Architecture of an Exchange Hot Wallet
We specialize in hot wallet development for crypto exchanges. When designing an online wallet for an exchange, the main headache is balancing withdrawal speed with security. The compromise between convenience and safety is solved through proper architecture: minimal balances on hot storage, the main reserve on cold storage. HSM signing is 100 times safer than keystore storage. We develop exchange hot wallets with HSM protection, automatic nonce management, and balance monitoring. The system handles automatic withdrawal processing with minimal latency. Our experience: 10+ years in blockchain development, 30+ integrations with exchange systems. A hot wallet (also called an online wallet) is an online cryptocurrency storage system that automatically processes user withdrawals. It is always connected to the internet, making it the primary attack vector.
Structure of an Exchange Hot Wallet
A master hot wallet address holds funds consolidated from deposit addresses. For Ethereum-based networks, it is one address for the entire exchange or several for parallel withdrawal processing. Implementation steps:
- Select network and generate master address.
- Implement key management (HSM or Vault).
- Set up nonce tracker with atomic increment.
- Configure gas estimation and bump fee logic.
- Implement token sweep and consolidation.
- Add monitoring and alerting.
type HotWallet struct {
address common.Address
keyManager KeyManager // abstraction over HSM or keystore
client *ethclient.Client
nonceTrack *NonceTracker // nonce management
gasTrack *GasTracker
}
// NonceTracker — critical component
// PostgreSQL stores the last used nonce
// Atomic nonce issuance needed for parallel withdrawals
type NonceTracker struct {
db *DB
mu sync.Mutex
pool chan uint64 // pre-fetched nonce pool of 50
}
func (nt *NonceTracker) Next(ctx context.Context) (uint64, error) {
nt.mu.Lock()
defer nt.mu.Unlock()
var nonce uint64
err := nt.db.QueryRow(ctx,
"UPDATE hot_wallet SET nonce = nonce + 1 RETURNING nonce - 1"
).Scan(&nonce)
return nonce, err
}
Nonce management is one of the main technical challenges of an online wallet. With parallel transactions, you need to guarantee that two workers do not get the same nonce. Solution: atomic increment in the database with mutex protection. To reduce latency to under 500 ms, we use a pre-fetched nonce pool of 50 and Redis for worker synchronization.
Protecting the Private Key of a Hot Wallet
Crypto wallet security is our top priority. The private key must never be in plain text in server memory. Security levels:
| Level | Solution | Security | Complexity | Cost |
|---|---|---|---|---|
| 1 | Encrypted keystore (AES-256) | Low | Low | Free |
| 2 | HashiCorp Vault Transit Secrets | Medium | Medium | $2,000/month |
| 3 | Hardware HSM (Thales, CloudHSM) | Maximum | High | From $10,000/year |
Level 1 (minimal): Encrypted keystore on disk (AES-256), password from environment variable or secrets manager (AWS Secrets Manager, HashiCorp Vault). Key decrypted at service startup and stored in memory.
Level 2 (recommended): HashiCorp Vault Transit Secrets Engine. The key never leaves Vault — the server sends data for signing and receives the signed transaction back.
HSM transaction signing provides hardware-level isolation.
import vault "github.com/hashicorp/vault/api"
type VaultSigner struct {
client *vault.Client
keyName string
}
func (vs *VaultSigner) SignTransaction(txHash []byte) ([]byte, error) {
path := fmt.Sprintf("transit/sign/%s", vs.keyName)
secret, err := vs.client.Logical().Write(path, map[string]interface{}{
"input": base64.StdEncoding.EncodeToString(txHash),
"hash_algorithm": "sha2-256",
"signature_algorithm": "pkcs1v15",
"prehashed": true,
})
return parseVaultSignature(secret.Data["signature"].(string))
}
Level 3 (maximum): Hardware HSM (Thales Luna, AWS CloudHSM, YubiHSM). Signing occurs in a hardware chip; the private key is physically unextractable. For most exchanges, Vault is the optimal compromise: it is cheaper than HSM but provides a comparable level of isolation. According to EIP-1559, dynamic fees reduce network congestion, which is important for mass withdrawals.
Bump fee: automatic fee increase
A transaction can get stuck in the mempool if the gas price is insufficient. The system should automatically bump the fee. We implement bump fee in a background worker: it periodically checks the status of unconfirmed transactions and, if they are not confirmed after N blocks, creates a replacement transaction with a gas price increased by 10–20%.
Token Sweep and Consolidation
Deposit addresses accumulate tokens. The sweep process consolidates them:
func (hw *HotWallet) SweepERC20(depositAddr common.Address, token common.Address) error {
tokenContract := NewERC20(token, hw.client)
balance, _ := tokenContract.BalanceOf(depositAddr)
if balance.Cmp(MinSweepAmount) < 0 {
return nil
}
gasCost := hw.estimateSweepGas(depositAddr, token)
if ethBalance := hw.getETHBalance(depositAddr); ethBalance.Cmp(gasCost) < 0 {
err := hw.sendETH(depositAddr, gasCost)
if err != nil { return err }
time.Sleep(15 * time.Second)
}
nonce, _ := hw.nonceTrack.NextForAddress(depositAddr)
tx := hw.buildERC20Transfer(depositAddr, hw.address, token, balance, nonce)
signed := hw.keyManager.Sign(depositAddr, tx)
return hw.client.SendTransaction(signed)
}
The Hot Wallet as the Main Attack Vector
The online wallet is constantly online, making it the #1 target for attackers. Attacks include phishing, exploitation of vulnerabilities in RPC endpoints, and traffic interception. Without HSM, the private key can be extracted from server memory via memory dump. Even with Vault, access policies must be carefully configured. Operational cost savings reach up to 30% due to automation and reduced manual operations. For an exchange processing $1M in daily withdrawals, that translates to annual savings of over $100,000. Development of a full multi-currency wallet costs between $50,000 and $150,000 depending on requirements.
Stuck Transaction Handling
func (hw *HotWallet) BumpFee(txHash common.Hash) error {
origTx, _, _ := hw.client.TransactionByHash(txHash)
newMaxFee := new(big.Int).Mul(origTx.GasFeeCap(), big.NewInt(110))
newMaxFee.Div(newMaxFee, big.NewInt(100))
newPriorityFee := new(big.Int).Mul(origTx.GasTipCap(), big.NewInt(110))
newPriorityFee.Div(newPriorityFee, big.NewInt(100))
replaceTx := types.NewTx(&types.DynamicFeeTx{
Nonce: origTx.Nonce(),
To: origTx.To(),
Value: origTx.Value(),
Data: origTx.Data(),
Gas: origTx.Gas(),
GasFeeCap: newMaxFee,
GasTipCap: newPriorityFee,
})
signed := hw.keyManager.Sign(replaceTx)
return hw.client.SendTransaction(signed)
}
Transaction Log
Each hot wallet transaction is logged:
CREATE TABLE hot_wallet_transactions (
id BIGSERIAL PRIMARY KEY,
tx_hash VARCHAR(66),
network VARCHAR(20) NOT NULL,
from_address VARCHAR(42) NOT NULL,
to_address VARCHAR(42) NOT NULL,
token VARCHAR(42),
amount NUMERIC(36,18) NOT NULL,
gas_price NUMERIC(36,0),
gas_used INTEGER,
status VARCHAR(20) NOT NULL,
withdrawal_id BIGINT REFERENCES withdrawals(id),
nonce INTEGER,
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
confirmed_at TIMESTAMPTZ,
block_number BIGINT
);
Monitoring
An online wallet requires 24/7 monitoring: balance alerts when below threshold, failed transaction alerts, nonce gap detection, unusual outflow. We use Grafana + Prometheus for metrics, with alerts triggered if balance drops below 0.5 ETH or if more than 5 transactions fail in an hour. PagerDuty for on-call alerts. Balance monitoring ensures funds never fall below threshold. Regular security audits ensure no leaks. Contact us to discuss your project details.
Why Is HSM Crucial for Hot Wallet Security?
Without HSM, private keys reside in software memory, vulnerable to memory dump attacks. HSM provides tamper-proof hardware storage and signing, making key extraction virtually impossible. For exchanges handling millions in daily volume, the investment in HSM (costing from $10,000/year) is justified by preventing single points of failure.
What's Included in Turnkey Development
- Hot wallet architecture for your assets and networks
- HSM integration (Vault or hardware)
- Automatic sweep and token consolidation
- Nonce management with atomic increment
- Stuck transaction handling (bump fee)
- Monitoring and alerting
- Documentation and team training
Timelines and Cost
| Component | Timeline | Cost Estimate |
|---|---|---|
| ETH/ERC-20 online wallet (Ethereum exchange wallet) | 3–4 weeks | $15,000–$25,000 |
| Bitcoin hot wallet (UTXO management) | 3–4 weeks | $20,000–$30,000 |
| HSM integration | 1–2 weeks | $5,000–$10,000 |
| Sweep automation | 2–3 weeks | $8,000–$12,000 |
| Monitoring dashboard | 1–2 weeks | $5,000–$8,000 |
| Testnet testing | 2–3 weeks | $4,000–$6,000 |
Full multi-currency hot wallet with HSM — 3–4 months, total cost $50,000–$150,000. Order custom hot wallet development — our engineers will help choose the optimal architecture and estimate your project within 1 day.