🛡️ A certification is a promise. A surveillance audit checks you still keep it. In August, @dfnsHQ passed its first ISO/IEC 27001, 27017 and 27018 surveillance audit, with a positive recommendation from MSECB on all three. Over four days, auditors reviewed our security controls across SaaS and on-premises deployments, from risk management and disaster recovery to backups, incident response and employee training. The result: all three certifications maintained. No major findings. One minor documentation issue, now corrected and closed ✅ This follows another year of work: SOC 2 renewed with no exceptions, new security controls, better monitoring and recovery, and a detailed analysis of the limits every provider faces. Security isn’t a certificate on a wall. It’s the controls you run, test and improve every day. The full audit report is available to clients under NDA. ⏩ Next: ISO 22301 for business continuity and SOC 1 for financial controls. 📖 Read more: dfns.co/article/iso-27001-27… ⌨️ Start building: app.dfns.io/get-started

Until now, if we missed a deposit, you had to file a ticket and wait... That changes today. You can now replay transactions yourself from @dfnsHQ 🟢 Replay any missed transaction by hash, from the dashboard or API. Available to every customer, at no extra cost. Indexers can miss events when a node drops a block, a chain reorganizes, or a wallet is added after a deposit arrives. When that happens, you need to deal with missing balances, uncredited users, incomplete records, and more. Now you can fix it yourself: ✔️ Paste the transaction hash in the dashboard or API. ✔️ DFNS re-fetches the transaction and updates history and balances within a minute. ✔️ Standard webhooks trigger your existing deposit and sweep workflows. ✔️ Replays are idempotent: no duplicate records or webhooks. ✔️ Access is limited to your own wallets and rate-limited. No support ticket. No waiting. Just a complete transaction record. It's a small feature that makes a big difference in support, speed, and reliability. That's what onchain core banking is for. 📖 Read more: dfns.co/article/transaction-… ⌨️ Start building: app.dfns.io/get-started

Your own blockchain no longer needs a software release. Just an API call. Today, we’re launching 𝗕𝗿𝗶𝗻𝗴 𝗬𝗼𝘂𝗿 𝗢𝘄𝗻 𝗖𝗵𝗮𝗶𝗻 on @dfnsHQ. Banks and platforms increasingly run their own chains. Private Besu networks, consortium blockchains and appchains built on @OPLabsPBC Stack, @arbitrum Orbit, @avax, @0xPolygon, or @CantonNetwork. Until now, adding one meant a code change and a new release, even for on-premises deployments. Not anymore ✔️ Register a network through the API, and it works like any of the 100+ networks supported by DFNS. 1️⃣ Create wallets with the same key across compatible chains. 2️⃣ Sign, broadcast and track transactions. 3️⃣ Index blocks, decode contract events and monitor addresses. 4️⃣ Add networks on-prem without waiting for a DFNS release. Each network is isolated by organization. RPC credentials stay encrypted, and retired network names cannot be reused. We started with EVM chains. More chain types to follow. Your chain. Your configuration. Ready to use 🟢 📖 Read more: dfns.co/article/bring-your-o… ⌨️ Start building: app.dfns.io/get-started

🌐 Turn fiat payments into stablecoins cross 113+ countries. Today, we’re launching 𝗣𝗮𝘆𝗶𝗻𝘀 on DFNS, starting with @borderlessxyz. Until now, bringing fiat into a stablecoin operation meant leaving the platform. Separate portals, manual wallet mapping, and reconciliation between bank statements and blockchain transactions. That changes with Payins ✔️ Now, you can: 1️⃣ Select the wallet where your stablecoins should arrive. 2️⃣ Enter the amount, country, and payment method. 3️⃣ Review the quote and sign with a passkey. 4️⃣ Send fiat to the bank details provided. ✅ Done! Any stablecoin in your wallet. Through one API, we connect you to 19+ locally licensed payment providers, such as Cobre, Capa, Triple-A, Stripe, MoonPay, Walapay, and more, across 72+ currencies. USD, EUR, GBP. MXN, BRL, COP, ARS. NGN, KES, ZAR. INR, PHP, AED. No FX markups. A flat platform fee. Funds settle directly with the providers. On DFNS, every payin has a status, an audit trail, and a destination governed by the same policy engine as the rest of your operations. That’s what onchain core banking is for. 📖 Read it: dfns.co/article/payins ⌨️ Start building: app.dfns.io/get-started

On September 24, @bitget lost $387.5 million. But no key was stolen. The attacker took control of the server that told the signer what to sign, and the signer obeyed. Our CISO, Thibault de Lachèze-Murel, breaks down the Bitget hack: 𝘞𝘩𝘢𝘵 𝘩𝘢𝘱𝘱𝘦𝘯𝘦𝘥, 𝘸𝘩𝘪𝘤𝘩 𝘤𝘰𝘯𝘵𝘳𝘰𝘭𝘴 𝘧𝘢𝘪𝘭𝘦𝘥, 𝘸𝘩𝘢𝘵 𝘵𝘰 𝘤𝘩𝘢𝘯𝘨𝘦, 𝘢𝘯𝘥 𝘸𝘩𝘢𝘵 𝘳𝘪𝘴𝘬𝘴 𝘳𝘦𝘮𝘢𝘪𝘯 𝘪𝘯 𝘰𝘶𝘳 𝘰𝘸𝘯 𝘮𝘰𝘥𝘦𝘭. Based on interim reports from @Mandiant and @SlowMist_Team, here’s what happened: → A flaw in a third-party security product gave the attacker access 24 days before the theft. → A reused employee identity opened the way to the wallet server. → A withdrawal tool bypassed its own risk checks. → Bitget’s wallets signed the transfers as legitimate withdrawals. → $203 million moved across five chains in nine seconds. → Signing continued for 2h39 after the alert. Bitget stopped customer withdrawals, not the attacker. The problem wasn’t key storage. It was who the signer trusted. 🫆 The signer checked where the request came from, not whether it was authorized. It had no proof that a person approved the transfer or that the destination and amount matched the approved instruction. You can reduce this risk by: ✔️ Checking authority, not just origin. ✔️ Separating policy decisions from systems an attacker could compromise. ✔️ Requiring a client-controlled credential. ✔️ Limiting the warm tier with allowlists, quorums and velocity limits. ✔️ Practising how to stop signing independently of customer withdrawals. But no vendor can eliminate every risk. Our analysis explains what providers can prevent, what clients must control, and what risks remain. 🛡️ Questions? [email protected] 📖 Read the analysis: dfns.co/article/the-bitget-h… ⌨️ Start building: app.dfns.io/get-started

🇰🇷 Korea’s digital asset rules start with banks. That means network segregation, data kept in Korea, and strict controls to protect users’ assets. Today, we’re partnering with FairSquare Lab to make that possible. FairSquare Lab provides blockchain technology to the KDX consortium, co-founded Korea’s first dedicated digital asset custodian, and helps lead initiatives for won stablecoins and cross-border FX settlement. Its platform, Sphere, is built on @dfnsHQ. Together, we’re building wallet and custody infrastructure designed to run inside Korean financial institutions’ own environments. ✔️ On-premises deployment integrated with the bank’s HSMs. ✔️ Offline signing for networks separated from the internet. ✔️ Local data control, keeping wallet and transaction data in Korea. ✔️ Bank-defined controls, with approval workflows, transaction limits and a full audit trail. ✔️ A path to custody, as Korea’s regulatory framework develops. DFNS provides the core banking platform for digital assets. FairSquare Lab brings local integrations and deep knowledge of Korean banks’ security and compliance requirements. As FairSquare Lab CEO Joonhong Kim puts it: “𝘉𝘢𝘯𝘬𝘴 𝘯𝘦𝘦𝘥 𝘣𝘰𝘵𝘩 𝘨𝘭𝘰𝘣𝘢𝘭-𝘨𝘳𝘢𝘥𝘦 𝘴𝘦𝘤𝘶𝘳𝘪𝘵𝘺 𝘢𝘯𝘥 𝘪𝘯𝘧𝘳𝘢𝘴𝘵𝘳𝘶𝘤𝘵𝘶𝘳𝘦 𝘵𝘩𝘢𝘵 𝘧𝘪𝘵𝘴 𝘒𝘰𝘳𝘦𝘢𝘯 𝘳𝘦𝘨𝘶𝘭𝘢𝘵𝘪𝘰𝘯.” 🟢 Available today. Global tech. Local control. Built for Korean institutions. 📖 Read more: dfns.co/article/partnering-w… ⌨️ Start building: app.dfns.io/get-started

👥 Most access controls don't fail in a breach. They fail quietly through drift. On most platforms, approval policies name specific people. So when someone joins or leaves a group, like the “treasury team,” an admin must manually update every policy that mentions them. Do that for a year and you end up with dozens of hand-maintained user lists that no one fully trusts. Today we're introducing 𝗨𝘀𝗲𝗿 𝗚𝗿𝗼𝘂𝗽𝘀, so that never has to happen again. A User Group is a named team the platform understands. ✔️ Assign permissions to the group and every member inherits them. ✔️ Name the group as the approver and the quorum is drawn from that team. ✔️ Someone joins? Add them to the group once. ✔️ Someone leaves? Remove them once. Every policy and permission self-updates. You can create a group with the same name as the one in your identity provider, and from there we follow your IdP (e.g. Okta, Microsoft) at every login. A match adds the user, an absence removes them, including for admin access. Because a group is a way to grant power, it's also governed like one: → Adding someone to a privileged group grants the same rights as assigning them directly → Deleted group names stay reserved and can’t be recreated with different rights → A floor guard prevents removing the last administrator, directly or through group deletion → Every membership change is signed, audited, and traceable The org chart and the platform now say the same thing, and your auditors can prove it. That's what onchain core banking is for. 📖 Read it: dfns.co/article/user-groups ⌨️ Start building today: app.dfns.io/get-started