L O R I C A
BIOMETRIC STEP-UP · AT THE MOMENT MONEY MOVES

The verification layer for the moment money moves.

Lorica is a step-up verification API for crypto exchanges and fintechs at the moment money moves. One call, before the wire clears, returns a cryptographically signed proof a specific human authorized a specific action at a specific timestamp. 292ms median.

Express interest → Read the spec →
292 ms MEDIAN · HMAC-SHA256 signed · One POST
LIVE · VERIFICATIONS
14:39:51 · usr_pX7nL3kT9bV · withdrawal · 0.9847 ✓
14:39:50 · usr_4Z9X2fK8mPq · wire · 0.9912 ✓
14:39:48 · usr_qR2mK5jH8wY · trade · 0.9756 ✓
14:39:46 · usr_sN4vT8gQ2dC · withdrawal · 0.9891 ✓
14:39:44 · usr_wH1zB6yM3xK · reset · 0.9812 ✓
14:39:42 · usr_kF8jD2cR5vN · withdrawal · 0.9879 ✓
14:39:40 · usr_aL5gM9pH3vC · beneficiary_change · 0.9923 ✓
14:39:38 · usr_bN2vT6xR4kJ · wire · 0.9784 ✓
§01 · OUTCOMES

Verify at the moment money moves.

Centralized exchanges run KYC at signup and call the user verified for the lifetime of the account. The withdrawal moment is the most expensive moment in fintech, and almost no architecture asks anything at that moment. Lorica is the verification layer that does.

§01
RE-VERIFY WHEN MONEY MOVES

One call before any withdrawal, wire, or large trade. Camera opens, face matches enrolled biometric, signed JWT returned in 292ms. Same API surface for every high-risk action.

§02
CLOSE THE LIVENESS GAP

A multi-signal anti-spoof layer scores every frame. Liveness adapts per action — light-touch checks for low-risk flows, active gestures for high-value ones. Bypassing requires fooling every signal at once, which doesn't scale to commercial fraud.

§03
INSURANCE-GRADE ATTESTATION

Every decision is signed with HMAC-SHA256, claim-locked to the request, valid 60 seconds. Underwriters audit the JWT — they verify what was checked and when, without ever seeing the user.

§04
SINGLE-CALL VERIFY

Three endpoints — /enroll, /verify, /delete. SDKs for Python, Node, browser. Drop the verify call into your withdrawal handler. Sandbox access on signup.

§02 · HOW IT WORKS

One POST. One signed proof.

Your backend hits a single endpoint at the moment of action. Lorica validates the live human, signs the verdict, and returns a JWT in 292ms median. Your backend verifies the signature locally, then authorizes — or doesn't.

  • Synchronous. One HTTP call. No webhooks, no eventual consistency. The verdict comes back in the response body.
  • Auditable. Every verification produces a JWT with the user, action, and verdict, signed with your tenant's signing secret. Store it alongside the transaction.
  • Locally verifiable. Your backend validates the signature against the shared secret. Lorica retains nothing — the JWT is yours.
§03 · MARKET

Five incidents. Same architecture flaw.

Bybit lost $1.5B in February 2025. Coinbase disclosed $400M in user losses in December 2025. Kraken users lost $18.2M to social engineering on March 31, 2026. Grinex was breached for $13M on April 16, 2026. Same authentication-held-at-signup, no-re-verify-when-money-moves architecture. Five incidents. The pattern isn't a Bybit problem or a Grinex problem. It's a sector problem.

Date Entity Vector Loss
2025-02 Bybit Cold-wallet exploit $1,500,000,000
2025-12 Coinbase Insider data sale $400,000,000
2026-03-31 Kraken (user) Social engineering $18,200,000
2026-04-13 Kraken (insider) Extortion attempt $0 (no funds moved)
2026-04-16 Grinex Authorization bypass ~$13,000,000
Total 5 incidents Same architecture flaw ~$1.93B

SOURCES — Chainalysis 2025 Crypto Crime Report (Feb 2026). Bybit incident disclosure (Feb 2025). Coinbase 8-K filing (Jan 2025). Kraken security blog: Mar 31 2026 ($18.2M social engineering) and Apr 13 2026 (insider extortion, no funds moved) — these are separate events. Grinex public post-mortem (Apr 16, 2026).

§04 · BUILT FOR THE MOMENT

Three endpoints. One signed proof.

PERFORMANCE
  • 292ms median verify latency
  • HMAC-SHA256 signature
  • 60-second token validity
  • One POST per verification
COMPLIANCE
  • GDPR Article 9 — explicit consent flow, right-to-erasure
  • CCPA — California user data deletion API
  • SOC 2 Type II — audit in progress
  • MiCA + NYDFS — aligned with recommended liveness coverage