Wallets determine how crypto assets are held, moved, secured, and used across blockchains. With around 560 million global digital currency users in 2024, understanding wallet mechanics is increasingly important for businesses engaging with digital assets. These wallets determine who controls funds, how transactions are authorized, and how users access decentralized finance (DeFi) and onchain applications.
Below, you'll learn what an onchain wallet is, how it differs from custodial crypto wallets, and what it takes to manage onchain wallets securely at scale.
What is an onchain wallet?
An onchain wallet is a self-custody crypto wallet that interacts directly with a blockchain. It has an address controlled by cryptographic keys, not by an account provider or institution. This is a way to hold and use crypto without relying on an intermediary.
When you use an onchain wallet, only the holder of the private keys can authorize transactions. There's no account manager behind the scenes, no company with the power to move funds, freeze balances, or reverse activity. Ownership is enforced by the network itself, not by trust in a third party.
How does an onchain wallet work in practice?
An onchain wallet sits between a user and the blockchain, handling the technically demanding parts while keeping authority with the key holder. The flow works as follows:
Key creation and recovery: When a wallet is created, it generates a private key and a corresponding public address. Wallets also typically include a recovery phrase that can restore access if a device is lost. The private key never leaves the wallet and is required to authorize every action.
Transaction preparation: When a user initiates a transfer or interacts with a smart contract, the wallet constructs a transaction specifying the destination, asset, amount, and network fee. Nothing happens automatically or implicitly.
User authorization: Before any transaction is sent, the wallet prompts the user to review and approve it. Approval triggers cryptographic signing with the private key — proving access without revealing the key itself.
Broadcast and confirmation: Once signed, the transaction is broadcast to the blockchain network. Validators or miners independently verify it and include it in a block. The wallet has no control over confirmation or settlement.
State updates: After confirmation, the transaction becomes part of the public ledger. The wallet updates balances and activity by reading the blockchain's state, not by querying an internal database.
How does an onchain wallet differ from a custodial crypto wallet?
The distinction comes down to who controls the keys. That single question has significant legal, regulatory, and operational consequences.
Key control and transaction authority
With an onchain wallet, the user holds the private keys and is the only party that can authorize transactions. The blockchain is the ledger of record; balances and transaction history are publicly verifiable by anyone. Once a transaction is authorized, it cannot be frozen, reversed, or blocked. Recovery depends entirely on user-controlled backups, since no third party retains authority over the assets.
Custodial wallets invert that model. A third party controls the keys and acts on the user's behalf, typically maintaining internal databases for day-to-day activity and reconciling with the blockchain periodically. Custodial providers can restrict access, delay withdrawals, or suspend accounts — whether due to internal policy, court orders, or regulatory requirements. They can also reset credentials and restore access, which makes them more forgiving of user error.
Regulatory requirements
Onchain wallets generally have less regulatory requirements than custodial wallets for now.
However, businesses using onchain wallets for treasury operations, payments, or customer-facing applications take on compliance responsibilities directly. Sanctions screening, transaction monitoring, and record-keeping obligations fall to them rather than to a custodial intermediary.
Risk profile
Custodial wallets consolidate risk in the provider. Exposure to exchange insolvency, hacks, or mismanagement sits outside the user's control, as several high-profile exchange failures have illustrated. Onchain wallets concentrate risk in key management instead — a lost or compromised private key has no recovery path beyond a properly secured backup.
Ready to go live?
What technologies enable onchain wallets?
Onchain wallets are built from several layers, each solving a specific problem around identity, authorization, and security. These are the main components:
Public-key cryptography: Asymmetric cryptography pairs a private key with a public address. The private key authorizes transactions; the public address lets others send assets without exposing control.
Blockchain networks: Blockchains validate signatures, track balances, and enforce rules without intermediaries. Wallets read state and broadcast transactions but don't control settlement.
Deterministic key derivation and recovery phrases: Modern wallets generate many addresses from a single recovery phrase. One properly secured backup can restore the entire wallet across devices.
Smart contracts: On programmable blockchains, wallets interact with contracts that manage assets and execute logic automatically — enabling DeFi, NFTs, and advanced permissioning. Some wallets move logic onchain, enabling features such as batched transactions, spending limits, and shared control while preserving onchain enforcement.
Multi-signature and threshold cryptography: Multi-signature wallets require approval from multiple keys. Threshold cryptography achieves similar protection by splitting signing authority across systems without ever assembling a complete private key.
Secure hardware and enclaves: Hardware wallets and trusted execution environments (TEEs) isolate keys from general-purpose software, limiting exposure even if a connected device is compromised.
How do onchain wallets remain secure?
Onchain wallets stay secure by reducing exposure and making every action explicit. The system is unforgiving by design:
Local key control: Keys are generated and stored on user-controlled devices, not on centralized servers. Transactions cannot be initiated without them.
Encryption and device protections: Wallets encrypt keys at rest and rely on device-level safeguards — secure enclaves, PINs, and biometrics — that make it much harder to gain unauthorized access.
Explicit transaction approval: Every transfer or contract interaction requires deliberate user authorization. Wallets surface transaction details before signing so users can verify what they're approving.
Hardware isolation: Hardware wallets sign transactions internally, keeping keys offline and away from internet-connected environments.
Shared control models: Multi-signature and threshold schemes reduce single points of failure by requiring cooperation among independent keys or systems.
Backup-based recovery: Recovery depends on properly created and protected backups, not centralized account resets.
User-facing safeguards: Many wallets warn users about risky permissions, unfamiliar contracts, or suspicious behavior to help prevent phishing and accidental approvals.
What are the benefits of onchain wallets?
Onchain wallets offer meaningful operational and financial capabilities for businesses alongside the security and compliance considerations described later in this article. The features below are most valuable when paired with strong key management, operational controls, and regulatory diligence.
Here’s what you can expect:
Global reach without intermediary friction: Transactions are validated by decentralized networks, allowing value to move globally without reliance on banks or payment intermediaries.
Native access to DeFi: Onchain wallets connect directly to decentralized exchanges, lending protocols, stablecoin systems, and governance platforms — without custody transfers or third-party approvals.
Programmable money: Smart contracts allow assets to follow rules and financial logic automatically, enabling escrow, revenue splits, yield strategies, and treasury automation.
Interoperability: The same wallet can be used across applications and protocols built on open standards, without locking into a single provider.
Multi-chain flexibility: Many wallets support multiple blockchains from a single setup, letting users operate across networks without managing separate infrastructure.
Transparent auditability: Every transaction is recorded on a public ledger and can be independently verified, which simplifies tracking, reconciliation, and proof of ownership.
What are the security considerations associated with onchain wallets?
The same features that give onchain wallets their power also introduce some tradeoffs. There are security considerations you will need to be mindful of.
Focus on the following:
Key loss and permanence: Lost keys or recovery phrases mean permanent loss of access. Mistaken transactions or malicious approvals cannot be reversed.
Targeted attacks: Phishing, malware, and impersonation attacks typically target user behavior rather than the cryptography itself. The weakest point is usually the human, not the protocol.
Operational complexity: Managing keys, network fees, and contract permissions requires discipline. Without strong processes, errors are costly and unrecoverable.
Compliance responsibility: Self-custody shifts obligations to the wallet owner. Businesses in particular need to account for this before deploying onchain wallet infrastructure.
How can businesses safely and effectively choose and manage onchain wallets?
Outcomes with onchain wallets often depend on how clearly ownership, access, and responsibility are defined. It’s important to know best how to manage all aspects.
Consider the following:
Match wallet design to business risk: Treasury and operational wallets serve different purposes and require different security models. High-value or long-term holdings require stronger controls than day-to-day transaction wallets.
Avoid single points of failure: Meaningful balance should never be safeguarded by a single key held by a single person. Shared control is essential.
Define access and approval policies: Who can initiate transactions, who can approve them, and under what conditions should be enforced by wallet architecture, not an informal process.
Plan for recovery early: Backups, documented recovery procedures, and tested contingencies should be in place before they’re needed.
Monitor activity continuously: Real-time visibility, anomaly detection, and compliance screening are part of safe wallet operations.
Educate teams continuously: Wallet failures are often caused by human error rather than by cryptographic flaws. Teams should receive ongoing training on phishing, transaction review, and business hygiene.
Reduces unnecessary complexity: Wallet infrastructure that abstracts away key management, enforces policies, and supports multiple chains can minimize operational risk. Solutions such as Privy let businesses offer onchain wallets without forcing every team to become cryptography experts, while still preserving user-controlled ownership.
Companies shipping onchain products run on Privy. See how we can help →
This content is for informational purposes only and does not constitute legal, financial, or investment advice. Laws and regulations governing digital assets vary by jurisdiction and are subject to change. Consult a qualified legal or financial professional before making custody or asset management decisions.