Protection

The first on-chain exchange
with real custody insurance

Every US brokerage account is insured up to $500,000 by SIPC. Every US bank account is insured up to $250,000 by FDIC. No crypto exchange — centralized or decentralized — has ever offered anything comparable. Gilt is building it.

1,500×

Fund-to-insured-assets ratio vs SIPC. Gilt targets 20–35% reserves. SIPC runs at 0.01%.

7×

TVL is hard-capped at 7× fund balance. We pause deposits before we outgrow reserves.

< 1wk

Automatic on-chain payout on detected anomaly. No governance, no vote, no waiting.

The trust gap

Every year, billions are lost. Nothing is insured

After every hack, users ask the same question: why don't I just trade somewhere my funds are insured? Until now, that question had no good answer.

Cross-chain bridge exploit

Recurring · 2022–present

$2.5B+

signature & validator compromises

Smart-contract exploit

Recurring · ongoing

$1.8B+

oracle, logic, reentrancy

Exchange custody failure

Recurring · 2014–present

$1B+

hot-wallet & key compromises

Every month brings another headline. Industry-wide, billions have been lost to bridge exploits, contract bugs, and custody failures — with zero third-party custody insurance covering users. Existing crypto "insurance funds" cover a trader's margin shortfall. They do not cover the exchange getting drained.

Live Protection Fund

Protection scales with the platform, in real time

As fees flow in, the fund grows. As the fund grows, the deposit cap grows and the per-account cap rises. Every dollar is backed before it's accepted.

Fund balance

$500,000

bootstrap · team capital

Current TVL

$2.1M

61% of cap

Max TVL (7×)

$3.5M

pauses at 100%

Coverage ratio

102%

of max insured claims

current TVL ↑ deposits pause at max

Per-account cap (current)

$10,000

Next cap raise

$15K @ $15M fund

Current fee allocation

50% to fund

Two funds. Two risks

Custody risk and trading risk need different funds

Most DEXes lump everything into one opaque "insurance fund" that only covers liquidation deficits. Gilt separates custody risk (bridge compromise, contract exploits) from trading risk (liquidation shortfalls) because they need different funding mechanisms.

PPF · Protocol Protection Fund

Covers custody failure. This is the SIPC analog

Bridge compromise. Validator collusion. Smart-contract exploit in the custody layer. Oracle manipulation that results in unjust extraction. This is what no other DEX has.

Coverage target200% of max insured claims

Bootstrap capital$500K team capital

Fee allocationAdaptive 50% → 5% by coverage

Per-account cap$10K → $250K (scales)

Held onEthereum mainnet (separate multisig)

Claim triggerAutomatic, on-chain

TIF · Trading Insurance Fund

Standard liquidation-deficit fund

Covers the gap when a liquidation can't close before margin goes negative. Without this fund, losses socialize via ADL — profitable traders get force-closed.

Seed target$100K

Primary fundingLiquidation penalties (~1%)

Bootstrap skim5% of fees until seeded

Re-engagesIf balance < $50K

Natural hedgeRevenue tracks need

Fund-to-assets ratio

Traditional insurance runs thin because failures are sequential. Crypto's aren't

A brokerage failing doesn't take down every other brokerage. A bank failing doesn't drain every other bank. But a bridge drain is all-at-once, irrecoverable, and has no US Treasury backstop. That's why Gilt holds a fund ratio two orders of magnitude higher than SIPC.

Gilt PPF target

20–35%

FDIC US bank deposits

1.3%

SIPC US brokerages

0.01%

SIPC can afford a 0.01% ratio because broker failures are sequential, assets can be recovered, and the US Treasury stands behind it. Gilt holds ~1,500× that ratio because bridge drains are all-at-once, recovery is impossible, and the fund stands alone.

Adaptive fee waterfall

When coverage is low, the fund gets more. Automatically

The PPF's share of fees is set by the current coverage ratio — the state of the system, not the calendar. Post-drain recovery is automatic. Drag the slider to see how fees distribute at different coverage levels.

Coverage ratio

80%

↑ rebuilding the fund

0% 100% 200% 300%+

PPF 50%

Rebuilding custody reserves

TIF 5%

Trading fund seed

LP sweetener 10%

Flat, lock-weighted

Treasury 35%

Residual

Bridge defense

Max drain is capped by design, not by hope

The fund is the last line of defense, not the only one. Five structural mechanisms make a full drain architecturally impossible — while keeping every legitimate withdrawal instant.

LAYER 01

Per-bridge rate limit

Each bridge enforces a maximum hourly outflow as a percentage of its balance. Scales automatically with TVL — larger bridge, proportionally larger limit.

× stops rapid drain

LAYER 02

Daily outflow cap

Catches slow-drain attacks that stay under the hourly limit. Total extraction is capped over any 24-hour window, per bridge.

× stops slow drain

LAYER 03

Global circuit breaker

Ferros monitors aggregate withdrawals across all five bridges. Anomalous total outflow pauses every bridge simultaneously — even if no single bridge tripped its own limit.

× stops multi-bridge

LAYER 04

Pattern-based anomaly detection

Admin-function calls on any bridge trigger instant auto-pause. Coordinated fresh-account drains are blocked. Honest users with normal patterns are never flagged.

× stops sybil & admin-key attacks

LAYER 05

Per-chain key isolation

Each validator uses a different signing key per chain, HSM-derived from a master. Compromise on one chain can't unlock any other.

× limits blast radius

HARDENED CODEBASE

Dual audits, formal verification, bounty

Five bridges share one Solidity codebase — which means one surface gets all the attention. Two independent top-tier audit firms. Formal verification of rate-limit and circuit-breaker logic. A $500K+ bounty dedicated to the bridge.

Five chains at launch

EVM

Ethereum

EVM

Base

EVM

Arbitrum

EVM

Polygon

EVM

BNB Chain

USDC & USDT deposits across all five. More chains added as audits clear.

Float composition

The fund earns yield while standing ready

A 30% liquid floor is non-negotiable — that's the claim-processing cushion, always on instant access. The rest is diversified across uncorrelated yield strategies with a hard 15% per-venue cap.

30%

25%

15%

30% · 0%

Liquid reserve

native USDC, instant access

30% · 4–5%

Short-term T-bills

Ondo, Maple (tokenized treasuries)

25% · 3–6%

Stablecoin lending

Aave, Morpho (USDC supply)

15% · 3–4%

Liquid staking

stETH or equivalent

Stress test

What happens when something actually goes wrong

Worked scenario: a single bridge is compromised at Month 12 (realistic growth case). $12M drained (20% of $60M TVL — constrained by the per-bridge rate limit and global circuit breaker).

Pre-event PPF

$18.7M

TVL

$60M

Drain

$12M

Insured claims

$8.4M

T + 0

Bridge balance anomaly detected. All bridges auto-pause. Claim process initiates on-chain.

drain contained

T + minutes

30% liquid reserve is instantly available. Pro-rata payout to insured accounts begins.

$5.6M paid

T + 24–72h

T-bill and lending positions unwound. Remaining claim balance becomes available.

+$2.8M paid

T + 1 week

All insured claims settled in full. Fund allocation re-engages at the 50% bracket.

$8.4M total paid

T + ~5 months

Adaptive fee allocation rebuilds PPF to the 200% target from organic fee revenue.

back to 200%

Post-event coverage: 123%. The protocol survives the drain, pays all insured claims within a week, keeps coverage above 100%, and fully rebuilds in about five months — without external capital.

Hard-coded floors

What the contract enforces, no admin can change

These guarantees are embedded in the PPF smart contract with no admin function to loosen them. Any parameter can be raised to be more conservative — never lowered.

PPF target ≥ 5% of insured TVL

Fund target is a floor. The protocol can raise it; it cannot be lowered.

immutable floor

Liquid reserve ≥ 30% of PPF

The instant-payout cushion is non-negotiable. Yield strategies can't consume the reserve floor.

immutable floor

Per-account cap can only rise

Once set, a cap can be raised with fund growth. It cannot be clawed back.

ratcheting

Payout ordering: pro-rata, no discretion

Insured accounts are paid proportionally. No operator can prioritize any party.

no admin override

Claim trigger: automatic, no approval

Bridge-balance anomaly detection initiates payout without human input. No governance vote required.

trustless

No single yield venue > 15% of PPF

Hard concentration limit prevents contagion between a bridge exploit and a yield-venue failure.

diversification rule

Compared to traditional insurance

Gilt is designed for crypto's unique risk profile

	SIPC	FDIC	Gilt PPF
Fund size	~$5B	~$128B	$500K → $76M+
Fund / insured assets	0.01%	~1.3%	20–35%
Per-account cap	$500K	$250K	$10K → $250K (scales with fund)
Backstop	US Treasury credit line	US Treasury credit line	Self-funded (200% target)
Covers simultaneous failure?	No (firm-by-firm)	No (bank-by-bank)	Yes — a bridge drain is all-at-once
Payout speed	Months (legal)	Days to weeks	Minutes to 1 week (on-chain, automatic)
Transparency	Annual report	Quarterly report	Real-time, on-chain, verifiable every block

The first on-chain exchangewith real custody insurance