Cross-chain signing without a bridge

One account,
every chain.

A quorum of bonded operators threshold-signs a native transaction for any chain, coordinated and slashed by a Solana program. No bridge, no wrapped asset, no honeypot to drain.

Connect a wallet and post your first signing intent in under two minutes.

Verify it yourself

Signed and broadcast — the group key was never assembled

A Solana account signed a native Bitcoin transaction. It confirmed.

Destination chains, one account

Curves: FROST Ed25519, GG20 secp256k1

Bridge contracts in the path

Times the group secret is reconstructed

The premise

Every bridge is a contract holding custody, and the largest one is always the target. Distin holds nothing. A quorum of operators signs natively for the destination chain, the group secret is never reconstructed, and the only thing you trust is a program you can read and a signature you can verify.

Bridge
vs signature.

The difference is not a feature list. It is whether a contract holds your asset in custody, or whether your account simply signs for itself on the chain that needs it.

Dimension
Bridged DeFi
Distin

What moves

Asset locked, minted, redeemed across chains

Nothing moves; a native signature is produced

What the destination sees

A wrapped IOU and a bridge contract

An ordinary signature on its own curve

Trust surface

Bridge validators holding custody

Bonded operators, slashed on-chain

Failure mode

A drained bridge, stranded wrapped assets

A request that simply expires

Five chains.
One key.

Each destination receives a signature on its own curve, from the same Solana account. Two schemes, branched per VM family. Nothing is wrapped.

Ethereum

GG20 · secp256k1

Threshold ECDSA, ecrecover to the group address

Bitcoin

GG20 · secp256k1

Native signature, verified against spec vectors

Tron

GG20 · secp256k1

Same curve, same group key, no wrapping

Cosmos

FROST · Ed25519

Schnorr threshold, accepted by ed25519-dalek

Aptos

FROST · Ed25519

One Solana account, a native Move signature

Four moves.
One signature.

The signing rounds run off-chain. Solana holds the request, the deadline, and the staked-weight threshold, then records the finished aggregate. The chain coordinates the ceremony; it never recomputes the cryptography.

off-chain cryptoon-chain coordination

01on-chain

Post the intent

A user writes one 32-byte signing intent to the Solana program: the destination VM, the message hash, a stake-weight threshold, and a slot deadline. The request account is the whole ask.

create_signing_request

02off-chain

Operators sign, apart

Bonded operators run the real multi-round ceremony off-chain. FROST over Ed25519, GG20 over secp256k1. Each holds one Shamir share; the group key is never assembled in any single place.

kobe · FROST / GG20 rounds

03on-chain

Stake answers for them

Each operator posts a participation receipt carrying its staked weight. The chain does no curve math; it counts distinct operators and staked weight against the threshold, inside the deadline.

submit_partial_signature

04on-chain

Record, then broadcast

The coordinator combines the partials off-chain and posts the finished signature back. The program records it once the threshold is met and emits it; a relayer verifies and broadcasts on the destination chain.

aggregate_and_emit

Shares in, one
chain-valid signature out.

A native signature, not a wrapped IOU

A quorum of operators runs a real threshold ceremony and produces an ordinary signature on the destination chain’s own curve. Ethereum, Bitcoin, Tron and Cosmos see a signature indistinguishable from a single key. No bridge contract, no wrapped asset, no honeypot to drain.

The secret is never reconstructed

Each operator holds one Shamir share. FROST for Ed25519, GG20 for secp256k1: the protocol combines partials into one signature without the group key ever existing in one place.

Solana coordinates, accounts, slashes

One Anchor program owns the control plane: it opens a 32-byte intent, gates finalization on staked weight and a slot deadline, and slashes a misbehaving bond. It records the real off-chain aggregate; it never pretends to do the curve math.

opens32-byte signing intent + slot deadline

gatesdistinct operators × staked weight ≥ threshold

recordsthe off-chain aggregate, bound to the request

slashesa misbehaving bond into the slash pool

Coordination lives where it is cheap

Multi-round MPC needs several round-trips. On a 12 to 15 second chain each round costs over a minute. On Solana’s 400ms slots the same ceremony finishes in seconds, so the control plane sits on Solana and the signature lands wherever it is needed.

Solana

400ms slots

3 rounds · ≈ 1.2s · interactive

L1 at 12s

12s blocks

30× slower

3 rounds · ≈ 36s · unusable

L1 at 15s

15s blocks

38× slower

3 rounds · ≈ 45s · unusable

0-of-n

threshold quorum signs, secret never assembled

milestones built, M1 to M9, crypto layer independently verified

wrapped assets, bridge contracts, honeypots

Questions.

A control plane for cross-chain signing on Solana. Instead of bridging an asset, a quorum of bonded operators threshold-signs a native transaction for the destination chain. One Solana account, a real signature on every chain, no bridge in the path.

Live

Sign on
any chain.

Connect a wallet and post a signing intent. A bonded operator set threshold-signs a native transaction on the chain you choose. No bridge, no wrapped asset, no custodian holding your funds.

One account,every chain.

Bridgevs signature.

Five chains.One key.

Four moves.One signature.