Treasury — Controls - ColdHarbor Styleguide

Controls

Master functions governing the entire ledger.

How many hardware signers must approve a movement before it can broadcast. Cold Storage carries its own, deeper quorum.

Default quorumApplies to Operations, Yield, and Reserve. Currently 2 of 3.

1 of 22 of 33 of 5

Cold Storagedeep-cold vault, air-gapped3 of 5

A rolling 24-hour cap across the hot accounts. Anything above the cap escalates to a full-quorum review.

Daily limit3.00000000 BTC · $194,640

Used today1.52000000 / 3.00000000 BTC · 51%

A mandatory delay between signing and broadcast for the coldest funds — a window to catch a coerced or mistaken withdrawal.

Cold-withdrawal time-lock24h on cold withdrawals

With whitelist-only on, funds can leave only to pre-approved destinations. Adding one requires a full quorum.

Whitelist-only withdrawals12 approved destinations

Add a new destination — requires 2 of 3 signatures

Every balance, fee estimate, and broadcast is sourced from treasury-owned infrastructure — never a third-party endpoint.

ConnectionBitcoin mainnet · own node

Connected

Master functions that halt or reset the entire ledger. Each is logged to the audit trail and cannot be undone from this device alone.

Freeze treasuryImmediately suspends every outbound movement across all accounts. Reversible only by 3 of 5 cold signers.

Key managementRotate the signing set, or trigger an emergency lock that forces every device to be re-provisioned before the treasury reopens.