Company: HBAR
Filing Date: 2025-09-09
Form Type: S-1
Source: 0000950170-25-113803
Chunk: 208

Company: Grayscale Hedera Trust ETF
Filing Date: 2025-09-09
Form: S-1
Chunk 208
---
 when the Trust’s HBAR is staked, including but not limited to, multiple encrypted private key “shards,” usernames, passwords and 2-step verification. Multiple private key shards held by the Custodian must be combined to reconstitute the private key to sign any transaction and transfer the Trust’s assets. Private key shards are distributed geographically in secure vaults around the world, including in the United States. The Custodian’s system architecture requires the involvement of the Sponsor to reconstruct the private keys and access the Trust’s assets, and it isnot possible for the Custodian’s employees to access the Trust’s assets without the Sponsor’s involvement and approval. This architecture is part of the Custodian’s service organizational controls (“SOC”) Type I and Type II reports, which are authored by leading assurance providers to confirm to the Custodian’s clients that the Custodian is compliant with a variety of security and reporting standards, and which are delivered to the Sponsor for review on an annual basis.

General Controls on the Custodian’s Custody Environment : Data related to transaction activity executed on the Custodian’s platform is backed-up and saved to both an alternative location (besides the primary location) and to a “Disaster Recovery” Amazon Web Services (“AWS”) Account to enable recoverability in an event one of the regions becomes unavailable. Authentication requirements for the Custodian’s platform are restricted through two-factor authentication and encrypted network protocols, among others.

User Entity Controls: In addition to security controls in place at the Custodian, the Sponsor expects to implement additional controls and procedures, including, but not limited to, (i) reviewing the

<div align='center'>121</div>

Custodian’s SOC report to ensure private key management and other general controls are consistently applied and operating without exceptions, (ii) periodically reviewing Sponsor team members’ access to the custodial wallet environment to ensure appropriateness, and (iii) reviewing the Custodian’s third party management control.

The Sponsor also reviews the SOC report for one of the key sub-service providers, AWS, including specifically sections related to availability, security and confidentiality. Under its third party risk management framework, the Sponsor also performs other ongoing monitoring of the Custodian, including the completion of an assessment of the Custodian’s cybersecurity controls. In addition, the Sponsor expects to screen all eligible Staking Providers in a manner consistent with its practices in screening eligible custodians, including, but not limited to, by (i) conducting initial and, thereafter, annual reviews of the Staking Provider