Canopy, the AI-native platform for building and deploying onchain applications, has launched Canopy KMS, a key management system that seals its high-value signing keys inside a dedicated enclave.

The company said the move is intended to put a tighter security system in place ahead of its upcoming token generation event (TGE). A TGE marks the point at which a project’s token is minted or distributed and begins circulating, the moment treasury and transfer keys shift from moving test value to controlling live assets.

How Canopy is protecting its keys from hackers

According to the team, Canopy KMS uses an isolation-first design. Under that model, key material remains inside the enclave, and the enclave returns only the signature. That means the surrounding system never holds the raw private key — the same principle behind the secure enclaves and hardware security modules long used in crypto custody and traditional finance.

Canopy CEO Adam Liposky said the system was built from scratch to meet the specific demands of the company’s ecosystem.

Cofounder and CTO Andrew Nguyen also addressed the design, noting that generic signers are built for broad compatibility. He said, “they do not handle the nuance nor volume of Canopy Terminal’s transfers.”

That is why the company chose to build a system designed to handle those tasks in the way it wants.

Canopy KMS arrives amid heightened crypto security concerns

Canopy framed the launch as a proactive step at a time when crypto security has remained under pressure.

Chainalysis counted more than $3.4 billion stolen through direct exploits from January to early December 2025, with wallet compromises rising.

The trend continued into 2026, especially in the second quarter. By the end of the first half (H1) of 2026, more than $1.3 billion had been lost to exploits. Wallet compromises were the leading category, with 33 incidents and more than $444 million lost, according to CertiK.

Key handling is one of the ways wallet compromises can happen, and it remains one of the surfaces attackers target most often. Some of the largest crypto thefts on record have involved compromised signing keys, including the 2022 Ronin Network bridge breach, where attackers gained control of validator keys — a relevant backdrop given that bridge transfers are among the functions Canopy KMS governs.

What building from scratch means for Canopy

In addition to being native to Canopy’s operations, the Canopy KMS system governs signing for treasury disbursements, bridge transfers, and chain-creation functions.

Liposky said their “systems inherit this protection by default, with no extra configuration.”

Canopy was in the news two months ago when it announced that it had raised $8.5 million in seed funding for its AI-native blockchain development.

At the time, the company also highlighted testnet progress, saying it had surpassed 331,000 project launches, with nearly 27,000 of them in the first 12 days. Canopy is currently live on public testnet.

With the TGE ahead, those signing functions — treasury, bridge, and chain creation — are where the enclave-based design will be exercised with live value, making them the operations to watch as Canopy moves beyond testnet.