L O R I C A
SECURITY

What Lorica blocks. The step-up gap.

Every exchange verifies identity at signup. None re-verify when money moves. That gap — between authentication and high-value action — is where most 2025 crypto theft happened. Lorica closes it.

§01 · THE BOUNDARY

Between credential and action.

The boundary Lorica draws sits between session and authorization. Between "logged in 90 days ago" and "authorized this withdrawal, right now." Between a credential that proved who you were once and a fresh proof that the same human is at the keyboard — or in front of the camera — at the moment value moves.

Below: the five 2025-2026 events Lorica's verification layer addresses, and the data-handling guarantees that come with it. We don't publish our internal threat-decomposition or the specifics of how each layer scores. That belongs in the security review, not on the marketing page.

§02 · INCIDENT COVERAGE

Five incidents. What changed for each.

Date Entity Vector Loss
2025-02 Bybit Cold-wallet exploit $1,500,000,000
2025-12 Coinbase Insider data sale $400,000,000
2026-03-31 Kraken (user) Social engineering $18,200,000
2026-04-13 Kraken (insider) Extortion attempt $0 (no funds moved)
2026-04-16 Grinex Authorization bypass ~$13,000,000
Total 5 incidents Same architecture flaw ~$1.93B

SOURCES — Chainalysis 2025 Crypto Crime Report (Feb 2026). Bybit incident disclosure (Feb 2025). Coinbase 8-K filing (Jan 2025). Kraken security blog: Mar 31 2026 ($18.2M social engineering) and Apr 13 2026 (insider extortion, no funds moved) — these are separate events. Grinex public post-mortem (Apr 16, 2026).

§03 · DATA HANDLING

What we keep. What we don't.

Camera frames are dropped immediately after the embedding is computed. Lorica never persists raw imagery — there is no historical photo store to compromise.

The 512-dimensional embedding is encrypted with Fernet AES-128-CBC at rest, keyed per tenant. Embeddings are not reversible to imagery. A single DELETE /v1/delete call zeroizes the embedding and revokes any active JWTs for that user. GDPR Article 17 and CCPA compliant.

The signed JWT is the only artifact your backend stores. Lorica does not retain server-side JWTs — the token is client-held by your backend, signed with your tenant's signing secret. We can't produce a JWT for a verification we didn't run.

§04 · WHAT WE DON'T DO

Defining the product by its boundary.

  • We don't replace KYC. Lorica runs at the action moment, not at signup. KYC verifies identity once; Lorica re-verifies the human at every high-value action.
  • We don't store photos. Frames are processed in memory and discarded. There is no image archive.
  • We don't write to your database. The signed JWT is returned synchronously; you persist what you need from it. We hold no transaction record on your behalf.
  • We don't ship as-a-service AI agents. No webhooks, no background processing, no eventual consistency. Every verification is a single synchronous POST.
  • We don't decide which actions need verification. Your risk policy decides what triggers /v1/verify. Lorica runs the verification when you call it.