A national currency cannot depend on the network being up. Sovex settles value directly between devices when connectivity is gone, then proves every transfer against the ledger the moment it returns.
When the ledger is unreachable, value is carried by the transfer itself rather than looked up from a server.
Each offline unit carries its provenance, denomination, and issuing signatures, so a receiving device can validate it locally without contacting the ledger.
Keys never leave the secure element; the holder authorizes each transfer on-device, preserving the non-custodial guarantee even with no connection.
Every offline transfer is signed with ML-DSA-65 (FIPS 204), so an intercepted or replayed message cannot be forged today or against future quantum capability.
The hardest offline problem is stopping the same value from being spent twice while no authority is reachable to say no.
The secure element enforces a strictly increasing transfer sequence; a reused or out-of-order counter is detectable and rejected at reconciliation.
Devices present hardware attestation before transacting, binding value to tamper-resistant elements and excluding cloned or emulated wallets.
Per-device value ceilings and velocity limits cap the total offline liability a single holder can accumulate before it must reconcile.
Two devices establish trust and exchange value entirely between themselves, with no intermediary in the path.
Transfers complete over NFC, Bluetooth, or scannable codes without either party reaching a network service.
Payer and payee verify each other's certificates and revocation status from locally cached trust material before value changes hands.
Both sides retain a signed record of the transfer, giving each party independent evidence for later submission and dispute resolution.
Reconnection is not a sync of balances but a cryptographic proof that folds offline activity into the authoritative record.
The device submits its ordered chain of offline transfers; the ledger revalidates signatures and counters and folds accepted transfers into the hash-chain.
If two devices claim the same value, the ledger identifies the collision through counters and quarantines the conflicting branch for adjudication.
Reconciled offline transfers occupy the same append-only, hash-linked ledger as online settlement — never a separate, weaker record.
Offline capability is governed by issuer policy, not fixed by the protocol, so systemic bearer risk stays bounded.
Offline value limits, transfer counts, and time-to-reconcile windows are policy parameters the issuer sets and can change.
Offline balances can be made to expire or require reconnection after a defined interval, bounding how long value circulates unreconciled.
Compromised device certificates enter revocation lists that spread through subsequent device contacts, containing fraud without a live connection.