What Varnir is
Varnir is a payment rail built for software to use directly — including AI agents that hold, receive, move and trade value as part of their job.
What makes that safe is a treasury-control model: one agent's intent to pay is verified by another before it executes, instead of a single model moving funds on its own say-so. Everything else in the system exists to serve that verification layer.
Why it matters
For a business, Varnir is a way to hold, receive, pay and trade stablecoins and native coins from software while the keys to your balance stay on your own device. Payments and trades between Varnir accounts settle at once on Varnir's own ledger, with no chain gas. Money only touches a public chain when it leaves. The keys that control deposit addresses are never stored whole, and your own signing key never leaves your device or server. Testnet is built for speed and delivery, so Varnir runs every node and the confidential VMs run without hardware attestation; production is designed to spread the nodes across separate operators, cloud providers and countries, on attested AMD SEV-SNP machines. On top of that sit the controls an automated payer needs: spend limits on a key, a second key that must approve large payments, and a record of who allowed what.
Varnir runs on public test networks (Ethereum Sepolia, Tron Nile, BNB Smart Chain testnet, Base Sepolia, Arbitrum Sepolia and Polygon Amoy) and does not yet handle real funds. Two-key agent payments are live; multi-verifier confirmation is on the roadmap.
What exists today
| Piece | What it does |
|---|---|
| Settlement layer | A custom Activeledger fork running as a four-node testnet, with the wallet/transfer/onboarding logic written as on-ledger contracts |
| Scanner | Public scanner over the ledger and the three L1 testnets it watches |
| Web wallet | Browser wallet — onboard an identity, get a wallet assigned, send and receive native coins and tokens, contacts, usage and billing |
| Browser extension | The same wallet as a Chrome (Manifest V3) extension, with an injected window.varnir provider that Varnir's own sites use to ask it to sign. Built; not yet in the Chrome Web Store |
| Invoicing | Named, referenced, multi-wallet invoices with payment detection (reference) |
| Webhooks | HMAC-signed deposit callbacks, pending then confirmed (reference) |
| SDK | @varnir/chain-client (TypeScript) — everything the web wallet does, from your own code, on one class (TypeScript guide) — plus ports for Python, Kotlin/Java, .NET, Go, PHP, Rust, Dart/Flutter and Swift (overview) |
| Mobile wallet | An Expo / React Native wallet — onboard, send and receive native coins and tokens, trade, invoices, key management, and remote QR signing for the scanner. Built and running; not yet in the app stores |
| Agent payments | A spending key that can only propose, and a treasury key that confirms — enforced by key authority on the ledger (guide) |
| Exchange | Trading of L2 balances that settles only with each trader's signature — atomic co-signed swaps and maker-signed resting orders, paired by an off-ledger matcher and settled by the Varnir.Swap contract. On the scanner's /exchange and the mobile Trade tab (SDK) |
Its own chain — and a layer over others
Varnir runs its own ledger with its own consensus — the four-node network above. That makes it a chain in its own right, not a contract deployed on someone else's chain. By the usual test — your own consensus, your own state — it is a layer-1.
It just doesn't try to be the chain your assets live on. Value stays on its native chain — USDT on Tron, ether on Ethereum. Varnir detects the deposit, mirrors the balance onto its own ledger, settles transfers and trades between identities internally, and withdraws back to the origin chain on the way out. So it is both: a sovereign ledger used as settlement tissue between the chains that already hold the value, with no token or gas economy of its own. Balances stay denominated in whatever you deposited.
No bridge: what that trades off
The usual way to move value between chains is a bridge — you lock an asset on its native chain and a contract mints a wrapped version on another, so a single canonical token stands in for the original wherever you want it. Varnir does not do this. There is an L1 ledger and an L2 balance layer, but no cross-chain bridge: assets stay on their native chains, and Varnir mirrors and settles them internally rather than issuing a wrapped claim on a chain the asset never left.
That is a deliberate trade-off. Both sides:
What the no-bridge model avoids:
- The largest exploit class in crypto. Bridges have been the single biggest source of funds lost to hacks, because a bridge concentrates locked value behind one contract and one trust assumption — compromise it and the wrapped supply is no longer backed. No bridge means none of that surface exists here.
- A custody and trust surface. A bridge is something you must trust to stay solvent and correct for as long as the wrapped asset circulates. Varnir does not add that layer between you and your funds.
- A standing maintenance burden. A bridge is a live, adversarial system to launch, secure and keep running. Not having one removes that cost and that risk.
What it costs:
- No canonical wrapped asset. A bridge gives you one portable token that is the same asset everywhere it goes. Varnir has no such thing — a balance is a mirror of value that still lives on its origin chain, and it settles between Varnir identities, not out onto a third chain as a wrapped token.
- Per-chain work to list an asset. Varnir detects deposits directly on each chain rather than routing everything through one wrapping contract, so every chain it supports needs its own deposit detection and withdrawal path. Coverage is deliberate, incremental work, not something a single bridge grants at once.
In short: no bridge means no bridge-hack surface, and assets stay on the chains that already hold them — at the cost of a canonical cross-chain token, and of supporting each chain one at a time. That does not, on its own, make the system perfectly safe; How keys are held covers the keys that do remain.
The one property to understand first
A private key never reaches a Varnir-operated server. This is how the code is shaped, everywhere:
- Identity keys are generated in your process (browser, phone, or your own server) and stay there.
- Every ledger transaction is signed locally and POSTed directly to a chain node, not relayed through a Varnir API that could have signed it for you.
- The one thing Varnir's own API is asked for during wallet setup is which wallet id to claim — a public, unauthenticated read. It hands out ids; it does not decide who gets one, and it cannot assign one to you. Assignment is a transaction signed by your identity's own key.
- The bookkeeping endpoints are authenticated by signature, not by a bearer token, and only a public key is ever transmitted. You can sign with your identity's own key, or attach a separate scoped key to it and sign with that. See Keys.
Read Getting started for the flow at a glance, the TypeScript guide for every step, or The signing model for the cryptographic detail.
That covers your identity key. The L1 wallet keys that actually receive deposits are different: the network does hold those, and How keys are held explains how they're split so that no single machine stores a whole one, and how production is designed so that no single operator or jurisdiction can sign with one. Distribution and jurisdiction states plainly which parts of that are deployed today and which are not.
Where this is going
Today the stack settles value between identities and trades it between them on an exchange that settles only with each trader's signature. What it does not yet do is the full form of treasury control it is aimed at: an AI proposes a payment, several independent verifying agents check it against policy, and only an approved proposal settles. The two-key version — one proposer, one confirmer — is built and running. The multi-verifier version is a direction, not a feature, and nothing in these docs describes it as available. A near-term target for the whole thing is USDT settlement in the Eurozone. Where this is going keeps the honest list of what is built and what is not.
The settlement contracts take no Varnir fee on a transfer (Pricing). Credits are the pricing unit: the plans are Free (one free on-chain payout a month), Lite (500 credits a month), Hobbyist (2,900), Trader (19,900) and Enterprise, and each charged action costs its listed credits. On the testnet, credits are free from the web wallet, and they are taken on the ledger for plan fees, withdrawals and wallets added after sign-up (Subscription pricing).
Bringing USDT settlement to the EU
The near-term target above is specific: EU businesses settling in USDT, with the keys to their balances on their own devices. That is not incidental to the architecture — it is why keys are split the way they are, and why settlement runs as contracts rather than operator decisions. MiCA and who controls the keys covers what that means under EU crypto-asset regulation, and what is and isn't established about it yet.