# Protocol accounts

Where the genesis supply sits, and the only transactions that can move each protocol account. This is the treasury policy as the ledger enforces it.

## The rule

Protocol accounts (`compute.mlx`, `rewards.mlx`, `treasury.mlx`, `community.mlx`, `team.mlx`, `bridge.mlx`, `withdrawals.mlx`, `api.mlx`) have no key. Nobody can sign a transfer from them. They move only through the transaction types below, each one public on the [explorer](https://explorer.mlx.app), and a user transfer to any of them except `treasury.mlx` is refused. A new way to spend from a protocol account would need a new transaction type, and it would be listed in the [changelog](/start/changelog) before it ships.

| Account | Purpose | Share | MLX |
| --- | --- | ---: | ---: |
| `rewards.mlx` | Seat reserve | 30% | 3,000,000,000 |
| `compute.mlx` | Compute rewards | 35% | 3,500,000,000 |
| `community.mlx` | Community and referrals | 10% | 1,000,000,000 |
| `treasury.mlx` | Treasury | 15% | 1,500,000,000 |
| `team.mlx` | Contributors | 10% | 1,000,000,000 |

Live balances: [GET /api/token](/network/stats) (`supply.protocol`, locked tranches included), or each account's page on the explorer.

## What can move each account

| Account | MLX leaves only by | Comes in from |
| --- | --- | --- |
| `compute.mlx` | `compute_reward`, once an hour, into locked rewards for Macs ([Rewards](/protocol/rewards)) | nothing |
| `rewards.mlx` | `reallocate`, once on 29 Oct 2026: its whole balance moved to `treasury.mlx` (it paid dedicated seats up front until 20 Oct 2026) | nothing since |
| `treasury.mlx` | spot buys (`swap`): MLX at the curve price plus the premium | the seat reserve (`reallocate`, 29 Oct 2026), spot sells and seats paid from a wallet balance (MLX and USDC), spot buys and withdrawal fees (USDC) |
| `community.mlx` | mining referral bonuses inside `compute_reward` since 29 Oct 2026, within a budget of 300 million MLX ([Mining referrals](/protocol/rewards#mining-referrals)); seat referral bonuses until 20 Oct 2026 | returned seat referral bonuses |
| `team.mlx` | nothing: no transaction spends from it, and its MLX is locked (below) | nothing |

`treasury.mlx`'s USDC pays people who sell MLX (spot sells) and nothing else. `issue` adds USDC to it, and from 25 Oct 2026 every `issue` must name the reserve transfer behind it (`chain:signature`), so ledger USDC can be checked against reserves ([State](/integrity/state)).

`bridge.mlx`, `withdrawals.mlx` and `api.mlx` hold no allocation. `bridge.mlx` counts the USDC issued against reserves (deposits, commissions, liquidity), `withdrawals.mlx` escrows USDC between a withdrawal request and its payout, and `api.mlx` holds wallets' [API credit](/compute/credit-and-billing) and what was charged from it until `compute_bill` pays it to Macs and the treasury. USDC leaves `api.mlx` only by `api_refund` (to the wallet whose credit it is) and `compute_bill`.

## Who holds the keys {#keys}

The rules above are what the ledger enforces. What it can't enforce is who runs it: MLX has one sequencer today, run by its operator, and the operator holds every key and power below. This is the part you have to trust, so here it is in full.

| Key or power | What it can do | What limits it, or shows it |
| --- | --- | --- |
| The sequencer key | Orders and seals every block, and signs the system transactions (`compute_reward`, `commission`, `deposit`, `issue`, `adjust`, `gift`, `withdraw_settle`, `grant_node`, `ref_tier`, `compute_bill`, and the one-off `reallocate`, `vest`, `relock`, `epoch0`, `seat_reward_return`) | It can't sign for a wallet: a transfer, swap or withdrawal needs the wallet's own key. Every block is in a public transparency log whose checkpoints Macs co-sign and which is anchored hourly on Solana and daily on Bitcoin ([Integrity](/integrity/overview)), so history can't be rewritten without it showing. |
| `adjust` | Credits USDC to a wallet against reserves, or debits USDC from a wallet's unlocked balance | Public, with its reason, on the explorer and in the wallet's activity ("Balance adjustment"). Never MLX, never a protocol account, never more than the wallet holds. |
| `gift` | Gives a wallet MLX from community.mlx, USDC from treasury.mlx or a seat, once the wallet claims a gift the operator sent it in a message | Public on the explorer ("Gift from MLX", with the message's title). Moves only when that wallet claims it, once, before any deadline; sending a message moves nothing. |
| `issue` | Adds USDC to `treasury.mlx` as sell liquidity | Since 25 Oct 2026 it must name the reserve transfer behind it (`chain:signature`). |
| `grant_node` | Gives a Builder a Core seat | Public, numbered like any seat. |
| The deposit addresses | Receive the coins people deposit, and seats paid in crypto (which stay off the ledger) | The operator's wallets. [Proof of reserves](https://mlx.app/reserves) lists them once they're public; until then it says "Soon", and [/token](https://mlx.app/token) shows the treasury book: every dollar in and out. |
| The withdrawal treasury on Hyperliquid | Pays USDC withdrawals to Solana automatically | At most 2,000 USDC each and 10,000 USDC a day; anything larger is reviewed and paid by hand. |
| The code | New rules ship as new code | A new way to spend from a protocol account needs a new transaction type, listed in the [changelog](/start/changelog) before it ships. The source of the apps is public; the server's is not yet. |
| Resetting the network | Wiped the ledger and wrote a new genesis (used once, on 18 Oct 2026, the day mainnet started) | Off on mainnet since 30 Oct 2026. |

Not built yet, and what would shrink this list: more than one sequencer, keys split between several people (multisig) for the treasury and the deposit addresses, published reserve addresses, an outside security audit of the server and the apps, and slashing.

## Contributors' vesting

`team.mlx`'s MLX is locked on the ledger by the one `vest` system transaction: 48 equal monthly tranches (the remainder in the last), the first unlocking on 18 Nov 2026 and the last on 18 Oct 2030, a month apart from mainnet. The transaction runs once; a second one is refused. Each tranche is a lock of kind `vest` on the account, visible on [explorer.mlx.app/account/team.mlx](https://explorer.mlx.app/account/team.mlx).

Even once a tranche unlocks, `team.mlx` still has no key and no transaction that spends from it. Paying contributors will need a new, public transaction type, which isn't built.

## Concentration

[GET /api/compute/work](/network/compute) returns `concentration`: the share of all mined MLX that the biggest wallet and the ten biggest received, and the same for dedicated-seat units. explorer.mlx.app/integrity shows both under "The work".