The time-lock is the alarm
A withdrawal request starts a 24-hour clock, visible to you and your guardians. A legitimate withdrawal is a day of patience; a fraudulent one is a day of warning — plenty of time to cancel a request you never made.
Guardians and the whitelist
Funds move only when 2 of 3 guardians approve, and only to addresses already on the whitelist. Adding a new address is itself a guarded, time-locked operation — so an attacker cannot simply whitelist themselves first.
- [ 01 ]2-of-3 approval — no single point of compromise
- [ 02 ]Whitelist changes go through the same gauntlet
- [ 03 ]Self-custody throughout: your keys, your guardians