The Vault Builds Its Own MPC Custody Cryptography, Audited by Halborn
The Vault, a Swiss and EU regulated digital asset custody platform, has built the multi-party computation (MPC) cryptography that governs who can move client assets, taking a component most rivals license from an outside vendor and bringing it in house. The library has now passed an independent security review by blockchain security firm Halborn, whose final report this week confirmed that every finding raised during the engagement had been fixed and verified, with the last items closed in August 2026. Chief executive Artem Stopnevich set out the work at the European Blockchain Convention in Barcelona on 17 September, on a panel covering the custody of tokenised funds, positioning ownership of the signing layer as the platform's differentiator in a market where the same cryptography is usually rented.
MPC is the technique that lets separate parties each hold a share of a signing key so that a complete private key never assembles on any single device or server. It is the mechanism behind The Vault's co-signing model, under which no participant, including The Vault itself, can authorise a transfer alone. The client holds a key share on their own device through a mobile signer, sold as an add-on to the platform's software-as-a-service custody product.
What does owning the cryptography actually change for an institution?
For a custodian, the signing layer is the part of the stack a client's technical due diligence team examines most closely, because it answers the only question that matters at the point of loss: who is able to move an asset, and under what controls. Most providers buy that layer from a third party. That arrangement ties the custodian to the vendor's release cycle for security fixes, to whichever elliptic curves and protocols the vendor chooses to support, and to the level of code disclosure the vendor permits when a prospective client comes asking.
Building it in house removes those dependencies. The Vault describes the result as sovereign cryptography, by which it means the code, the signing protocol and the release schedule sit with the platform: fixes ship on its own timetable, auditors can read the whole codebase rather than stopping at a vendor boundary, and the protocol can be updated as standards move. Halborn's own assessment, offered as the engaged auditor rather than a disinterested party, made the same point from the security side, noting that proprietary cryptography gives a provider direct control over fixes and lets reviewers examine the complete implementation, which matters when a client is scrutinising exactly who can touch its assets.
The technical detail supports the claim of end-to-end ownership. The library is written in Rust, a systems language whose compiler enforces memory safety without a garbage collector, ruling out whole classes of bug at compile time and giving explicit control over how key material is held in memory and erased once finished with. Chief technology officer Yurii Derbasov framed the language choice as buying properties the compiler can guarantee, while stressing that a compiler cannot make a signing protocol correct, which is why the design still needed external review of this depth. The same implementation runs on The Vault's servers and inside the iOS and Android signer, so a single codebase carries the whole system.
Is The Vault really first in Europe?
The company's framing is worth reading closely. Stopnevich described the library as the first sovereign cryptographic library for institutional custody in Europe, and the platform separately calls itself the only EU-regulated custody provider running institutional MPC cryptography of its own making. Both statements survive only inside a carefully drawn boundary.
Proprietary, in-house custody cryptography is not new to the region. Taurus, founded in Geneva in 2018, developed its Taurus-PROTECT custody platform internally and is the established custody leader across Switzerland and the wider European market, counting Deutsche Bank and State Street among its institutional clients. Fireblocks built its MPC-CMP signing protocol entirely with its own cryptography team and runs it beneath much of the institutional market. What lets The Vault's superlatives stand is the precise wording. Taurus is a Swiss securities firm, regulated by FINMA rather than under an EU regime, and its custody product leads with hardware security modules alongside MPC. Fireblocks is a technology vendor whose regulated custody arm sits in the United States. The Vault draws its box around EU regulation specifically, around MPC as the primary mechanism, and around ownership of the full signing stack down to the mobile signer.
That box is defensible, and the underlying substance, control of the code and a published third-party audit, is real. The marketing edge is narrower than the language suggests, and finance professionals assessing custody vendors should treat the claim as a statement about a specific regulatory and architectural combination, not about being alone in building cryptography.
What did the Halborn audit actually cover?
Scope is the part of any audit that determines its weight. Halborn's engagement covered 91 files spanning the cryptographic core, its test suite and the iOS and Android signer applications. The library implements distributed key generation, resharing, refresh and recovery, threshold ECDSA and EdDSA signing, and the supporting primitives of commitment, oblivious transfer and zero-knowledge proofs, together with the transport that carries protocol messages between signers. Rather than a single report at the end, findings were addressed as the review progressed, and Halborn verified each remediation against the specific code commit that implemented it, confirming the final items in August 2026.
Halborn is an established name in the field, with a dedicated practice for custody and digital asset infrastructure and prior work spanning the XRP Ledger and the Monetary Authority of Singapore's Project Guardian. An audit verifies what was in scope at a point in time and does not certify a system as unbreakable, a distinction institutional buyers understand. The Vault says the full report is available to institutional clients on request.
Why is The Vault building post-quantum signatures now?
The forward-looking part of the announcement points at a genuine gap in the standards. The Vault says it intends to publish the Rust library as open source, so the cryptography can be examined by anyone, a pledge that would raise the bar on transparency but has not yet been delivered. Its cryptography team is also working on two new protocols.
The first is a threshold variant of ML-DSA, the lattice-based post-quantum signature scheme that the US National Institute of Standards and Technology finalised in August 2024 as FIPS 204. That standard covers a single signer only. Threshold signatures, the multi-party form custody actually depends on, have no NIST-standardised version today, and candidate constructions, classical and post-quantum alike, are being evaluated under the NIST First Call for Multi-Party Threshold Schemes, which the company dates to January 2026. The second protocol is a threshold post-quantum password-authenticated key exchange. The relevance to custody is the harvest-now-decrypt-later risk: assets and key material that must stay protected for years, not months, are the clearest case for moving to quantum-resistant signatures before a capable quantum computer exists.
Why This Matters to FinanceX Readers
Custody is where institutional digital asset strategies succeed or fail, and the signing layer is the specific piece a risk committee signs off on. The Vault's move reframes a due-diligence question that vendors prefer to keep abstract: when a security flaw appears, whose release schedule decides how fast it is fixed, and can your auditors see the code that holds your keys. Owning that layer, and publishing an independent audit of it, is a credible answer, whatever the merits of the first-in-Europe framing.
For investors and treasury teams weighing custody providers, the practical takeaways are concrete. Ask whether a provider builds or licenses its MPC, and what that means for fix timelines and disclosure. Treat superlatives as boundary-drawing exercises and test where the line sits. And watch the post-quantum roadmap, because the absence of a NIST-standardised threshold signature is an industry-wide gap that will shape custody architecture well beyond any single vendor.
