Wallets and custody

Hot wallet

A wallet whose keys can sign automatically while connected, so payouts go out without manual steps; fast, but its protection depends entirely on how signing is isolated and controlled.

A hot wallet can sign transactions on demand. That's what makes automated withdrawals and payouts possible, and also what makes hot wallets the usual target of attacks: if an attacker can make it sign, they can drain it.

The common pattern is to keep only working balances hot and the rest in cold storage, topping up the hot wallet when it runs low.

What protects a hot wallet

  • Isolation of the key: a key on an application server is one bug away from theft. A key inside an HSM or a hardware enclave can't be copied out.
  • Rules on what gets signed: limits, saved destinations and human approvals for anything unusual.
  • Monitoring: alerts on unusual outflows.

On Valtu

By this definition Valtu's signing is hot: payouts are signed automatically when your policies allow. What protects the keys is isolation, not being offline: they exist only inside hardware enclaves with no disk, no network and no operator access, and the enclave signs only what passed your policies. Treasury wallets can be limited to saved addresses, and large payouts can require approvals with passkeys.

Related terms

Keep reading.

Cold storageKeeping keys on devices that are never connected to a network, so signing needs deliberate, physical steps; very hard to attack remotely, and slow to use. Treasury walletThe wallet where a business collects its own funds, typically filled by sweeps from customer addresses and protected by the strictest sending rules. Approval policyRules that decide, before anything is signed, whether a transfer goes straight out, waits for people to approve it, or is refused. Hardware enclaveAn isolated compute environment, enforced by hardware, that even the machine's own operators can't read or log in to, and that can prove which code it runs.

More in wallets and custody: Blockchain address · Private key · Seed phrase · Custodial wallet · Self-custody · Wallet-as-a-service. The whole glossary.

Start free on testnetsRead the integration guide

Put it into practice.

Every workspace starts on testnets with free test coins: same dashboard, same API. Go live when your team is ready.

Get started Talk to sales