How to Migrate from an In-House Wallet to WaaS

How do you migrate from an in-house wallet to WaaS? Start by taking stock of your existing chains, addresses, and system integrations, then choose a migration path: generating new addresses in WaaS and moving assets over, or importing existing private keys into the new system. After that, run the old and new systems in parallel and switch users and funds over in phases. Done well, the whole migration can be completed without any downtime.

When Should You Consider Migrating from an In-House Wallet to WaaS?

Many exchanges and payment companies built their own wallets early on, and a few years later they tend to run into the same problems: every new chain takes weeks of engineering time; private keys are still stored in full on servers or hardware, creating a single point of failure; audit, certification, and regulatory requirements keep rising; and the engineers who originally built the wallet may have left.

If the cost of maintaining your wallet now outweighs the differentiation it brings, or your security architecture can no longer keep up with the size of your funds, it’s time to consider migrating. For a cost comparison of building versus buying, see How Much Should a Wallet Cost?

What Should You Prepare Before Migrating?

First, inventory your assets and addresses: which chains and tokens you support, how many deposit addresses and hot and cold wallets you have, the balance in each, and which addresses are already on partners’ whitelists. Second, inventory your system integrations: which services handle deposits, withdrawals, sweeping, reconciliation, risk controls, and approvals, and how their interfaces are called.

Third, run a gap assessment against WaaS capabilities: which chains and features can be replaced directly, and which custom logic needs to stay in your business layer. You can work through this item by item using the types of WaaS API endpoints; see What Is a WaaS API?

What Are the Two Migration Paths?

Generate New Addresses and Move Assets

Generate brand-new keys and addresses with MPC in WaaS, then move assets from the old wallet in batches. This is the cleanest approach: the new keys have never existed in complete form, and any security weaknesses left in the old system are cleared out with it. The trade-off is paying transfer fees and notifying users and partners to update addresses.

Import Existing Private Keys

Some providers on the market support importing existing private keys and splitting them into MPC shards, so addresses stay the same. But these private keys once existed in complete form, and if copies remain in the old system, in backups, or with former employees, the risk persists after import, which undermines MPC’s advantage that the complete private key never appears.

From a security standpoint, generating new addresses is therefore still the recommended approach. The user notifications and whitelist updates that come with an address change can be handled smoothly through the phased migration and old-address monitoring described below.

How Do You Migrate in Phases, and What Risks Should You Watch For?

The safe approach is to run in parallel first, then switch over. Start by integrating one chain on WaaS and having new users sign up on new addresses while existing users continue on the old system. Once that is stable, migrate hot wallets and sweeping chain by chain, and finally move the large balances held in cold wallets. Validate each step on testnet first, then run a small-amount trial on mainnet.

The most common risk is old addresses continuing to receive deposits. Users and partners may keep sending to old addresses for a long time, so keep the old system’s deposit monitoring and sweeping running for a while rather than shutting it down too soon. The second is ledger mismatches: with both systems running during the migration, reconcile on-chain balances and internal ledgers on both sides every day. Finally, add the new addresses to whitelists in advance and require multi-party approval for large transfers, so the migration itself doesn’t become an attack vector.

Conclusion

How do you migrate from an in-house wallet to WaaS? Take stock of assets, addresses, and system integrations, generate new addresses in WaaS, and run the old and new systems in parallel while switching over step by step. Keep monitoring old addresses, reconcile daily, and strictly approve large transfers, and you can complete the migration without downtime while clearing out the old system’s security weaknesses along the way.

Evaluating a move from your in-house wallet to WaaS? Explore Safeheron WaaS, or contact the Safeheron sales team to book a one-on-one demo