How a hot wallet works
A signing service holds the keys, or shares of them, and signs each withdrawal request once it has passed the platform's checks. No one fetches a device from a vault, which is the whole point.
Because the keys are online, an attacker who gets into the signing path can drain what the wallet holds. Operators therefore keep only a working float there and move the rest to cold storage.
How operators limit hot wallet risk
- A cap on the float, with automatic sweeps to cold storage above it
- Limits per withdrawal, per customer and per hour
- Address allow-lists, and delays for new destinations
- Keys in a hardware security module or split by MPC, never in plain files
- Manual approval above a set amount
- Reconciliation of on-chain balances against the ledger
What EU rules say about hot wallets
EU law does not use the words hot and cold. Article 75 of MiCA requires a custodian to have a custody policy that minimises the risk of losing clients' crypto-assets, or the means of access to them, through fraud, cyber threats or negligence. The custodian is liable for losses from incidents attributable to it, up to the market value of the lost asset at the time of the loss.
Hot wallet, warm wallet or cold wallet?
- Cold wallet
- Keys are kept offline and a person takes part in every signature. Slower, and used for the bulk of holdings.
- Warm wallet
- A middle tier: online, but each transaction needs a human approval or a second system's signature.
Where a hot wallet shows up in a platform
Modules that do the work
- Custody & walletsWallets on every major chain, with MPC custody from leading providers or your own keys.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- LedgerThe double-entry book of record behind every balance, fee and transfer.
- BackofficeOne console to run the platform: customers, money, risk, content and staff permissions.
Platforms that need it
Guides that go deeper
Where it is written
The laws and standards this page's facts come from.
General information, not legal advice: what applies to you depends on your services and your market.