White-label crypto wallet: where ready-made builds break
"White-label crypto wallet" is sold as a shortcut: a ready-made wallet core, a storefront under your brand, a couple of weeks for integration.
While there is no load, the build looks operational — transactions go through, the rate is pulled in, the balance on the screen updates.
Failures begin where the demo scenario ends: at peak activity, during a network update, and at the first attempt to separate access within the team.
The most frequent failure is balance desynchronization.
The communication node and the core cache each live their own life: after a chain reorganization, the settlement layer rolls back blocks, while the cache remains on the old numbers, and the user sees an amount that no longer exists.
Next comes loss of access to keys: if the core stores them on the vendor's side or encrypts them using a scheme that cannot be reused, changing the network or address format turns into an irreversible incident — there is no way to restore access.
Access separation in boxed solutions is usually one thing: an "administrator" with full access to everything. There are no roles for a support operator, auditor, treasurer; there is no log of who touched the keys and when. One compromised access — and the entire pool is in question.
The integration bottleneck is almost always outside the core: exchange, cash desk, payment gateway, limits, number of confirmations are hardcoded in someone else's code.
Customization for your process means a fork — that is, loss of external updates and manual security maintenance. We look at how this is closed at the architecture stage, not after the first incident.
What a ready-made core provides: release speed and key reliability
A ready-made core is not an interface template but a proven layer for working with keys, signing, and broadcasting operations to the network.
Therefore the effect of implementation is measured in engineering metrics: product release time, recovery time after a failure, share of operations that reach the network, and volume of support requests.
We keep keys in a threshold scheme: the private key is never assembled in full either on the device or on the server — the signature is composed from shares.
This approach is used in industrial key storage systems, including Fireblocks: it eliminates an entire class of failures where compromise of one access point or loss of a single backup copy nullifies access to funds.
We distribute backup shares across independent storage locations, and access recovery becomes a routine procedure rather than a rescue operation.
- Wallet release time: addresses, signing, and balance accounting are ready, so from scenario approval to a working build takes several weeks instead of months.
- Service recovery time: nodes and the operation queue are brought up from configuration, so the service returns to operation in minutes even if a server is lost.
- Share of rejected transactions: fee, send nonce, and limit checks are performed before signing — only operations that are actually confirmed go to the network.
- Eliminated class of failures: idempotent event processing prevents a redelivered notification from debiting funds twice.
- Support load: self-service access recovery and clear operation statuses remove the flow of similar requests.
White-label crypto wallet, code fork, or in-house development
The choice between a ready-made solution, a fork, and in-house development comes down to two questions: who holds the keys and how much non-standard logic needs to be included.
If the scenarios are typical — balances, transfers, history, several networks — the framework is taken ready-made and months are not spent on the base layer.
The key storage model here matters more than the delivery form.
A custodial wallet requires key management services, signing policies, and access separation on the server side; a non-custodial one moves everything to the client, and handling the seed phrase and hardware storage becomes critical.
A modular wallet architecture allows starting with one model and later adding the second without rewriting the core.
| Option | When it fits | Limitations |
|---|---|---|
| White-label | Launch in tight deadlines, typical scenarios, several networks | Logic and interface are limited by what is included; deep integrations require customization |
| Open-source fork | Need control over code and your own key storage model | Audit, vulnerability tracking, and merging upstream updates are on your side |
| In-house wallet development | Non-standard scenarios: your own networks, custodial services, signing policies | Longer to first release, higher requirements for testing and release cycle |
Transition between options is possible if the layers of network access, key storage, and interface are separated: then white-label covers the start, and individual circuits are replaced with your own implementation without stopping the product.
Implementation stages: audit, key scheme, build, verification, handover
The order of stages is not cosmetic: if the key management scheme is designed after the interface build, half of the signing services will have to be redone. Therefore we go from the role model to the code, fixing at each step an artifact that can be accepted.
-
Audit and requirements analysis. Networks and assets, roles — client, operator, treasury, limits, integration points with your backend. The output is a scenario map and a list of failures the wallet must survive.
-
Key management scheme. Where the key is generated, who signs and with what threshold, what remains with the user and what is in a secure perimeter. Rotation and separation of powers are agreed here — in rework, this is the most expensive part.
-
Wallet build. Signing core, interfaces, integration with blockchain nodes, branding. Testing on test networks, where operations are free and you can break things without consequences.
-
Backup policy. What is backed up, how often, where the copy is stored, and how recovery works. We verify for real: deployed from the copy and continued operation.
-
Wallet load testing. Simultaneous signatures, peak transaction queues, node unavailability. We look at worst-case values, not averages — in reality the wallet lives on exactly those.
-
Acceptance scenarios. We run through a checklist with your team: transfer, rejection, rollback, access recovery, blocking of a suspicious operation. Each scenario is either accepted or sent for refinement.
-
Source code handover. Repository, configurations, key scheme, deployment documentation, training for your engineers. The wallet remains manageable by your team without our involvement.
What we hand over: repositories, flow diagrams, access policies
Wallet handover is not granting repository access. We hand over a package with which your team or another contractor can build a release, deploy the environment, ship an update, and analyze an incident without correspondence with us. By project closure, what is in hand includes:
- Repositories with source code for the client side, server services, and signing module — with full change history, not a "final archive."
- Transaction flow diagram: from withdrawal request to network confirmation — where signing happens, where balances and limits are checked, at which points failure is possible and how it is rolled back.
- Access policies and roles: a rights matrix for administrator, operator, auditor, and service accounts, key rotation rules, and separation of test and production environments.
- Deployment instructions — the procedure for bringing up the environment from scratch: dependencies, configuration parameters, storage migrations, post-launch checks.
- Incident response policy: severity levels, who gets involved and within what timeframes, how fund withdrawal is stopped, and how the service returns to operation after a node failure.
- Maintenance documentation: module descriptions, extension points, the procedure for connecting new networks and tokens, known limitations.
- Results of load runs indicating tested scenarios, volumes, and what remained outside coverage.
Such a package removes the main risk: the service stops depending on a single contractor.
Case study: a wallet for a partner network — metrics before and after
What it looked like before rework
The first version was built for one network and one scenario — storage and transfers within a partner program. Balances were calculated by direct requests to nodes: at peak, partners' data diverged, transaction history stopped reconciling, and withdrawals hung on confirmation. Support handled each such case manually.
Connecting a partner required code edits and a separate build — up to three weeks per partner. The share of operations that had to be completed manually reached 4% at the daily peak, and recovery after a node failure took hours.
What was changed in the architecture
Work with networks was moved to a separate layer: the wallet does not access nodes directly but puts an operation into a queue with an idempotent key, so a retry does not create a second transaction.
A unified history index gave partners identical balances and statuses, and signing keys were moved to a hardware module based on Fireblocks. Connecting a new network or partner became a set of parameters in configuration.
What the metrics showed
- Share of successful operations: was about 96%, became 99.9% on the same volume.
- Time to connect a new network: three weeks → two days, without a wallet release.
- Supported networks: one → six in a single interface.
- Manually closed operations: 4% → 0.3% of the daily flow.
- Recovery after a node failure: hours → minutes, request intake does not stop.
How does the custodial model differ from the non-custodial one?
The difference starts with who holds the private key. In the custodial model, keys and transaction signing remain on the service side: the user sees balance and history but manages assets through the operator's infrastructure.
In the non-custodial model, the key is created and stored on the user's device, and the service only prepares the transaction and sends it to the network — it has no access to the funds.
This also changes access recovery. The custodial scenario is restored using standard means: password reset, re-binding of the second factor, handling of the request by support with actions recorded in the log.
In the non-custodial one, access recovery relies on a backup phrase or a preconfigured key-sharing scheme among trusted custodians: without a backup copy, there is no way to return the assets.
Responsibility for assets is the second divide.
In the custodial model, an error in operator rights, a key storage failure, or compromise of internal access falls on the service: separation of duties, hardware modules for keys, independent audit, and an incident action policy are needed.
The non-custodial one transfers this responsibility to the user, leaving the operator responsible for correct signing and application security.
Infrastructure requirements differ no less. The custodial option is an isolated perimeter for keys, backups with recovery verification, access rotation, monitoring of suspicious operations.
The non-custodial one is lighter on the server side but heavier on the client side: key generation on the device, local signing, storage encryption, support for different platforms.
The choice is dictated by the scenario: a mass-market product with support and a service for experienced asset holders require different architectures.
Key storage, audit, and updates: technical concerns
Before development starts, the client usually asks three questions: where private keys physically reside, who audits the code from the outside, and what happens during an update and network change. Below are short answers to the point.
Where are the user's private keys stored?
In the non-custodial model, the key is generated on the device and remains in the operating system's secure storage: only the signed transaction goes to the servers, so a database leak does not give access to funds.
In the custodial scheme, the key is never assembled in full — the signature is computed by several nodes using a threshold scheme, and copies are encrypted with a separate key. We check the mobile part against the OWASP checklist.
How is an external security audit conducted?
The audit is performed by an independent team, not us: manual review of signing and cryptography logic, static analysis, input fuzzing, and failure scenario testing. The output is a report with severity levels, fixes, and re-verification of closed items. Separately, we run a bounty program for discovered vulnerabilities.
What about updates and migration to another network?
Environments are separated: separate nodes, signing keys, and builds for development, testing, and production — the test network does not see production keys. Updates are limited by the minimum allowed client version so that outdated builds do not work with the new API.
Migration is a network change, history reindexing, and balance snapshot, first on a limited share of users.
Let's discuss the task: architecture, timelines, work plan
To make the estimate substantive, in the first conversation we review the inputs: which networks and tokens to support, where keys are stored — on the user's device or in a managed perimeter, whether fiat money deposit and withdrawal are needed, and which external services the wallet exchanges data with.
Based on the discussion, the client receives a work plan — not a one-page proposal but a document with stages, dependencies, and acceptance points. Below is the set of items we record in it.
- Stage-by-stage work plan: from the wallet core and key storage scheme to publication in app stores, with dependencies and acceptance points.
- Timeline estimates separately for the base build and extensions: new networks, tokens, additional signing scenarios.
- Team composition: architect, mobile and server engineers, security specialist — roles and workload by stage.
- Access model: what is signed on the device, what goes through the managed perimeter, and how administrator and user rights are separated.
- Support terms: update policy, procedure for responding to requests, and release of support for new networks after launch.
- Acceptance criteria: release verification scenarios — wallet creation, access recovery, transfer, and behavior during failure.
- What is needed from the client: list of networks and tokens, design requirements, access, and a contact for acceptance.
We mark open inputs directly in the plan and close them before the start — so that stages do not rely on assumptions.