Wallets and custody

Trading Core connects to institutional wallet infrastructure from a provider of the client’s choice. It never generates or stores private keys. It watches the chain, keeps the ledger in step with it, and controls every movement between hot and cold storage.

Who uses it: wallet and settlement staff in the back office; risk and compliance close alerts. See Security and access.

Provider-based wallets

Signing is done by the client’s contracted wallet provider through a signer interface.
Trading Core holds no private-key material.
Deposit, hot and cold addresses are registered as watch-only.
An address moves from active to retired only, never back. Each new address is reported to the back-office system.

Deposit detection

Continuous monitoring of registered addresses on Bitcoin, Ethereum, BNB Smart Chain and Polygon.
Native coins and supported asset contracts are detected.
Confirmation depth is set per network.
Reorganisation re-check: a deposit dropped by a chain reorganisation is marked dropped and never credited.
Detected deposits are credited as held and passed to the compliance gate.
Each network can be switched on or off independently.

A digital-asset deposit, step by step

The customer opens the deposit screen and sees a QR code and address for the chosen network. Only registered addresses are shown.
The customer sends funds. Trading Core detects the transfer and waits for the configured confirmations.
At confirmation depth, the system re-checks for reorganisation and credits the deposit as held.
The compliance gate runs: wallet risk screening, ownership proof for self-hosted wallets, Travel Rule status and the back-office verdict.
When every check passes and deposits are not restricted on the account, the deposit is released to available.
Anything else stays held for review. Release, return or re-screen needs four-eyes approval.

Hot / cold management

The hot wallet cap is a percentage of holdings (a setting).
Sweeps from hot to cold are proposed by wallet or settlement staff and approved by a second officer.
The ledger moves custody balances only after on-chain confirmation.
Pending sweeps can be cancelled by authorised roles.

On-chain reconciliation

A scheduled reconciliation per network compares on-chain balances with the ledger (client balances plus company custody).
Reads are pinned to a fixed block for a consistent result.
Authorised roles can run it now, including on networks that are switched off.
Each run has a reference and a result (match or break) and is kept for audit.

Outflow monitoring and alerts

Every outflow from a company address is matched to an approved sweep, a signed withdrawal or a Travel Rule transfer.
An unmatched outflow is flagged as unexpected and raises an alert.
Alert types include: shared wallet across customers, customer wallet that is a company address, reconciliation break, unexpected outflow.
Alerts are facts and cannot be deleted. Closing an alert needs four-eyes approval from risk or compliance.

Back-office wallet console

Positions per network and asset.
Reconciliation history and run controls.
Alerts with the four-eyes close.
Outflows and sweeps with their status.

What the system does or refuses

Holds no private key and never signs; the wallet provider signs approved transfers.
Never credits a deposit dropped by a reorganisation.
Credits every deposit as held until the compliance gate releases it.
Never moves a custody balance before on-chain confirmation.
Refuses a sweep without a second officer’s approval.
Never reactivates a retired address.
Refuses to delete an alert, and refuses to close one without four eyes.

Compliance controls — the gate every deposit and withdrawal passes
Ledger and settlement
Deployment and licensing — the client’s own providers