Wallet security is a governance problem
A crypto wallet is an arrangement of software, hardware and procedures that enables users to manage digital assets. The private key or signing authority is critical because it can authorise transactions. However, “protect the key” is not a complete operating control. Custody teams also need to decide who can request, approve and execute actions; how access changes when a person leaves; and how the firm recovers safely when technology fails.
Wallet architecture should be selected based on the service, asset, transaction needs, threat model and recovery requirements. Hot wallets can improve availability for routine payments, while offline storage can reduce exposure to some online threats. Each approach introduces different operational risks. The firm should document why its design is suitable and what limits apply.
Map the key lifecycle
Key governance begins before a wallet is used. Document how key material or signing shares are generated, who supervises the process, how devices are secured, where backups are kept and how access is granted. Identify every person, role, service account and vendor that can initiate, approve or complete a transaction.
The lifecycle should cover:
- Creation: Use an approved process and controlled environment; retain evidence of configuration and participants.
- Storage: Protect devices, seed material and backups against unauthorised access, loss and environmental damage.
- Access: Grant only role-appropriate permissions, with strong authentication and periodic recertification.
- Use: Require transaction details to be checked and approved according to risk and value thresholds.
- Change: Control wallet migrations, key rotation, vendor changes and address-policy updates.
- Recovery: Maintain tested procedures for lost devices, unavailable approvers, compromise and business continuity.
- Retirement: Revoke access and securely dispose of or archive key material under documented procedures.
Do not put secret key material into ordinary tickets, shared spreadsheets, chat messages or unapproved backups. Procedures should describe where sensitive information is handled without reproducing the secret itself.
Separate duties and approvals
Separation of duties reduces dependence on one person or credential. A requester may prepare a transaction, a reviewer may check the destination and purpose, and an authorised signer may approve execution. For particularly sensitive actions, use independent approvers who cannot approve their own requests.
Multi-signature and threshold-signature arrangements can distribute signing authority. Their effectiveness depends on how signers, devices and recovery factors are managed. If all shares are held by the same administrator or in the same environment, nominal multi-party design may offer less independence than expected.
Use least privilege: give each role the minimum access needed, for the shortest reasonable period. Review access after role changes, departures, vendor changes and incidents. Emergency access should be exceptional, time-limited, independently approved and reviewed after use. Maintain an access register showing role, permissions, approver, date granted and next review.
Control withdrawals and wallet changes
A withdrawal workflow should verify the account instruction, destination, asset and network, limits, customer status, risk flags and required approvals before signing. The exact checks depend on the service and applicable rules. A change to a saved address or wallet policy deserves a separate control from an ordinary withdrawal because it can redirect future transfers.
For high-risk movements, consider independent confirmation through a trusted channel, transaction simulation or test transfer where appropriate, cooling-off controls where supported, and enhanced approval. These are control options rather than universal legal requirements. Define conditions that trigger them and how exceptions are authorised.
Before broadcasting a transaction, compare the final transaction details with the approved request. After execution, record the transaction hash, amount, fees, approvers, time and status. Monitor the transaction to the firm’s stated confirmation threshold and reconcile the resulting ledger entry.
Test recovery and monitor exceptions
A recovery plan must work when normal access is unavailable. Test whether backup devices, recovery credentials, alternative approvers and required records can be reached by authorised people. Confirm that restoration does not bypass dual control or expose key material. A tabletop exercise can reveal missing decisions; a controlled technical test can verify that documented steps work in practice.
Monitor unusual access, repeated failed authentication, new device registration, changes to wallet allowlists, emergency access, policy modifications and unexpected signing activity. Alerts should have named owners and escalation routes. Retain logs in a way that supports later investigation and prevents unauthorised alteration.
MiCA Article 75 sets custody-policy and safeguarding expectations for providers within scope. The FCA’s future CASS 17 materials address means of access and safeguarding under the UK regime scheduled for 2027. The firm must check whether the service and jurisdiction fall within those provisions; no single wallet design guarantees compliance.
Frequently asked questions
Is cold storage always safer than a hot wallet?
No. Offline storage may reduce exposure to some online attacks, but it can increase availability, backup and recovery risks. The right design depends on the service and threat model.
Does multi-signature eliminate insider risk?
No. It can distribute authority, but collusion, shared infrastructure, compromised devices or poor recovery controls can weaken it. Review the independence of signers and the full process.
How often should wallet access be reviewed?
Set a risk-based schedule and trigger reviews after role changes, departures, vendor changes and incidents. Document review ownership and remediation of unnecessary access.
What evidence should a withdrawal control retain?
Keep the authorised request, destination and asset details, required checks, approval identities, transaction information, execution result and any exception decision.
Build practical custody capability
The Crypto Custody, Safeguarding and Client Asset Protection Controls course includes wallet governance and private-key controls alongside records, oversight and resilience.
