Cross-chain bridges remain crypto’s most dangerous choke point. Hundreds of millions of dollars vanish each year because protocols release funds to unauthorized addresses. Current bridges verify transaction hashes and smart-contract events. They rarely verify user ownership. If malware poisons a payout address, the bridge releases funds anyway.
American Fortress is attempting to eliminate this blind spot.
Researchers Vincenzo Botta, Michal Pospieszalski, Emanuele Ragnoli, and Justus Ranvier have published new research introducing linkable provenance proofs. The system builds on Zero-Knowledge Proofs of Seed Provenance, known as ZK-POSP. It allows cross-chain protocols to cryptographically verify that a receiving wallet originates from the exact same secret seed as the sending wallet. Most importantly, it confirms common ownership without exposing private keys or publicly linking the addresses.
The cryptographic mechanism functions across entirely different mathematical curves. A user can transfer Bitcoin based on secp256k1 over to Solana running Ed25519. The protocol checks that both addresses stem from a single hidden secret. If a malicious actor attempts an address-substitution attack during transit, the payout halts automatically. The rogue destination wallet cannot generate the required derivation proof. No proof, no payout.
Proving speed has historically crippled practical zero-knowledge applications. Earlier implementations of ZK-POSP required over 30 minutes of computing time to generate a single proof. American Fortress reports a major performance leap utilizing the Plonky3 proving system.
Full-path derivation proofs now generate in approximately 6.65 seconds. Onchain verification takes roughly 475 milliseconds per value. For a two-chain bridge transfer, verifying both branch derivations requires under one second. This level of throughput makes real-time verification feasible for live decentralized finance protocols.
The timing is critical. Cross-chain exploits drained hundreds of millions of dollars from decentralized protocols throughout 2026. High-profile incidents at Kelp DAO, Verus, Syscoin, and AFX Trade highlighted how vulnerable bridge relays can be when validating cross-chain messages. In each case, protocols disbursed assets without confirming that the recipient was the rightful depositor. Enforcing a mathematical “same-owner” rule eliminates this entire attack surface.
Beyond cross-chain bridging, the research introduces a privacy-preserving compliance model. Under European Union frameworks like MiCA and the Transfer of Funds Regulation, digital asset providers face strict Travel Rule mandates. Traditional privacy tools obscure all transactional data, putting them at odds with regulators.
American Fortress resolves this tension through structured cryptographic receipts. In a peer-to-peer transaction, the sender attaches a zero-knowledge proof establishing that they are a registered entity. The sender’s name is encrypted so that only the recipient can decrypt it. Outside observers on the public ledger see only a single-use stealth address.
This architecture also changes how audits function. When a business needs to prove its transaction history to a tax authority, current tools require surrendering master viewing keys. Those keys expose the company’s entire past and future financial history.
Under the American Fortress approach, a recipient can produce a zero-knowledge proof covering an exact subset of transactions. The auditor verifies that every selected payment originated from an identified sender and belonged to the recipient. The rest of the corporate treasury remains completely private, and wallet keys never leave the premises.
Post-quantum security protects the entire framework. Hash-based binding values shield the underlying wallet seeds from potential extraction by future quantum hardware. American Fortress plans to implement these provenance relations into its upcoming SafeSend product, offering decentralized finance a practical path toward verifiable ownership without sacrificing financial confidentiality.
