firm that buys, sells, exchanges, transfers or safeguards these tokens for customers in Singapore needs a DPT license. Which Businesses Need a DPT License? The Payment Services Act originally covered dealing in digital payment tokens and facilitating their exchange, typically exchanges and OTC desks. From 2024, the amended Act expanded DPT services to include token transfer and custody, so even a firm that never matches trades but only safeguards tokens or private keys, or transfers tokens for customers, needs a license. Licensees are split by size into standard payment institutions and major payment institutions, and once business volumes cross certain thresholds a firm must apply for a major payment institution license and face stricter oversight. How Does the DPT License Relate to the DTSP Regime? The DPT license governs services provided to customers in Singapore. Since June 30, 2025, the digital token service provider (DTSP) regime under the Financial Services and Markets Act has brought firms that are set up in or operate from Singapore but serve only overseas customers into licensing as well. MAS has […]
Why Does Hong Kong Require 98% Cold Storage for Crypto Platforms?
Why does Hong Kong require 98% cold storage for crypto platforms? The core reason is to shrink the share of client assets exposed to online attacks to a minimum. Most major exchange losses in history have come from hot wallets, so the Hong Kong SFC requires licensed virtual asset trading platforms to keep at least 98% of client virtual assets in cold storage. Even if a hot wallet is compromised, losses stay within a very small range. What Exactly Is the 98% Cold Storage Requirement? The requirement comes from the SFC’s regulatory guidelines for virtual asset trading platforms. Client assets must be held on trust by a wholly owned subsidiary of the platform, with at least 98% in a cold wallet and no more than 2% in a hot wallet for day-to-day withdrawals. Platforms must also arrange insurance or compensation for client assets, with stronger coverage expected for the online portion. The ratio is calculated on client assets, and platforms must monitor and maintain it continuously, not just meet it once at the time of licensing. The SFC’s wider expectations on key management are best read alongside its robust custody standards. How Does This Rule Affect Platform Operations? The most direct impact is on withdrawals. The hot wallet balance is capped, so when users withdraw heavily or in large amounts, […]
How Much Should a Business Keep in a Hot Wallet?
How much should a business keep in a hot wallet? There is no universal ratio. The principle is to hold just enough to cover normal outflows during one replenishment cycle, plus a buffer for peaks. Keep too much, and the loss is larger if the hot wallet is hacked; keep too little, and user withdrawals queue up while operations staff have to move funds manually again and again. Hot wallet balances should therefore be calculated from data and adjusted regularly as the business changes. How Do You Estimate the Balance a Hot Wallet Needs? Start with historical data: how much is withdrawn and paid out per day and per hour, when peaks occur, and how much those peaks grow during sharp market moves. Then look at how long one replenishment takes, including initiating the transfer, approval and on-chain confirmation. The target hot wallet balance is roughly the expected peak outflow over that period. Calculate it separately for each chain and token, since funds on different chains cannot cover for one another, and each chain also needs enough native tokens to pay fees; otherwise you may find you can’t send USDT without gas. How Do You Set Replenishment and Sweep Rules for a Hot Wallet? Give each hot wallet a lower bound and an upper bound. When the balance falls below […]
What Is a Hot Wallet?
What is a hot wallet? It is a crypto wallet whose private key or signing capability sits in an internet-connected environment, so it can initiate and sign transactions at any time, as opposed to a cold wallet that keeps its private key offline. Hot wallets do the heavy lifting for day-to-day payments, but precisely because they are online, businesses need to apply stricter controls to them. What Types of Hot Wallets Are There? Individual users are most familiar with software wallets on phones, browser extensions and desktops, which store private keys on internet-connected devices. Assets held in exchange accounts are often treated as hot wallets too, although strictly speaking users do not hold the private keys; the exchange holds them in custody. In business settings, a hot wallet is usually a server-side wallet that signs automatically through an API to process withdrawals and payments in bulk. Another type is the MPC wallet, where the private key is split into shares distributed across multiple parties that sign collaboratively online, so no single party ever holds the complete key. What Are Hot Wallets Used For? Any scenario that requires frequent, automated movement of funds relies on hot wallets: exchanges processing user withdrawals, payment providers paying and settling with merchants and suppliers, market makers and trading teams moving funds between venues, and interactions […]
What Should You Do If Your Hot Wallet Is Hacked?
What should you do if your hot wallet is hacked? Speed matters most: stop the losses first, then trace and freeze the funds, and only resume operations once the attack path has been closed. How the first few hours are handled determines how far the damage spreads. Businesses should prepare an incident response plan in advance and follow it when something happens, rather than improvising. What Should You Do Immediately After a Hot Wallet Is Hacked? The first step is to cut off the attacker’s access: pause all outgoing transfers from the compromised hot wallet and related wallets, including automated withdrawals, and revoke any API keys, login sessions and signing credentials that may have leaked. The second step is to protect the remaining funds by moving assets still in the affected environment to an address confirmed to be safe, and revoking any token approvals that could be abused. The third step is to preserve evidence: keep server logs, operation records and on-chain transaction hashes, and avoid rushing to reinstall systems, which could destroy evidence needed for investigation and accountability. Can Stolen Funds Be Recovered? Sometimes, depending on the type of asset and how quickly you act. If the stolen assets are centralized stablecoins such as USDT, contact the issuer as soon as possible, because the issuer can freeze funds at […]