Your bond shouldn't be sold because your ETH crashed.
Galvanic lets you borrow against a tokenized bond and volatile crypto at the same time — and guarantees a crypto crash can never reach the bond. Not by policy. By construction.
Your bond never moved in price. It was sold to cover somebody else's problem — your ETH. That is the default behaviour of every margin account in crypto today.
Put two assets in one account and you quietly agree to something.
Say you hold a tokenized treasury bond and some ETH. Pledging both lets you borrow more than either would alone — that's the whole point of a margin account, and it's genuinely useful.
But the fine print is that collateral is treated as interchangeable. When ETH falls at 3am, the system sells whatever recovers the loan fastest. Often that's the bond — the asset that didn't do anything wrong.
For a fund, that's a bad night. For an institution, it's a dealbreaker. Their bond is a regulated security with an approved holder list and transfer rules — and a smart contract just sold it to a stranger to cover an unrelated position.
Today the only alternative is to keep the bond in a separate account, where it earns you no borrowing power at all. Safe, and useless.
Keep the borrowing power. Drop the risk of losing the bond.
The bond counts, for real
Your tokenized bond stays on Hedera, under its own compliance rules. Galvanic reads what you hold and lets it back your loan — with no bridge, no wrapper, and nothing locked up.
In this account, the bond is doing most of the work: the ETH alone couldn't support the loan.
Your risk rules stay yours
Where you get liquidated, and how much gets sold, are your numbers — and publishing them tells everyone exactly how to push you. So the decision runs inside a sealed environment that nobody, including us, can read into.
It also watches how hard the wider lending market is liquidating right now, and moves your safety margin with it.
The sale can only touch crypto
If you get liquidated, the engine is allowed to sell your crypto and nothing else. If that isn't enough, your borrowing power shrinks and new borrowing stops — but the bond stays where it is.
The part that decides how much to sell has no way to name the bond. It isn't trusted not to — it structurally cannot.
Anyone whose collateral isn't all the same kind of risky.
Funds holding tokenized treasuries
Borrow against the bond without accepting that a crypto drawdown can liquidate it.
Issuers and their holders
Your security keeps its holder register intact. It cannot be transferred to someone outside it by a liquidation.
Lending venues
Accept real-world assets as collateral without redesigning your liquidation engine around every asset class.
We ran the crash both ways and kept the receipts.
Same account. Same 92% crash. Same decision. The only difference is whether the firewall was on. Both settled on a public testnet — you can open them.
$16,201
taken from the bond after the crypto ran out. The holder register changed hands.
View transaction ↗$0
taken from the bond. The crypto was sold, borrowing was frozen, and the bond stayed exactly where it was.
View transaction ↗A live security token on Hedera with an approved-holder list and a 2.5% coupon. We revoked a holder's approval and watched the contract refuse the transfer.
FWM-NOTE on HashScan ↗Prices and liquidation pressure come from Aave, Compound and Spark — live, right now. There is no offline mode; without real data the app refuses to decide.
Your risk rules are loaded inside a hardware-isolated enclave and never come back out. What comes out is one instruction, and it cannot name the bond.
Watch a liquidation stop at the border.
Crash the market yourself, run the decision, and see which assets move.