Your Own Crypto Exchange: How to Hold Client Funds in Hot and Cold Wallets, Check Withdrawals and Meet the EU Rules

Plan how client funds are held before you design the trading screen. Keep most of your clients' crypto in cold wallets, whose keys stay off any computer connected to the internet, and require several people to approve each transfer out of them. A small hot wallet pays out everyday withdrawals and is refilled from cold storage in planned transfers with an upper limit. Every withdrawal passes checks before anyone signs it. In the EU, the exchange also needs authorisation under MiCA and has to pass on sender and recipient details with transfers.

What does a crypto exchange need besides a matching engine?

The matching engine pairs buy and sell orders. Around it, an exchange runs several other systems:

• A ledger that records how much of each coin every client owns and changes with every trade, deposit and withdrawal
• Deposit handling: an address for each client, and software that watches each blockchain and credits a deposit once it has enough confirmations
• Wallets that hold the coins themselves: hot, warm and cold, explained below
• Withdrawal handling: the checks, the signing and the sending of each transfer to the network
• Identity and anti-money-laundering checks on clients and on the addresses they send to and receive from

A trade between two clients changes only the ledger. Coins move on a blockchain only when a client deposits or withdraws. The coins in the exchange's addresses therefore have to cover what the ledger says the clients own. Ask a builder how this comparison runs every day and what happens when the numbers do not match.

How much should sit in hot wallets, and how much in cold?

A hot wallet keeps its keys on a server connected to the internet, so it can sign withdrawals without a person. That speed is also its risk: anyone who takes over the server can sign too. A cold wallet keeps its keys offline, and a transfer usually needs several people to approve it. A warm wallet sits between the two: in a common setup it is online, but a person approves every transfer.

Keep in the hot wallet only what a normal day of withdrawals needs, and refill it from cold storage in planned transfers with a fixed upper limit. No ratio fits every exchange. It depends on how much clients withdraw and how quickly they expect their coins, so ask the builder to work it out from your own expected volumes.

MiCA is the EU regulation on crypto-assets: Regulation (EU) 2023/1114, read on 27 October 2026 like the other sources in this article. It describes the goal and leaves the method to the firm. Its Article 75 asks a firm that holds clients' crypto to keep a custody policy. That policy has to “minimise the risk of a loss of clients’ crypto-assets or the rights related to those crypto-assets or the means of access to the crypto-assets due to fraud, cyber threats or negligence”. The same article requires that, “on the distributed ledger, their clients’ crypto-assets are held separately from their own crypto-assets”. So the exchange's own coins and its clients' coins sit at different addresses.

What did the Bybit theft show about cold wallets?

On 21 February 2025, the crypto exchange Bybit made what it called “a routine transfer from one of our Ethereum multisig cold wallets to a warm wallet”. A multisig wallet needs several keys to approve a transfer. The approvers signed what looked like a normal transfer, but the transaction changed the wallet's own logic and gave the attackers control of it. Bybit put the loss at $1.46 billion. The FBI put it at about $1.5 billion and said North Korea was responsible.

Bybit's timeline of the incident cites preliminary reports by Sygnia Labs and Verichains. They pointed to “malicious JavaScript code on Safe{Wallet}'s platform”, the outside service its signers used, and found no vulnerability in Bybit's own infrastructure. The approvals did not stop the theft, because what the signers were shown was not what they signed.

For a new exchange, the lesson concerns how approvals work, not only how many there are:

• Each approver checks the details of a transfer on a device the web interface does not control, such as the screen of a hardware signing device
• A transfer out of cold storage has an upper limit, so one approved transaction cannot empty a whole wallet
• Someone watches the cold wallets around the clock and can pause withdrawals

How should a withdrawal be checked before it is signed?

A withdrawal request should pass checks in software before any key signs it:

• The client's balance in the ledger covers the amount and the network fee
• The amount fits the client's daily limit and the limit for one transfer
• The address is on the client's list of saved addresses, or a waiting period applies to a new address
• The address is screened against lists of sanctioned and high-risk addresses
• The details that the transfer rules require are collected and sent with the transfer

Small withdrawals that pass every check can be signed by the hot wallet automatically. Larger ones go to people who approve them from the warm or cold wallet. After the transfer is sent, the system waits for confirmations on the network and only then marks the withdrawal as complete in the ledger.

What does the EU Travel Rule require from an exchange?

Regulation (EU) 2023/1113, often called the Travel Rule, has applied “from 30 December 2024”. It requires the exchange of the client who sends crypto to pass on details of both sides. For the sender, these include “the name of the originator” and the sender's blockchain address and account number. They also include “the originator’s address, including the name of the country, official personal document number and customer identification number, or, alternatively, the originator’s date and place of birth”. For the recipient, they include the name, the blockchain address and the account number.

The details have to be sent “in advance of, or simultaneously or concurrently with, the transfer of crypto-assets”, but they do not have to be included in the blockchain transaction itself. Exchanges pass them to each other through separate messaging services, so the builder has to connect yours to them.

Withdrawals to a wallet the client controls personally, which the regulation calls a self-hosted address, have one more rule. It covers “a transfer of an amount exceeding EUR 1 000 to a self-hosted address”. For such a transfer, the exchange must “take adequate measures to assess whether that address is owned or controlled by the originator”. A common way is to ask the client to prove control of the address, for example by signing a short message with it.

Which licence does a crypto exchange need in the EU?

Under MiCA, running a trading platform for crypto-assets is a crypto-asset service, and a firm needs authorisation as a crypto-asset service provider. It falls into the highest of the three capital classes in Annex IV of the regulation, with a minimum capital requirement of EUR 150 000.

Firms that offered such services under national law before 30 December 2024 could continue under a transitional regime. It lasted “until 1 July 2026 or until they are granted or refused an authorisation”, whichever came first. That date has passed. An exchange that wants clients in the EU should plan for authorisation from the start.

MiCA also shapes the software. Article 75 requires:

• A custody agreement with each client
• A register of each client's positions
• A statement of positions “at least once every three months”
• Procedures to return clients' crypto-assets “as soon as possible”

The firm is liable for losses from incidents attributable to it, “capped at the market value of the crypto-asset that was lost, at the time the loss occurred”. Article 70 adds a rule for client money in euros or other currencies. Unless the firm is itself a bank or a payment or e-money institution, that money has to be placed “with a credit institution or a central bank” by the end of the next business day.

Outside the EU, the rules depend on the country, and this article is not legal advice. Ask a lawyer in each market you plan to serve before you decide where to register.

Should we run our own wallets or use a custody provider?

There are three common setups:

• Own wallets: you control every step and every cost, and you carry all the risk, the audits and the people who guard the keys
• A custody provider: storing keys and signing are its job, but every withdrawal depends on its systems and its fees
• Both: hot wallets in-house for speed, and cold storage with a provider for most of the client funds

Under MiCA, a provider that holds clients' crypto for an exchange must itself be authorised. Article 75 lets a firm use only providers “authorised in accordance with Article 59”, and the firm has to tell its clients that it uses one.

With a white-label exchange, ask which setup the provider uses and who holds the keys. If the provider holds them, your clients' coins depend on a company you do not control.

What should we ask a firm that builds exchange wallets?

• Where are the keys created and stored, and how many people approve a transfer from each wallet?
• How does each approver check what they sign without relying on the web interface?
• How is the ledger compared with the balances on each blockchain, and how often?
• What happens to clients' balances when a blockchain splits or a token is replaced by a new version?
• How do the Travel Rule details reach other exchanges, and what happens when they are missing?
• Can you show the withdrawal flow in a system that runs today?

The question about blockchain splits matters because of MiCA. Clients have a right to any crypto-assets newly created by such a change, in proportion to their positions, unless their agreement with the exchange says otherwise.

Where does amBrain fit?

amBrain, which publishes this blog, describes this part of its work in one line: “amBrain builds crypto exchanges: matching engine, wallets, deposits and withdrawals.” It has been building software since 2019 and works in three formats: full delivery, a dedicated team, or engineers embedded in your team. Its line on ownership is “The client keeps full ownership of the product and the code, except our reusable components.”

This article is not a case study and describes no client work. It does not say which exchanges amBrain has built, for whom, or how their wallets are set up, and it gives no prices or timelines. It is not legal advice either. If amBrain is on your shortlist, give it the same questions as any other firm.