Bridging Two Worlds of Digital Money: A Token Interchange Built on Hiero

The Promise and Problem of Tokenized Markets

When an investor buys a bond, the trade itself can happen in seconds. But the actual moment when the money and assets change hands (the settlement) can take two or three days. This delay is a structural feature of how wholesale financial markets work. Trades pass through clearing houses, custodians, and bank ledgers, all of which need to reconcile their records before the deal is final. Across the global financial system, these inefficiencies add up to significant costs and risks.

Tokenization promises to fix this. When assets and money are represented as digital tokens on programmable platforms, settlement can be atomic: both sides of a trade happen simultaneously, or not at all. There is no waiting, no failed settlements, and no capital sitting idle.

The trouble is, two very different forms of digital money are emerging in parallel, and they are not built to work together.

Stablecoins are digital tokens pegged to fiat currency and issued by licensed private entities. Widely known examples, USDT (issued by Tether) and USDC (issued by Circle), are pegged to the US dollar. Stablecoins are designed to be widely accessible and easy to trade, with the openness and liquidity that broad participation brings.

Central bank digital currencies (CBDCs), like digital banknotes, are issued directly by the central bank and carry no credit risk because they are backed by the sovereign.

The same openness that makes stablecoins useful creates problems for a CBDC, where central banks need tight oversight, known participants, and the ability to enforce compliance at every step.

Without a way to bridge these two worlds, the promise of tokenized markets stays theoretical.

For countries, solving this problem can be more than a matter of business efficiency. It can be a question of digital sovereignty. The faster other economies move toward tokenized markets, the more pressing that question can become.

Project Acacia may help provide an answer.

Australian Payments Plus and Project Acacia

In late 2024, the Reserve Bank of Australia (RBA) and the Digital Finance Cooperative Research Centre (DFCRC) launched a collaborative research initiative called Project Acacia. The goal was to explore how different forms of digital money, paired with new infrastructure, could support the development of wholesale tokenized asset markets in Australia.

With backing from the Australian Securities and Investments Commission (ASIC), the Australian Prudential Regulation Authority (APRA), and the Australian Treasury, Project Acacia eventually selected 20 use cases from organizations ranging from local fintechs to three of Australia’s four major banks. ASIC provided targeted regulatory relief to enable participants to test tokenized settlement within the project's controlled scope.

As an operator of national payments infrastructure with deep expertise in how regulated financial systems actually work, Australian Payments Plus (AP+) was a natural participant. AP+ operates the core domestic payments infrastructure that Australians use every day, including a debit card network, a bill payment system, and a real-time payments platform. It partners with more than 150 institutions across the country, including banks, retailers, fintechs, and government agencies.

Within Project Acacia, AP+ designed and built a token interchange intended to serve as national infrastructure, capable of accepting any payment token and facilitating exchanges with tokenized assets.

Designing an architecture that bridges public and private networks

AP+’s token interchange was designed to sit at the center of a tokenized marketplace ecosystem. The concept was straightforward. Assets on one chain could be swapped for payment tokens on another, with the interchange handling the atomic swap. Tokens come in from one chain, the swap happens, and the resulting tokens go out to another chain. Clean, regulated, fast.

The RBA issued a pilot wholesale CBDC for research purposes, on the condition that the CBDC did not sit on a public ledger. The marketplaces and stablecoin rails involved in the project all operated on public networks; that was the point of broad accessibility. But the CBDC had to remain in a controlled, private environment under central bank oversight. For a token interchange whose entire purpose was to bridge public marketplaces, this was an interesting hurdle.

AP+’s solution was a three-part architecture:

A public network where the token interchange operated and where stablecoins and marketplace assets could be accessed and swapped.

A private network where the wholesale CBDC lived, controlled by participating institutions. The central bank could mint CBDC onto this private network, and it would never leave.

A proxy token mechanism that allowed the public interchange to reference CBDC balances on the private network without the CBDC itself ever crossing over. The system could verify that a participant held sufficient CBDC in their private account and execute the swap using a proxy representation on the public side, keeping the actual central bank currency safely contained.

This design solved the interoperability problem without compromising either environment. The public network kept its accessibility and liquidity. The private network kept its regulatory controls. And the proxy token mechanism bridged them without either side needing to access the other directly.

Choosing a paired public-private solution: Hedera and HashSphere built on a shared open source code foundation, Hiero

With the plan in place, AP+’s team needed distributed ledger technology that could support both halves of the architecture. The public network needed performance and accessibility. The private network required the same underlying capabilities, but with permissioned access, regulatory controls, and the ability to operate within institutional environments. Ideally, both networks would speak the same language so that the bridge between them could be built without translating between incompatible systems.

The answer was a paired solution.

1. Hedera, a public distributed ledger network governed by a council of leading global enterprises and institutions
2. HashSphere, a private permissioned network developed by Hashgraph, an LF Decentralized Trust member, for enterprises in regulated industries.

For Project Acacia, AP+ would deploy Hedera Mainnet for the token interchange and HashSphere to host the wholesale CBDC.

What made this pairing work was that both Hedera and HashSphere are built on the same tech stack, Hiero. Hiero is the open source distributed ledger codebase governed by LF Decentralized Trust. In 2024, the full Hedera codebase was contributed to LF Decentralized Trust, where it became Hiero: an openly governed, vendor-neutral technology stack. It was the first time a major public blockchain had placed its full codebase under independent, neutral governance.

For a project where a central bank, commercial banks, stablecoin issuers, and marketplace operators all needed to trust the same infrastructure, this open source foundation mattered in specific, practical ways:

• Neutrality. Because Hiero is governed by LF Decentralized Trust rather than any single company, no participant in the project had to worry that the technology underlying the system could be steered in a competitor's favor. The code is public. The governance is transparent. Contributions are reviewed on their merit, not their origin.
• Auditability. Financial regulators expect to be able to examine the systems that handle settlement. Open source code can be inspected and audited by any institution, a practical requirement for regulated financial infrastructure.
• Native compatibility. Because Hiero is the shared foundation for both the public Hedera network and the private HashSphere deployment, the two halves of AP+'s hybrid architecture were natively compatible. The public network and the private network spoke the same language at the protocol level. The bridge between them did not require translation between fundamentally different systems.

Hiero made the hybrid architecture possible, not just convenient. Without a shared, open source code foundation that both public and private networks could be built from, AP+ would have faced the same interoperability problem the project was designed to solve.

Building the Token Interchange

AP+ worked closely with the Hashgraph team to stand up the HashSphere private network and ensure it connected properly to the public Hedera Mainnet. The private instance had to support the central bank's CBDC minting, manage institutional wallets, and communicate with the public-side interchange layer.

The development was fast-paced and experimental. Some tooling was less polished on the production mainnet than it had been in test environments, and the team worked closely with Hashgraph to resolve those gaps during the build.

Testing with Real Money and Real Counterparties

The architecture was not theoretical. AP+ ran live transactions with institutional counterparties using real money.

In one scenario, a superannuation fund (a retirement fund that manages contributions on behalf of workers) sought to purchase a bond from a bank via a digital marketplace. The buyer used AUDD stablecoins, Australian-dollar stablecoins issued on the Hedera network, as the payment instrument. On the marketplace, the trade was agreed on the same way it would be on any trading platform: search, select, and agree on terms.

Then the marketplace sent a message to AP+’s token interchange — swap these assets on these chains. The interchange executed the atomic swap. Both parties’ wallets were updated. The seller could convert the stablecoins received into fiat currency or hold them as digital assets. The entire process, from trade to settlement, took minutes.

The blockchain transaction itself was instantaneous, but the end-to-end settlement took slightly longer for a reason worth understanding.

Most institutional participants do not manage their own cryptographic keys; they rely on custodial wallet providers who hold the keys and run compliance checks before authorizing transactions. Those checks are essential in a regulated environment, and they add a few minutes of latency to every settlement.

Even with that overhead, the improvement was stark: from two to three days to minutes. And unlike conventional settlement, the atomic swap meant that both sides of the trade settled simultaneously. If anything was wrong — an insufficient balance, a mismatched ID, an account that didn't look right — the whole deal was off.

Across its use cases in Project Acacia, AP+ successfully settled a range of real-money transactions.Across all its use cases in Project Acacia, AP+ settled approximately $5 million in transactions.