How to build a crypto wallet
How self-custody wallets and institutional custody platforms handle keys, approvals and many chains, the rules that apply when you hold assets for others, and an order to build it in.
What a crypto wallet does
A crypto wallet lets people hold, send, receive and use crypto-assets. In a self-custody wallet only the user holds the keys. In a custodial platform the company controls the keys on behalf of clients, which brings licensing and much stricter controls.
Both need clear key handling, fee and network information before every send, address screening and a way to recover. Institutional platforms add quorum approvals, policies and audit trails around every movement.
The modules you need
Most teams need all of these in the end. The phased plan below sets the order.
Key management
Secure key generation and storage on the device, in HSMs or with MPC.
Onboarding and recovery
Setup that explains keys in plain words, and recovery that keeps the right party in control.
Send and receive
Addresses, networks and fees shown clearly, with checks before sending.
Multi-chain support
Several chains and tokens through one interface, with network labels everywhere.
Approvals and policies
Quorum approvals, limits, allow-lists and time locks for institutional accounts.
Screening
Addresses screened against sanctions and risk data before funds move.
Travel rule
Sender and receiver data exchanged with other providers for custodial transfers.
Activity and audit
Every transaction, approval and policy change logged.
How the parts fit together
- 01
Keys never in one place
MPC shares or multi-sig so no single person or server can move funds alone.
- 02
Hot, warm and cold tiers
Most assets offline, with limited hot balances topped up through approvals.
- 03
Chain adapters
One adapter per chain for building, signing and tracking transactions.
- 04
Policy engine
Rules on who may approve what, checked before any signing.
- 05
Indexing and reconciliation
On-chain balances indexed and reconciled with internal records.
Data model sketch
- 01
Wallet and key share
Wallets, addresses, chains and where each key share lives.
- 02
Transaction
Built, approved, signed and confirmed states, with hashes.
- 03
Policy
Approval rules, limits and allow-lists, with versions.
- 04
Approval
Who approved which transaction and when.
- 05
Counterparty
Addresses and providers, with screening and travel rule data.
Systems it has to talk to
- 01
Blockchain nodes
Own nodes or node providers for each chain.
- 02
MPC or HSM providers
Key management libraries, services or hardware.
- 03
Screening providers
Address risk and sanctions data.
- 04
Travel rule networks
Protocols for exchanging sender and receiver data with other providers.
- 05
Fiat on and off ramps
Licensed partners for buying and selling.
Rules to design for
Which rules apply depends on your market and product.
- 01
Custody licensing
Holding keys or moving assets for clients usually needs a licence, such as CASP authorisation under MiCA in the EU.
- 02
Travel rule
Custodial transfers carry sender and receiver data, with extra checks for self-hosted addresses in the EU.
- 03
Sanctions and AML
Address screening, customer due diligence and suspicious transaction reporting.
- 04
Operational resilience
DORA in the EU, and technology risk rules elsewhere.
- 05
Security assurance
Institutional clients ask for SOC 2 or ISAE reports and certified key storage.
From prototype to production
Build in this order so something real is in users' hands early.
- 01
Clickable prototype
Onboarding, send and the approval flow, tried by real users.
- 02
First chain live
Key management, send and receive, screening and audit on one chain.
- 03
Policies and approvals
Quorum approvals, limits and allow-lists for institutional accounts.
- 04
More chains and compliance
More chains, travel rule messaging and fiat partners.
What drives the cost
These decide most of the budget. For a number based on your own scope, use the cost tool. OceanLab bills $30-50/hr or per milestone.
- 01
Custody model
Self-custody is far simpler than custodial, which brings licensing and controls.
- 02
Chains supported
Each chain has its own transaction model and edge cases.
- 03
Key management
MPC, HSMs and their audits.
- 04
Compliance tooling
Screening, travel rule and monitoring integrations.
- 05
Security reviews
Independent audits and penetration tests before launch.
Product builds that match this guide
NovaWallet - Multi-Chain Self-Custody Mobile Wallet
Built an iOS and Android self-custody wallet supporting BTC, ETH, LTC, XRP and AVAX with one-tap send, receive and swap, plus a clean activity feed - shipped from clickable AI prototype to App Store in 8 weeks.
Riegel - Institutional MPC Custody Platform with Quorum Approvals and Client Policies
Designed and built a clickable client console for a German crypto custodian's MPC custody platform: institutions see their vaults and holdings, follow every transaction from request to final confirmation, approve with a security key against a quorum per approver group, and test their own first-match withdrawal policy before it goes live.
Bollard - Institutional Staking Dashboard for Validators, Rewards and Approvals
Designed and built a clickable client dashboard for a Singapore staking provider serving funds, family offices and corporate treasuries: positions across six chains, daily rewards split by type with SGD and USD values at receipt, unbonding dates per chain, and an approvals inbox that applies each institution's policy before stake moves.
ChainFlow - On-Chain Lending, Borrowing and Swap Console from Prototype to Production
Unified supply, borrow, swap, vault staking and portfolio analytics into a single multi-chain console - shipped from clickable AI prototype to production in 8 weeks.
Levada - Non-Custodial DEX Aggregator with Split Routing and an Ops Console
Designed and built a clickable non-custodial DEX aggregator for a Lisbon DeFi team: a swap app that splits trades across liquidity sources and shows every fee before the user signs, gasless limit orders, wallet history with approval revoking, transaction status, and an ops console that watches chain health, quote quality and failure clusters.
Two ways to work with OceanLab
Project build
We design and build the system as one project. It starts with a clickable prototype your team tries before any production code is written. Pay per milestone (outcome-based) or hourly at $30-50/hr, depending on role and seniority.
Embedded engineers
Our engineers join your team on a flexible monthly retainer. Part-time is fine and it runs month to month, with hours that overlap the US, UK and Europe, the Middle East, and Australia and Asia. Outcome-based or $30-50/hr.
Questions
Self-custody or custodial?
Self-custody keeps you out of most custody rules, but the user carries the risk. Custodial gives users recovery and support, but needs a licence and much stronger controls.
Is MPC better than multi-sig?
They solve different problems. MPC works across chains with one address. Multi-sig is transparent on-chain. Many platforms use MPC for operations and multi-sig for treasury.
How do you secure a wallet before launch?
Threat modelling from the start, key handling reviewed by specialists, and independent audits and penetration tests before real funds are involved.
