Credit unions have always run on trust. A member walks in, pledges an asset, and the institution is responsible for what happens next — to the loan, to the collateral, and to the member relationship.
Crypto-collateralized lending introduces a new version of that responsibility: the signing key. Every collateral deposit, every loan authorization, every release of funds back to a member requires a cryptographic signature from someone at the credit union. And unlike a wet signature on a loan document, a compromised digital key can move assets instantly, silently, and irreversibly.
Most digital lending infrastructure treats all signing keys the same. If a loan officer's key is compromised, there's no institutional lever to pull — the only fix is redeploying the entire smart contract infrastructure. That's not a compliance posture any NCUA examiner is going to sign off on.
WHAT WE BUILT
Aetherum's key governance system gives credit unions a two-tier structure that mirrors how they already operate. The Admin Key lives in cold storage at the board level — it's the institution's master authority. Loan officers hold Operational Keys for day-to-day signing. If an Operational Key is compromised, the Admin Key revokes it immediately. No redeployment. No disruption to other active loans. The revocation timestamp is recorded on-chain so any future question about who authorized what, and when, has a tamper-evident answer.
Admin Key rotation itself has a mandatory 48-hour timelock — long enough for the board to detect and respond to an unauthorized attempt, but designed so a compromised current key can't create a deadlock by blocking the rotation.
WHAT THE NCUA EXAMINER SEES
Every attestation, key rotation, revocation, and collateral event is written to an append-only audit trail contract on-chain. The examiner doesn't need to call Aetherum. They don't need API credentials. They query the contract directly using any standard RPC call and get a complete, chronological record: who signed, what risk score was in effect, what compliance checks passed, and exactly when each action occurred. It's the examination packet that writes itself.
"The examination packet that writes itself — every attestation, key rotation, and collateral event recorded on-chain, independently queryable without platform API access."
WHAT THE MEMBER GETS
If a credit union ever becomes unreachable — operationally or otherwise — a member's pledged collateral doesn't get frozen indefinitely. After a configurable inactivity window, the member can initiate a recovery. There's a review period during which only the board-level Admin Key can intervene. A compromised loan officer key has no veto. When the window closes with no action, the member retrieves their collateral directly from the escrow contract. No lawyers. No waiting.
A compromised Operational Key cannot suppress a member's emergency exit. Only the cold-storage Admin Key — held at the board level — has veto authority during the review window. This is not a policy. It is enforced by the contract.
THE BOTTOM LINE
The governance problem in crypto lending isn't exotic. It's the same dual-control, separation-of-duties, audit-trail problem credit unions have solved in every other part of their operations for decades. We just built the version that works on-chain — and makes the NCUA examiner's job easier in the process.