PRIVATUM documentation

Executive summary

Storing crypto today forces an unacceptable compromise. Hot wallets hold your entire private key in one place, so one malware infection drains everything. Hardware wallets cost $150+, run proprietary firmware, and add real friction. Neither gives you privacy: every transaction, balance, and counterparty stays permanently exposed on a public ledger.

PRIVATUM splits the private key mathematically across three independent shards with a 2-of-3 quorum. No single device or server can spend your funds, and transactions are shielded by default. It ships on two surfaces: a cross-platform native desktop app built on Tauri v2 for macOS, Windows and Linux, and @privatum/robinhood-chain-sdk, an audited Viem-based TypeScript SDK that lets any developer embed 2-of-3 threshold self-custody.

Why Robinhood Chain

Robinhood Chain is a permissionless, Ethereum-compatible Layer-2 built on Arbitrum Dedicated Blockchains, with ETH as its native gas token. It targets onchain financial infrastructure and tokenized real-world assets while supporting standard EVM tooling and ERC-4337 account abstraction.

The problem

Every existing wallet fails on at least one of three vectors: security, cost and accessibility, or privacy.

What PRIVATUM does

Architecture

PRIVATUM separates core shard and cryptographic lifecycle management from chain-specific execution. Supporting a future L2 or L1 means authoring one adapter — the desktop UI and co-signing infrastructure never change.

User surfaces
  Desktop App (Tauri v2)   |   Open SDK

PRIVATUM Core
  - Shard lifecycle management (Drive / Co-signer / Passkey)
  - Threshold signature orchestration
  - Co-signer protocol & policy enforcement engine

Execution layer
  Robinhood Chain adapter (ERC-4337)  |  DEX aggregation

The shard model

At wallet initialization three shards are generated independently in a secure key-generation ceremony. The full private key is never assembled or stored anywhere.

• Compromise of 1 shard: zero attacker spend authority.
• Loss of 1 shard: complete recovery from the remaining two.
• Non-custodial invariant: PRIVATUM holds exactly one shard, so it never has custody of your assets.

How a transaction signs

1. Build. The desktop app or SDK composes the unsigned payload and generates the signing bytes.
2. Client signs (Shard A). The client decrypts Shard A locally using user credentials and produces the first partial signature.
3. Co-signer signs (Shard B). The partial signature and intent go over TLS to the co-signer API, which authenticates the session, verifies policy constraints such as daily volume and velocity limits, and produces the second partial signature.
4. Combine. The two partial signatures merge mathematically into a single valid aggregate signature.
5. Settle. The transaction is submitted through ERC-4337 bundlers; the smart contract validates the quorum and executes.

Security model

Guarantees are enforced by cryptography and on-chain contracts, not by promises.

Signing relies on partial threshold signature combination and never assembles the private key into memory on a single machine. Client and co-signer environments stay strictly decoupled.

Privacy framework

Privacy is handled in two sequential planes: making the wallet setup indistinguishable on-chain, then keeping financial activity confidential.

Desktop application

Rather than a browser extension or web app, the primary client is a native desktop application engineered with Tauri v2.

PRIVATUM Desktop Application
  Frontend: React / Tailwind UI
  Core backend: Tauri v2 (Rust core)
    - OS keychain / hardware secure storage integration
    - Local AES-GCM encrypted Shard A management
    - Direct RPC & co-signer TLS communication

• Attack surface reduction: immune to extension hijacking, web injection and tab snooping.
• OS-level key storage: Shard A rests in macOS Keychain, Windows Credential Manager or Linux Secret Service.
• Lightweight footprint: native OS webviews instead of a bundled Chromium runtime.
• Full toolkit: send and receive USDC/USDT, native DEX swaps, shard health monitoring and backup verification, passkey recovery setup and rotation.

The open SDK

@privatum/robinhood-chain-sdk is an open-source TypeScript SDK built on Viem. Developers generate shards, assemble 2-of-3 wallets, and submit threshold transactions programmatically.

npm install @privatum/robinhood-chain-sdk

import { createShards, createWallet, sendTransfer } from "@privatum/robinhood-chain-sdk";

// 1. Generate the three shards (client, co-signer, passkey)
const shards = await createShards({ passkey: true });

// 2. Compose the 2-of-3 wallet on Robinhood Chain
const wallet = await createWallet({
  chainId: 4663,
  shards: [shards.client, shards.cosigner, shards.recovery],
  threshold: 2,
});

// 3. Send USDC privately — signing is orchestrated for you
const receipt = await sendTransfer(wallet, {
  token: "USDC",
  to: "ops.privatum",
  amount: "620.00",
});

The SDK is in progress and ships with audited cryptographic primitives. Package name and repository are provisional.

Network & surfaces

Status & roadmap

Path: Robinhood Chain custody → native privacy → multichain. See the roadmap timeline for phase detail.