Online Wallet

Overview

Online wallets include web, mobile, desktop, exchange, hosted, and embedded products. The keys may be local, provider-controlled, hardware-backed, or distributed, so online describes accessibility rather than a single custody model.

Internet exposure creates phishing, malware, credential theft, session hijacking, malicious extensions, API abuse, and provider outage risk. Even when private keys remain isolated, an attacker may manipulate transaction intent or use an authenticated session to request valid signatures.

Users should verify software origin, use strong authentication, review connected applications, and confirm transaction details on the most trusted display available. Organizations should apply least privilege, limits, allowlists, monitoring, and session controls. Large reserves generally require a more restricted architecture. Recovery and export procedures should work without depending entirely on one online interface.

Material risks for Online Wallet include credential compromise, malicious destinations, unsupported assets, wrong-network transfers, stale balances, compromised software, provider outage, privacy leakage, and inaccessible recovery material. For Online Wallet, controls should reflect value, automation, reversibility, and whether the organization or a third party controls signing.

Records for Online Wallet should preserve account and address identifiers, asset and network identity, policy version, requester, approvers, signed payload or transaction reference, fees, timestamps, status history, confirmations, exceptions, and final balance and accounting effects. For Online Wallet, corrections must remain linked rather than overwrite the original event.

Production ownership for Online Wallet should identify the user or legal entity, supported assets and networks, address model, custody boundary, signing authority, recovery method, and systems permitted to request or observe transactions. For Online Wallet, these fields determine who can act and which evidence is authoritative.