Softech Blog
Digital Assets & Financial Infrastructure

Crypto Wallet Infrastructure Development: Embedded, Programmatic and Treasury Wallet Architecture

A production architecture guide to embedded wallets, programmatic wallets, MPC/custody integrations, signing policy, recovery, treasury and product ledger.

3 min read
Crypto Wallet Infrastructure Development: Embedded, Programmatic and Treasury Wallet Architecture
Executive summary

The most important points from this article

A production architecture guide to embedded wallets, programmatic wallets, MPC/custody integrations, signing policy, recovery, treasury and product ledger. The core design decision is who controls value movement, who authorizes signing, and which state belongs to the blockchain versus the product ledger.

Key takeaways
  • Choose the control model before choosing the wallet vendor.
  • Separate business authorization from cryptographic signing.
  • Map every wallet/address to a canonical product entity.
  • Keep customer deposit state separate from treasury sweep state.
  • Design recovery and reconciliation before production launch.
Key insights

Key observations and insights

The key observations summarizing the experience, decisions and outcomes described in the article.

The wallet SDK should not define the custody model by accident.
Signing authority and business authorization are separate controls.
A blockchain balance is evidence of assets, not the complete product ledger.
Treasury movement should not change whether a customer deposit was valid.

Executive summary

Crypto wallet infrastructure is the product layer that determines who controls assets, who may authorize a transfer, how signing occurs, how blockchain transactions become product state and how operations recover when something fails. Generating an address is the easy part.

Modern wallet platforms expose several control models. Circle, for example, separates developer-controlled wallets, user-controlled wallets and modular wallets. The engineering decision is therefore not simply “which SDK?” but “which economic and authorization boundary should exist in the product?”

Choose the control model before choosing the wallet provider.

Three production wallet models

User-controlled and embedded wallets

Use this model when the user should own and approve transactions. The application can provide Web2-style onboarding and a branded wallet UX, while transaction approval remains at the user boundary. This is common in consumer fintech, loyalty, gaming and embedded on-chain products.

Developer-controlled and programmatic wallets

Use programmatic wallets when backend services need to create accounts, collect deposits, automate payouts, move treasury funds or execute other server-side flows. Circle documents this class specifically for backend-controlled creation and transaction execution.

Treasury and institutional operations

Business reserves and operating funds require a different control plane: roles, transaction policy, approvals, allowlists, recovery, segregation of duties and audit evidence. Platforms such as Fireblocks position vault and policy infrastructure around these operating requirements.

The five layers of wallet infrastructure

  1. Identity and wallet registry — map product users, accounts and business entities to canonical wallet records.
  2. Authorization policy — decide whether the operation is allowed before any signer is invoked.
  3. Signing — MPC, passkeys, keys or smart-account ownership execute the cryptographic authorization.
  4. Blockchain execution — submit, observe and classify transaction finality.
  5. Ledger and operations — post accepted business events, reconcile balances, operate treasury and preserve recovery evidence.

Signing is not authorization

A backend credential that can request a signature should not automatically have permission to move any amount to any address. Product policy should evaluate actor, asset, network, amount, destination, transaction purpose, limits and required approvals before the signing layer is called.

This separation is especially important for programmatic wallets because automation makes both legitimate operations and implementation mistakes faster.

Wallet balance is not product balance

On-chain state answers “what assets are at this address?”. It does not answer why funds arrived, whether they belong to a customer deposit, whether they were accepted, whether an adjustment was made, or whether treasury already moved them. That business interpretation belongs in an internal ledger.

For payment use cases, continue with Dedicated Deposit Addresses for USDC Payments and the stablecoin ledger guide.

Recovery belongs in architecture discovery

Recovery is not only “restore a key”. Production recovery includes lost user authentication, device migration, signer unavailability, provider outage, stuck transaction, incorrect policy, compromised operator access and safe reactivation. The correct path differs by user-controlled, programmatic and treasury models.

Provider abstraction without pretending providers are interchangeable

We normally keep a product-owned wallet registry and transaction model around provider-specific IDs. This reduces vendor coupling, but it does not pretend providers are identical. Custody model, signing guarantees, chain support, recovery and policy capabilities remain explicit architecture decisions.

When smart accounts matter

EOAs are simple and broadly compatible. Smart accounts can introduce gas sponsorship, batching and programmable authorization on supported EVM networks. Circle’s current account-type documentation distinguishes these capabilities and recommends selecting account type after the wallet product/control model.

Production checklist

  • Define economic ownership and custody/control boundary.
  • Define who can initiate, approve and sign.
  • Keep wallet IDs and addresses mapped to canonical business entities.
  • Use idempotency for wallet creation and transaction execution.
  • Separate transaction submission from business posting.
  • Separate customer deposits from treasury sweeps.
  • Design provider outage and recovery procedures.
  • Reconcile provider/chain evidence with the product ledger.
  • Give operators a searchable transaction timeline.

Conclusion

The strongest wallet architecture does not start with a vendor feature matrix. It starts with control. Once ownership, authorization, signing and operating responsibilities are explicit, the provider and chain become implementation choices rather than accidental definitions of the business model.

Solution framework

Key elements and relationships

Wallet Control Architecture

Five layers separating ownership, authorization, signing, execution and accounting.

Layer 1
Control model

Who economically controls the assets and who is allowed to initiate movement.

Layer 2
Authorization

Product policy for roles, limits, destination and transaction intent.

Layer 3
Signing

MPC, passkey, key or smart-account mechanism that authorizes blockchain execution.

Layer 4
Execution

Network transaction submission, observation and finality.

Layer 5
Ledger & operations

Product state, treasury, recovery, monitoring and reconciliation.

Evidence and context

Information supporting the analysis

Circle documents developer-controlled wallets for backend-controlled automation, user-controlled wallets for user-approved transactions, and modular wallets for custom wallet experiences.

Circle documents developer-controlled wallets as API-driven wallets where the application controls creation, transaction execution and signing.

Circle documents user-controlled wallets as user-owned wallets where users authenticate and approve transactions from their device.

Fireblocks documents vault, policy and wallet infrastructure for controlling digital-asset operations and treasury workflows.

Coinbase CDP documents non-custodial wallet infrastructure and programmatic wallet APIs for application-integrated wallets.

FAQ

Should we build our own private-key infrastructure?
Usually no. Use a specialist wallet/key provider when it fits the control model, and spend product engineering effort on authorization, ledger, recovery and operations.
Can one product use both user-controlled and developer-controlled wallets?
Yes. Hybrid products are common, but each wallet class should have an explicit ownership, authorization and operational boundary.
Continue reading

Related articles

Articles that expand the topic and add further practical context.

Author

Matt Dudzicz · Softech.app

Founder

Founder of Softech.app, focused on product engineering, digital asset infrastructure, custom software and AI-native business systems.

LinkedIn
Next step
Designing embedded wallets, MPC or treasury infrastructure?
We map the control model, signing policy, recovery, ledger and operations before selecting the provider and SDK.