Automatic freezes on high-confidence signals, managed as code

"Every layer of our security model assumes another layer might fail. The automatic freeze is the one that acts without waiting for a person, and we built it with Hypernative."

Fedor Chmilev, Co-founder and CTO @ Resolv Labs

Vault Street runs Hypernative's Onchain Monitoring & Response for 24/7 security and economic risk monitoring across its own contracts and every venue its capital touches. The same platform powers the emergency controls that freeze both vaults automatically, on every chain where they’re deployed, with a restart that requires multi-party sign-off.

Vault Street’s engineers write their monitoring as code and release it through continuous integration (CI), the automated pipeline software teams use to test and ship changes. Every new alert or response rule is reviewed and tested before it goes live, and every change leaves a record of who made it and why. When the team adds a venue or adjusts a strategy, the monitoring for it ships in the same release ensuring that security keeps pace with the product.

About Vault Street

Vault Street is onchain distribution infrastructure for institutional yield. It packages real-world asset strategies into permissioned, investable products that allocators and integration partners can access directly.

Governed by the Resolv Foundation, Vault Street launched publicly in June 2026 as Resolv Labs' new business line. Its first two products serve different allocation goals.

primeUSD is a leveraged investment-grade fund. It holds tokenized short-duration US Treasuries and a AAA-rated CLO fund, deployed with controlled leverage on Aave Horizon.

CARRY launched on Oct 8, 2026. It combines tokenized private credit with hedged, market-neutral positions, using up to 4x leverage at a floating NAV.

Both vaults settle in USDC, and only KYC/KYB-approved addresses can hold or transfer them. Vault Street operates on Ethereum, Base and Solana, allocating into venues that include Aave, Morpho, Centrifuge, Superstate, Midas, Kamino and Figure/Hastra.

The challenge: rebuilding after a single-key failure

Resolv Labs has been working with Hypernative since December 2024. Its early agents tracked USR and RLP mint and burn requests alongside stale data on key contracts, with alerts that non-technical stakeholders could read in Slack and email.

In March 2026, a multi-stage attack from outside Resolv's perimeter gained signing authority over an offchain service. Client collateral was not affected, and USR holders were made whole per project policy.

The team came out of the recovery with a clear design brief for Vault Street. No single key or person should be able to move or reprice client funds alone. Security would sit inside the product they offer allocators.

That brief set new requirements for our work together:

• Automated response that freezes the vaults on high confidence security signals, with as few false positives as possible
• Monitoring held to the same engineering standard as code, with testing, mocked data and deploys from CI
• Visibility into every protocol and issuer the vaults allocate into, alongside Vault Street's own contracts
• Proof that the monitoring pipeline itself is alive

"Once the recovery was done, we wanted to use Hypernative far more actively. Our goal was to test and ship monitoring the same way we ship code."

Fedor Chmilev, Co-founder and CTO @ Resolv Labs

The solution: layered monitoring with an automatic freeze

The rebuild started with Vault Street. In late May 2026 the team briefed Hypernative on its next phase. It asked for monitoring of any onchain or offchain condition, historical persistence, phone and SMS escalation for critical alerts, and monitoring as code with proper testing.

Hypernative’s CTO and solutions engineers ran joint working sessions in early June, working on the principle that detection only protects funds if it leads to action, and the fastest action is one a system can take on its own. This automation is only safe when its signals are precise enough to trust without a person in the loop. Everything Vault Street built afterward weighs the same trade-off: a pause that fires fast enough to protect funds, on signals reliable enough that it never fires without cause.

Monitoring as code

Before any change to Vault Street’s smart contracts goes live, the team tests it against local copies of live chains. They wanted the same discipline for their monitoring, so that every agent is proven to work before anyone relies on it. They asked Hypernative for test-firing and mocked data, tools that let engineers simulate an event and confirm the right agent fires before deployment. The team also wanted people outside engineering to be able to set up and support monitors. To get there, Vault Street built its own system using AI agent skills on top of Hypernative’s SDK. It enables the team to develop, test, and release monitors quickly while consistently following its internal processes.

Vault Street now runs 260 custom agents, and agents ship through the same CI pipeline as the rest of the Vault Street stack. 

Monitoring the monitoring

What does a silent alert channel mean? Nothing may have happened onchain, or a data feed may have failed or an agent may have stopped running. To tell the difference, Vault Street sought to build an agent that takes the pulse of everything they’ve set up. Firing on a regular schedule regardless of onchain activity, each signal confirms that data is reaching Hypernative and alerts are reaching the team and when it stops, the team knows to check the monitoring pipeline.

"A quiet alert channel should mean nothing is wrong. The heartbeat tells us the pipeline is still listening."

Fedor P, Founding Engineer @ Resolv Labs

A watchlist for every venue

Vault Street keeps track of dozens of watchlists covering hundreds of assets, contracts, and wallets across nine chains including Ethereum, Arbitrum, Base, BSC, Solana, and HyperEVM. 

Counterparty risk is where vault strategies are most exposed. A vault can be secure on its own terms and still lose funds when a lending market or issuer it depends on is exploited. To counter this, each lending venue and RWA issuer it allocates into has a dedicated watchlist to ensure the team keeps track of every protocol its capital touches and has the capability to react accordingly. The coverage is extensible and new watchlists are added as new allocations open.

An emergency pause that acts on its own

"We only wanted automation on signals we trust. A false pause is expensive, so we started with the detections that had already proven themselves."

Fedor Chmilev, Co-founder and CTO @ Resolv Labs

An automated pause has a cost when it fires incorrectly, as any false triggers freeze deposits and withdrawals for every allocator in the vault and erode trust in the alerts themselves. Before giving any signal that authority, the team worked with Hypernative to review the conditions of a pause, and weighing the threat severity against the firing rate to determine the right thresholds.

Hypernative’s hacks and exploit engines fit the framework, maintaining a 0.001% false positive rate and proven efficacy in preventing fund loss. These engines were then augmented with a specific custom agent for large mints targeting unauthorized issuance, a failure mode Vault Street had already designed its contracts to cap. Economic risk signals follow a different path. Borrow rates, supply rates, carry trade profitability and price deviations all feed alerts to the team, routed to PagerDuty or Slack depending on criticality and a person decides what happens next.

Vault Street now maintains a dedicated pause watchlist on those signals and has wired three actions to its emergency pause trigger. Restarting after a freeze requires multi-party sign-off.

Where Hypernative sits in the security model

Vault Street's security model stacks independent controls. Custody runs through Utila MPC with keys split so neither party signs alone. Contracts enforce limits on issuance and price movement with no operator override, and high-impact changes sit behind a 48-hour timelock with outside co-signers.

Hypernative provides the continuous monitoring layer and the automated emergency controls. The freeze is the only layer that acts without a human. It stays immediate, while other high-impact changes wait on the timelock.

Results: a security model institutions can underwrite

"We want our allocators and our community to know who is watching their capital around the clock. Hypernative is a core part of how we keep Vault Street safe."

Fedor Chmilev, Co-founder and CTO @ Resolv Labs

Vault Street treats security as a design decision made before launch. Every control starts from one principle: no single key or person can move or reprice client funds alone.

That principle runs through the whole stack. Custody keys are split between Vault Street and Utila, so neither can sign alone. Contracts cap issuance and price movement, and operators cannot override those limits. High-impact changes wait 48 hours and need outside co-signers. Hypernative monitors the vaults and every venue they allocate into around the clock, and the automatic freeze is the one control that acts without waiting for a person.

Day to day, the team now has coverage across both technical and economic risk, which the team says makes Vault Street feel safer to run. Every alert comes with a clear structure and process for how to act on it, whether it triggers the freeze or reaches a person through notification channels.

“When we walk allocators through the stacked layers of our security architecture, they’re impressed. It’s definitely helping us win deals.”

Ivan Kozlov, Co-founder and CEO, Resolv Labs

For institutional allocators, the result is a clear answer to the two questions they ask before allocating: how their capital is protected, and what happens if something goes wrong.

The approach matters beyond Vault Street. Institutional capital moving onchain expects the independent oversight it relies on in traditional finance, along with a clear plan for when things break. Vault Street shows how those expectations work onchain and its venue coverage offers a model for other allocators: map a strategy’s exposure across every protocol it touches, then watch all of it.

Hypernative’s view is that real-time detection delivers its full value when it is paired with a response that acts in seconds. As more value moves onchain, the window between first signal and lost funds keeps shrinking. Automated response closes that window, provided it runs on precise signals and restarting requires human sign-off. Vault Street is now one of the clearest examples of that model in production.

Learn more about Vault Street's security here.