Wallet-as-a-Service for Exchanges: Why Custody Infrastructure Became a Buy Decision
The question every exchange founder eventually asks
Every exchange, at some point, has to answer one question honestly: are we a trading company, or are we a cryptography company? Wallet infrastructure — key generation, transaction signing, deposit monitoring, withdrawal approval — used to force the answer to be “both,” because there was no credible alternative to building it in-house. That has changed. Wallet-as-a-Service (WaaS) has emerged as the default way exchanges, payment platforms, and neobanks stand up institutional-grade wallet infrastructure without becoming a blockchain engineering shop first and a financial product second.
What “wallet-as-a-service” actually means
Wallet-as-a-Service is exactly what it sounds like: wallet infrastructure — key management, address generation, transaction signing, and the operational tooling around it — delivered as an API and SDK rather than built from source. Instead of standing up nodes, writing signing logic per chain, and designing a key-custody architecture from scratch, an exchange integrates a WaaS provider’s API, and gets programmatic access to wallet creation, deposits, withdrawals, and balances — with the actual private key material secured by the provider’s infrastructure, typically using MPC (Multi-Party Computation) so no single party, including the provider, ever holds a complete key.
For an exchange, this collapses months of cryptographic engineering into an integration project measured in days or weeks.
The real cost of building it yourself
The build-vs-buy math here isn’t close, and it’s worth putting numbers to it. A dedicated blockchain engineering team capable of building and maintaining production-grade wallet infrastructure typically runs $40,000–$70,000 per month in fully loaded cost, before counting the security audits that any credible custody system requires — commonly $50,000–$150,000 per audit, and not a one-time expense, since new chains and new attack techniques mean re-auditing on an ongoing basis. Timeline-wise, reaching a genuinely production-ready wallet system in-house typically takes six to twelve months in the best case — and that’s before the multi-chain expansion, compliance tooling, and disaster-recovery testing a real exchange needs.
The deeper issue isn’t even the dollar figure. Wallet infrastructure, done well, is invisible — it rarely becomes a competitive advantage on its own, but it absorbs a disproportionate share of engineering time and leadership attention while an exchange is trying to differentiate on liquidity, product, and user experience. Every month spent hardening a custom key-management system is a month not spent on the trading engine, the mobile app, or market-making relationships.
What good wallet-as-a-service infrastructure needs to deliver
Not all WaaS providers are equivalent, and exchanges evaluating one should look past the marketing page for a few specific capabilities:
- Genuine key decentralization. The private key should never exist in complete form anywhere — during generation, signing, or storage — typically via MPC combined with hardware isolation (a Trusted Execution Environment), not simply a cloud KMS with access controls layered on top.
- Fast, low-friction integration. A provider worth adopting should let an exchange go from signup to a working wallet in minutes, not weeks, with clear API and SDK documentation for web, mobile, and backend systems.
- Automation that scales with volume. Batch address generation for large user bases, auto-sweep of deposits into treasury wallets, automated gas-station funding, and webhook-based event delivery — an exchange processing thousands of transactions a day cannot be manually operating wallet plumbing.
- A policy engine, not just a signer. Withdrawal limits, allow-lists, and multi-approver rules need to be configurable without an engineering release, and an API Co-Signer should let automated systems participate in approval without weakening the control structure.
- Compliance built in, not bolted on. AML and Know-Your-Transaction (KYT) monitoring should be part of the platform, not a separate integration project — and independent certifications (SOC 2 Type II, ISO/IEC 27001:2022) plus custodial risk insurance should be table stakes, not upsells.
Where Safeheron fits into the build-vs-buy decision
This is precisely the category Safeheron built its Wallet-as-a-Service platform for. Rather than exchanges standing up their own key-management stack, Safeheron’s WaaS lets a business go live with MPC-secured wallets in minutes rather than months, with APIs and SDKs covering batch multi-chain address generation for large user bases, automated deposit and withdrawal workflows tied to an API Co-Signer, customizable approval automation for different withdrawal scenarios, auto-sweep with configurable gas-station policies, and even token multisig lifecycle management for minting, launching, and burning assets. Safeheron reports that its platform supports over 95% of high-frequency wallet operations directly from mobile, alongside web console and browser-extension access — covering the operational surface an exchange actually needs day to day, not just a bare signing API.
Crucially for exchanges specifically, this WaaS offering sits inside Safeheron’s broader MPC Self-Custody line, purpose-built for exchanges and payment service providers, and customers retain full control over their private keys and asset ownership throughout — the platform never holds a complete key on the exchange’s behalf. Security posture is backed by SOC 2 and ISO/IEC 27001:2022 certification, built-in AML/KYT monitoring, and Digital Asset Custodial Risk Insurance arranged through Lockton, addressing the certification and risk-transfer questions that a pure engineering build would otherwise leave the exchange to solve on its own. For exchanges that later want more architectural control — running their own MPC nodes rather than depending entirely on a hosted service — Safeheron’s MPC Node Suite offers a self-hosted, white-label path to the same underlying technology, so a WaaS integration doesn’t have to be a one-way door.
A short evaluation checklist
Before committing to a WaaS provider — or deciding to build in-house instead — it’s worth getting concrete answers to:
- How long does it actually take to go from signed contract to a live wallet processing real transactions?
- Does the provider ever reconstruct a complete private key at any point, even briefly, during signing?
- Can withdrawal policy be adjusted (limits, allow-lists, approvers) without a new engineering release on the exchange’s side?
- What’s included versus billed separately — AML/KYT monitoring, gas automation, multi-chain support, insurance?
- What does the exit path look like if the exchange later wants to run infrastructure itself?
The bottom line
Wallet-as-a-service exists because wallet infrastructure stopped being a place exchanges could win, and started being a place they could only lose — through a hack, a missed listing because a new chain took months to integrate, or an engineering team quietly consumed by key-management maintenance instead of product work. Providers like Safeheron, through Wallet-as-a-Service and the underlying MPC Node Suite, exist to make “buy” the obvious answer for the wallet layer, so an exchange’s engineering effort goes toward the parts of the product that actually make it worth trading on.
