How it works

An exchange with no deposits.

Every centralized exchange asks you to hand over your coins first. Seeds never does. You keep the seed phrase; we hold a narrow, expiring authorization on one dedicated trading branch — and when the clock runs out, we destroy the key and publish proof.

The deposit is the bug, not the feature

On a traditional exchange, step one is a deposit. From that moment you hold an IOU in a database, not crypto. The exchange has the keys, the coins, and the discretion. Every catastrophic exchange failure in history — the hacks, the freezes, the bankruptcies — happened inside that deposit. Seeds removes it entirely.

The model, step by step

Plant your seed

Sign up and Seeds generates a BIP-39 recovery phrase in your browser. It is encrypted there with your password (PBKDF2 → AES-256-GCM) and only the ciphertext is stored. We never see the phrase, the password, or a private key — not once.

Two branches: savings and trading

From your phrase, keys derive down standard BIP-44 paths. Your savings branch is yours alone — we have no derivation for it, ever. A separate shared trading branch (m/44'/696969'/1106'/0/0 on TEXITcoin) exists purely for exchange settlement.

You grant a capped, expiring authorization

To trade, you move only what you want onto the trading branch and grant Seeds a per-asset authorization: this asset, up to this amount, until this time. It is enforced in the database before any key is touched — over the cap or past the expiry, the request dies.

Trade on a real order book

Orders match by price-time priority across TXC, TSD, USDC, USDT, LTC, ISK, and ZCU. When a match fills, each leg settles on-chain from the maker's trading branch to the taker's address — a real, signed, broadcast transaction with a real txid.

Expiry hits → the key is destroyed

When your authorization expires — or when you revoke it — the delegated key material is hard-deleted from our systems. Not revoked-by-flag. Gone. We can't sign another satoshi even if we wanted to.

We prove what we hold, publicly

The Custody Ledger publishes a live attestation: how many keys we hold, how many are expired-and-purged, and aggregate counts only. No addresses, no balances, no user data. Anyone can watch us hold almost nothing.

One seed, two branches

Your recovery phrase derives an entire tree of keys. Seeds only ever touches one isolated branch — the trading branch — and only within your authorization. The savings branch is cryptographically out of reach.

your seed phrase (never leaves your browser unencrypted)
├── m/44'/696969'/0'/0/…   SAVINGS BRANCH
│    └─ yours alone. Seeds has no keys here. ever.
└── m/44'/696969'/1106'/0/0 SHARED TRADING BRANCH
     ├─ per-asset authorization: asset + cap + expiry
     ├─ enforced in the database before any signing
     └─ key hard-deleted at expiry / revocation

Seeds vs. the old way

A normal CEX

Seeds

You deposit funds into the exchange's omnibus wallet.

No deposits. Funds stay at addresses derived from your seed.

They hold 100% of your balance, for as long as you use them.

We hold a capped key, only for assets you authorize, only until the time you set.

Withdrawals are a permission slip you request from them.

Revoke the authorization and sweep your branch back to savings — no approval needed.

A breach or insolvency can mean total loss (see: Mt. Gox, FTX, Celsius…).

A breach gets attackers ciphertext and expired keys. Your savings branch is unreachable.

You must trust their solvency attestations.

You can verify our custody on-chain — the attestation counts are public and auditable.

What this does — and doesn't — mean

Your seed phrase is your root of trust. Lose it and lose your password, and no one — including us — can recover your funds. Write it down. Keep it offline.
Authorizations are real control. While an authorization is active, Seeds can settle trades within its cap — that's the point. The cap and the clock bound exactly what that can mean, and expiry is destructive, not decorative.
Settlement is on-chain. Every fill produces real transactions you can verify on the relevant explorer. Nothing is an internal ledger entry pretending to be crypto.

Open your vault Watch the custody ledger