Crypto Exchange Wallet Infrastructure: A Practical Architecture Guide for 2026

Every crypto exchange, payment service provider, or brokerage runs on the same invisible layer: wallet infrastructure. It’s the system that generates addresses, holds private keys, moves assets between hot, warm, and cold storage, processes deposits and withdrawals at scale, and decides — transaction by transaction — whether a transfer is allowed to happen. When it works, nobody notices it. When it fails, it’s the difference between a routine day and a headline: Bybit’s $1.4–1.5 billion cold-wallet loss in February 2025 wasn’t a trading bug or a smart-contract exploit — it was a wallet infrastructure failure, specifically in how a transaction was signed and verified.

For any exchange scaling past its first few thousand users, wallet infrastructure stops being a wallet and becomes a system: key management, approval logic, liquidity automation, multi-chain support, and compliance controls that all have to work together without becoming an operational bottleneck. This guide walks through what that system needs to include and where teams most commonly get it wrong.

What “Wallet Infrastructure” Actually Covers

The term gets used loosely, but for an exchange it spans several distinct layers:

• Key management — how private keys are generated, stored, and used to sign transactions, and whether any single key (or person) could move funds alone.
• Tiered custody architecture — the hot/warm/cold split that balances liquidity against exposure.
• Deposit and withdrawal processing — detecting incoming funds, crediting user balances, and executing outbound transfers at the volume the business requires.
• Liquidity and gas management — sweeping deposits into consolidated wallets, funding hot wallets with native gas tokens, and rebalancing across chains.
• Policy and approval engine — the rules and workflows that decide which transactions are allowed to execute automatically and which require human sign-off.
• Node and blockchain connectivity — how the exchange reads chain state and broadcasts transactions across every network it supports.
• Monitoring, reconciliation, and compliance — real-time balance reconciliation, anomaly detection, and travel-rule / AML screening.
• Disaster recovery — key backup and recovery procedures that don’t reintroduce the single-point-of-failure problem they’re meant to solve.

Most infrastructure incidents trace back to a weakness in one of these layers, not all of them at once — which is exactly why each layer needs its own deliberate design rather than being treated as an afterthought bolted onto the trading engine.

The First Decision: Build, Buy, or Hybrid

Before any architecture diagram gets drawn, exchanges have to answer a more basic question: do we build key management and custody in-house, buy it as a managed service, or run a hybrid model?

• Fully in-house gives maximum control but requires deep cryptographic engineering expertise, ongoing security audits, and a team dedicated to infrastructure that isn’t your core product.
• Fully outsourced custody (a third-party custodian holding assets on your behalf) is fast to launch but means giving up direct control of assets — a trade-off some regulators and institutional clients are uncomfortable with.
• Self-custody infrastructure providers sit in between: the exchange retains cryptographic control of its own assets, while the provider supplies the underlying technology (key management, policy engine, signing infrastructure) as software.

This is where the decision usually narrows to a deployment question. Providers like Safeheron offer both ends of that spectrum: Wallet-as-a-Service, a managed SaaS platform for exchanges that want to move fast without operating their own MPC nodes, and the MPC Node Suite, a fully privatized, white-label deployment that runs on the exchange’s own infrastructure (via Docker containers with Intel SGX hardware security) for teams that want to retain exclusive control over key shards and data. Choosing between them is less about security and more about how much operational ownership the team wants to take on.

Key Management: Where Most Failures Actually Start

Regardless of build-vs-buy, the foundation of exchange wallet infrastructure is how private keys are managed. A single key stored on one server, in one HSM, or known to one engineer is a single point of failure no amount of process can fully offset. Two architectures address this directly:

• Multi-signature (multisig) wallets requiring M-of-N on-chain signatures.
• Multi-Party Computation (MPC), which splits a key into encrypted shares distributed across independent parties or devices, so no complete key ever exists in one place and no single party can sign alone — keeping the key decentralized across its entire lifecycle, from generation through signing and storage.

This is the layer where the Bybit incident is most instructive: the failure wasn’t the absence of multisig approval — Bybit’s transfer was multi-signed — it was that the signing interface displayed different transaction data than what was actually executed, and the underlying verification didn’t catch the mismatch. Infrastructure built around MPC combined with hardware-secured signature verification (Safeheron pairs its MPC architecture with Intel SGX-based TEE validation, checking transaction hashes and destinations independent of the display layer) closes that specific gap rather than relying on the UI to tell the truth.

Tiered Custody: Hot, Warm, and Cold Working Together

No exchange should run entirely on hot wallets, and no exchange can run entirely on cold storage and still process withdrawals in real time. The standard architecture layers three tiers:

• Hot wallets, connected and automated for immediate withdrawal processing, holding only the liquidity needed for expected volume.
• Warm wallets, semi-connected with higher approval thresholds, used to top up hot wallets on a schedule rather than continuously.
• Cold wallets, fully offline or air-gapped, holding the bulk of reserves with the highest approval requirements and, ideally, time-delayed withdrawals.

The operational challenge is moving funds between tiers without manual intervention becoming a bottleneck or a risk in itself. This is typically handled through automated sweep processes — consolidating deposits into designated wallets and auto-funding gas — governed by the same policy engine that controls withdrawals, so consolidation transactions are just as controlled as customer-facing ones.

Deposit and Withdrawal Automation at Scale

At meaningful transaction volume, manual review of every withdrawal isn’t viable, but blanket automation without controls is how single points of failure get exploited. The infrastructure needs to automatically approve and execute routine, policy-compliant transactions while routing anything unusual — unfamiliar destination, unusual amount, off-hours timing — into a human approval queue. This typically requires three components working together: an API-based co-signer that can execute pre-approved workflows programmatically, a policy engine that evaluates every transaction against configurable rules (initiator, amount limits, destination whitelists, approval thresholds), and real-time event notifications so operations and finance teams see transaction status without polling. Safeheron’s Wallet-as-a-Service, for example, pairs an API Co-Signer with its Policy Engine to auto-execute pre-set transaction workflows and uses webhooks to push instant notifications for deposit, withdrawal, and approval events — removing the manual bottleneck without removing the controls.

Multi-Chain and Node Infrastructure

Supporting multiple blockchains means running or connecting to nodes for each network, handling different address formats, gas models, and finality assumptions, and keeping all of it in sync with the exchange’s ledger. Underinvesting here creates two common failure modes: stale chain data causing incorrect balance displays or double-processing, and node downtime blocking withdrawals for an entire asset. Redundant node connections, chain-specific monitoring, and a wallet layer that abstracts chain differences from the policy and approval logic all reduce how much chain-specific complexity leaks into the rest of the system.

Compliance and Audit Readiness

Wallet infrastructure isn’t purely a technical concern — regulators, banking partners, and institutional clients increasingly expect evidence of it. At minimum, exchanges should be able to show: independent security assurance (SOC 2 Type II reports and ISO/IEC 27001 certification are common baseline expectations for infrastructure providers), automated AML/screening on withdrawal destinations, a complete audit trail of who approved what and when, and — as a backstop for residual risk — institutional insurance coverage on custodied assets. Safeheron, for instance, holds SOC 2 and ISO/IEC 27001:2022 certifications and backs its infrastructure with Digital Asset Custodial Risks Insurance placed through Lockton.

A Quick Build-vs-Buy Checklist

Before committing to an architecture, it’s worth walking through:

1. Do we have in-house cryptographic engineering expertise to build and maintain MPC or multisig infrastructure safely, or are we better served buying it?
2. Does our compliance/banking relationship require third-party attestations (SOC 2, ISO 27001) from any infrastructure provider we use?
3. Can our policy engine express the approval rules our risk team actually needs — tiered thresholds, whitelisting, role-based initiation — or are we relying on manual review as a substitute?
4. What happens to withdrawal processing if a node goes down or a key holder is unreachable?
5. Who can approve emergency actions (freezing withdrawals, rotating keys) and how fast can that happen?

How Safeheron Fits

Safeheron builds the wallet infrastructure layer described above so exchanges, payment service providers, brokerages, and asset managers don’t have to build it from scratch. Its MPC architecture keeps private keys decentralized across their entire lifecycle, its Policy Engine and API Co-Signer automate deposit and withdrawal workflows without giving up approval controls, and its TEE-based verified signing is built specifically to close the “what you see is what you sign” gap exposed by incidents like Bybit’s. Teams can choose managed Wallet-as-a-Service or the self-hosted MPC Node Suite depending on how much infrastructure ownership they want to retain — with SOC 2, ISO/IEC 27001 certification, and Lockton-backed insurance underpinning either path.

FAQ

Is MPC or multisig better for exchange wallet infrastructure? Both eliminate the single-key problem, but multisig is typically on-chain, more expensive per transaction, and less flexible for programmatic approval workflows. MPC achieves distributed key control off-chain, generally at lower cost and with more configurable policy integration — which is why most modern exchange infrastructure providers, including Safeheron, build on it.

How much of our reserves should sit in hot wallets? There’s no universal ratio; it should be sized to expected withdrawal volume over a short window (often hours, not days), with everything beyond that held in warm or cold tiers with higher approval requirements.

Should we build wallet infrastructure in-house? Only if you have dedicated cryptographic engineering resources and expect infrastructure ownership to be a durable competitive advantage — not just a launch requirement. Most exchanges are better served focusing engineering effort on their core product and buying custody infrastructure from a specialized provider.

What’s the highest-leverage fix if we’re behind on this today? Audit whether any single key, credential, or person can currently move funds without a second approval, and close that gap first — it’s the root cause behind most large unauthorized-transfer incidents.

Talk to Safeheron

If your team is evaluating wallet infrastructure for an exchange, payment platform, or custody business, Safeheron’s team can walk through your current architecture and where a managed or self-hosted MPC deployment would fit. Visit safeheron.com to learn more or request a demo.