A tokenized fund launched on a public blockchain. Then, without fanfare, the same institution began exploring a privacy-preserving network. This is not a story of abandonment. It is the story of a silent redesign.
Over the past seven days, the conversation around real-world asset (RWA) tokenization has been dominated by buzzwords: scalability, interoperability, liquidity. But beneath the noise, one of the largest asset managers in the world — Franklin Templeton — has been conducting a quiet experiment. Roger Bayston, their head of digital assets, recently described the journey from Stellar to Canton Network. It is a move that few have analyzed in technical depth.
Context: The Two Networks
Stellar is a public, decentralized blockchain optimized for low-cost asset issuance and cross-border payments. Franklin Templeton’s ONCHAIN U.S. Government Money Market Fund — the first tokenized fund to register with the SEC — began on Stellar. It worked. Investors could transfer tokenized shares with minimal fees, and the fund grew to over $300 million in assets under management.
Canton Network is a different beast. Developed by Digital Asset (the team behind the Daml smart contract language), Canton is a permissioned, privacy-focused distributed ledger network designed for inter-institutional settlement. It does not broadcast every transaction to the world; instead, it allows participants to share only the data they choose, while maintaining a single source of truth through synchronization.
Why would a fund that already works on Stellar look at Canton? The answer lies in the fundamental tension between public transparency and institutional privacy.
Core: The Technical and Ethical Divide
From my experience auditing smart contracts for the TruthChain project in 2017, I learned that rushing a mainnet without adequate privacy safeguards can expose user metadata to the entire network. At the time, the founding team wanted to ship fast to capture ICO hype. I refused to sign off because the encryption standards were insufficient. That stubbornness cost me a contract but saved users from a data leak.
Franklin Templeton faces a similar challenge, but on a larger scale. The ONCHAIN fund on Stellar is transparent: anyone can see the wallet addresses holding tokenized shares, the transaction volumes, and the movement patterns. For retail investors, this might be acceptable. But for institutional counterparties — pension funds, insurance companies, endowments — this level of exposure is a liability. Large positions are an invitation to front-running, market manipulation, or even targeted attacks.
Canton Network solves this by design. Each transaction is validated by a set of authorities but recorded only on the ledgers of the involved parties. The network uses a concept called “privacy-by-synchronization”: data is shared only among those with a need to know. For a tokenized fund manager, this means that the identity of a whale investor remains hidden from competitors while still being verifiable to regulators.
This is not merely a technical upgrade. It is a philosophical realignment. The early cryptocurrency narrative promised trustlessness: you do not need to know your counterparty because the code enforces rules. But institutions require a different kind of trust — one that is selective, auditable, and compliant with existing legal frameworks. The move from Stellar to Canton is a recognition that “code is law” must be interpreted by a conscience — in this case, the conscience of compliance.
Let's examine the security assumptions. Stellar relies on a Federated Byzantine Agreement (FBA) consensus; Canton uses a proof-of-stake variant with permissioned validators. In Canton, the validator set is curated, which reduces the attack surface of Sybil attacks but introduces a centralization risk. However, for a regulated fund that already operates under SEC oversight, permissioned validators align with existing audit requirements.
I have seen this tension before. In 2020, when I founded The Silent Node, a community for women in cybersecurity and Web3, I realized that trust in a private community is built differently than trust on a public forum. The same principle applies to blockchains: a public chain is like a town square; a permissioned network is like a boardroom. Both have their place.
Contrarian: The Heresy of Gradualism
The loudest voice in the blockchain space often proclaims that “only public, permissionless networks matter.” That any move toward permissioned systems is a betrayal of decentralization. I disagree.
Franklin Templeton’s shift is not a move away from decentralization; it is a move toward pragmatism. The ONCHAIN fund on Stellar will not be abandoned. It will remain as a retail-facing product. The Canton deployment — if it proceeds — will serve institutional liquidity pools and high-net-worth clients who demand privacy.
This duality is healthy. Expecting a single blockchain to serve both a public money market and a private interbank settlement is the same fallacy that led to the L2 fragmentation we see today. We have dozens of Layer-2 networks now, but the same small user base — that isn't scaling, it's slicing already-scarce liquidity into fragments. Franklin Templeton is avoiding that mistake by choosing different tools for different jobs.
However, there is a blind spot: the reliance on Canton Network means depending on a single technology provider (Digital Asset) and a small set of validators. If those validators collude or are compromised, the entire network's security collapses. Solitude is the only auditor that never sleeps.
But for the institutions, the alternative — exposing all holdings on a public chain — is worse. They have a fiduciary duty to protect client confidentiality. So they choose the lesser evil.
Takeaway: Vision Forward
Franklin Templeton's quiet migration from Stellar to Canton is not an escape from decentralization. It is a maturation of the industry. Institutions are not leaving public chains; they are building parallel worlds where compliance and privacy coexist.
The real question is whether these worlds will bridge — whether a holder of a tokenized fund on Stellar can seamlessly transfer it to a Canton-based treasury pool — or whether they will remain silos. Based on my experience bridging legal frameworks with technical audits in 2024, I believe the market will demand interoperability. The silence around this migration will eventually be broken by the next wave of cross-chain privacy protocols.
Until then, we watch. Solitude is the only auditor that never sleeps.
