io.finnet

io.finnet (Io FinNet Group Inc.) is a US-based digital asset infrastructure company that provides institutional-grade self-custody and settlement tools to banks, funds, exchanges, and payment providers through a proprietary Trustless Multi-Party Computation (tMPC) architecture, with Solana custody and staking supported as part of its 60+ chain coverage.

What io.finnet Builds

Founded in 2021 and headquartered in Raleigh, North Carolina — with additional offices in the UK, Spain, Cayman Islands, and Singapore — io.finnet targets the operational gap between traditional finance and digital assets. Its pitch to institutions is full control over private key material with no reliance on a custodian, including io.finnet itself. The company claims 1,500+ institutional clients, ranging from OTC trading desks and crypto exchanges to neo banks and electronic money institutions.

The product suite spans three main lines:

io.vault is the flagship product: a multi-chain MPC self-custody wallet for institutions. Launched in May 2024, it manages wallets across Bitcoin, Ethereum, Solana, Tron, Bittensor, and dozens of other networks. Support covers 100,000+ tokens. Pricing is flat-fee with a free tier, and the platform imposes no fees on individual transactions or assets under custody.

io.network is a permissioned blockchain for 24/7 instant settlement, targeting interbank and institutional payment flows. It includes tokenization tooling and stablecoin issuance. io.finnet's payments rail, io.flow, connects to this network.

Wallet-as-a-Service (WaaS) is an API product that allows institutions to generate unlimited unique deposit addresses from a single seed, enabling exchanges and platforms to issue wallets to their own end clients without operating separate vaults.

Core Technology: Trustless MPC

The defining technical claim of io.finnet is that a complete private key is never assembled at any point — not during key generation, signing, or storage. The company calls this architecture tMPC, short for Trustless Multi-Party Computation. Each signer holds only a secret share on their own device, and transactions require a quorum of signers with sufficient cumulative "signing power" to reach a threshold before a signature is produced.

The system supports both ECDSA and EdDSA signature schemes, which covers effectively every blockchain with standard key cryptography. On Solana, which uses EdDSA (specifically Ed25519), this means io.finnet's threshold signing protocol works natively with the chain's transaction format.

The Virtual Signer is a server-side automation component: an always-on, policy-enforcing signing agent that can process transactions 24/7 without human intervention. Policies — such as spending limits, address whitelists, or DeFi trade restrictions — are enforced cryptographically by the Virtual Signer rather than as software-level rules that could be bypassed. A redesigned Virtual Signer interface launched in March 2025.

The platform exposes REST and GraphQL APIs, a JavaScript/Node.js SDK (@iofinnet/io-web3-provider), a GraphQL Query Builder, and a testnet sandbox. The company states a typical integration takes under one week. On the open-source side, io.finnet maintains a public Go fork of the tss-lib threshold signature library on GitHub.

Solana Ecosystem Involvement

Solana is a first-class supported network within io.vault, covering SOL and SPL tokens for custody, transfer, and tracking. The more significant Solana-related development came in August 2025 when io.finnet launched a staking integration with Everstake, one of the larger Solana validator operators.

The Everstake partnership allows io.finnet institutional clients to stake SOL (and ETH) directly from their existing MPC vaults without transferring assets to a separate custody arrangement. The staking flow is integrated into io.finnet's existing API and permissions framework, so institutional clients can apply the same role-based controls, audit logging, and programmable policies to staking transactions that they use for standard transfers. Everstake itself uses io.finnet to manage its own treasury. The integration is designed to expand to 15+ additional proof-of-stake assets.

io.finnet has no native token and no protocol-level governance component. Its Solana presence is strictly infrastructure: custody, staking yield generation, and API-based access for institutions that want to hold or earn on SOL without sacrificing key control.

Security Posture and Audits

io.finnet achieved SOC 2 Type 1 certification in January 2024 and SOC 2 Type 2 certification in November 2024, covering security, availability, confidentiality, and privacy. Its MPC implementation was independently audited by Kudelski Security, a Swiss cryptography and cybersecurity firm.

The most technically consequential public security work io.finnet has done is a coordinated vulnerability disclosure conducted jointly with Kudelski in early 2023. During their audit process, the two companies identified four critical vulnerabilities in tss-lib, an MIT-licensed Go library implementing Binance's threshold signature scheme that underpins a large portion of the MPC wallet industry:

• CVE-2022-47930: The session ID parameter was not enforced through the full MPC protocol, enabling message replay and spoofing attacks.
• CVE-2022-47931: Inputs were concatenated using $ as a delimiter, enabling hash collisions.
• CVE-2023-26556: Zero-knowledge proof malleability.
• CVE-2023-26557: Go's big.Int is not constant-time, creating a timing side-channel that could leak private key material.

io.finnet stated that its own tMPC implementation was not affected by these vulnerabilities — the bugs were in the upstream tss-lib dependency, not in io.finnet's modified fork. Coordinated disclosure was managed through the MPC Alliance in late February 2023; public disclosure and patches in tss-lib v2.0.0 followed on March 21, 2023. io.finnet claims the disclosure protected an estimated $70 billion in assets exposed by the unpatched library.

Additional security infrastructure includes Blockaid transaction screening (flagging malicious addresses and contract interactions before signing), Runtime Application Self-Protection (RASP) for anomaly detection at runtime, static and dependency scanning (SCA/SAST), full audit trails, and an open-source disaster recovery CLI tool with no third-party dependencies.

Team and History

io.finnet was founded in 2021 by Gregory Pepin, who serves as CEO. Pepin holds an MSc in Actuaries and Finance from HEC Lausanne and has a background in financial consulting, wealth management, and finance academia; he previously served as Managing Director at Cedrus Capital and Chairman of Delchain. The CTO and Chief Security Architect are Jacob Plaster and Luke Plaster respectively; Michael Jebsen serves as CFO and Catherine De Coninck as COO.

io.finnet completed EY's FinTech Growth Programme and joined the MPC Alliance in July 2024 — a consortium of over 50 companies including Meta and Salesforce that promotes MPC adoption in financial services. Notable partnerships include Blockaid (transaction screening), Kiln (institutional staking infrastructure for Ethereum), WalletConnect, AWS, and QuickNode. In November 2024, io.finnet signed a letter of intent with French computing manufacturer Metavisio (THOMSON Computing brand) to form a 50/50 joint venture aimed at producing consumer computers with built-in MPC cryptography for key management and digital identity.

The company positions itself directly against Fireblocks and Gnosis Safe, arguing that both models require trusting the vendor or co-signers at the key management layer, while tMPC eliminates vendor key access by design.

Fit Within the Solana Ecosystem

io.finnet addresses a specific segment of the Solana institutional market: large-balance holders — funds, exchanges, OTC desks, and staking operators — that need programmatic key management without the counterparty risk of third-party custodians. The Everstake integration makes io.finnet relevant to institutions that want to earn SOL staking yield while retaining the same control plane they use for the rest of their treasury. There is no DeFi-native angle, no token, and no on-chain governance participation. io.finnet is infrastructure for institutions that have already decided to hold SOL and want the most defensible key management architecture available.