Architecture

Crossmint wallets are designed to provide:

1. Flexibility: A single wallet primitive that supports many use cases — end-user wallets, treasury management, disbursements, and more.
2. High throughput and availability: Wallets scale to the maximum throughput available per chain, at the fastest speeds possible.
3. True ownership: You and your users fully own every wallet. Even if Crossmint were to disappear, wallets continue to function — no vendor lock-in, no dependency on Crossmint infrastructure.

All while abstracting out all blockchain complexity — operate with them via simple REST APIs and SDKs.

​

Dual Layer Architecture

Crossmint achieves this by separating two concerns: the wallet itself and the authorization methods that control it.

​

The Core: Smart Contract Wallets

On EVM chains, Crossmint wallets are smart contract wallets implementing ERC-4337 with ERC-7579 modular extensions. Because the wallet is a smart contract, it lives natively on the blockchain — not in a private third-party server that you cannot audit or control. On Solana, wallets use program-derived addresses (PDAs) with equivalent programmatic control. On Stellar, wallets use Soroban smart contracts, with equivalent functionality and additional cost and developer experience improvements around the use of trustlines. This smart contract foundation enables:

• Seamless provider migration: If you wish to migrate, you can update the wallet’s recovery methods without changing the wallet address. Your users keep their address, balances, and transaction history regardless of infrastructure changes.
• Programmable authorization logic: Add multiple operational signers, with optional scoped permissions, plus multiple recovery methods, with logic fully auditable onchain.
• Flexible gas sponsorship: Wallets can pay gas in USDC, native token, or billed to your Crossmint account. See Gas Sponsorship.
• Easier post-quantum migration: Unlike wallets that couple wallet address with the underlying signer, Crossmint wallets will continue to operate with the same address once keys are upgraded to post-quantum cryptography.

All permissions are enforced onchain and fully auditable, removing the need to trust opaque infrastructure or Crossmint’s backend. The wallet logic stays visible, enforceable, and portable.

​

The Control Layer

A signer is a cryptographic identity — such as a device key, passkey, server key, or external wallet — authorized to approve actions on the wallet’s behalf. Crossmint wallets use two kinds. Operational signers approve day-to-day transactions and messages. Recovery methods prove ownership of the wallet in order to change its operational signers or recovery methods.

How it works onchain

Operational signers and recovery methods are both entries in the wallet’s onchain signer set. The smart contract enforces their permissions, not Crossmint’s backend.

For end-user wallets, Crossmint uses the native key enclaves already present on your users’ devices: the Secure Enclave on iOS and the Keystore on Android. Signatures happen directly on user hardware with no network round-trip to Crossmint or any third-party server. This means signing adds zero latency compared to a direct blockchain transaction — unlike MPC-based architectures that require key reconstruction across distributed infrastructure before every signature, or cloud TEEs which require a network round trip. For server-side and AI agent wallets, Crossmint supports server key signers — a secret held in your own infrastructure that derives keypairs deterministically by chain type (EVM, Solana, or Stellar). Signing happens entirely in-process with no external calls. For company and treasury wallets, Crossmint integrates with your existing cloud infrastructure — AWS KMS, Azure Key Vault, or GCP Cloud HSM. These Cloud KMS signers keep private keys non-extractable inside the provider’s hardware security module, supporting up to 1,000 cryptographic signing operations per second per key. For recovery, Crossmint provides recovery methods based on email or phone number OTP. These recovery methods are added to the wallet’s onchain signer set, meaning recovery is enforced by the smart contract itself — not by Crossmint’s backend. See Signers for operational signer guidance, Recovery Methods for the recovery concept, and Wallet Recovery for the recovery flow.

​

What This Means in Practice

For end-user wallets, this architecture enables completely invisible, self-custodial wallets. Users sign transactions on their own device hardware without knowing a blockchain is involved. Gas can be fully sponsored when gas sponsorship is enabled. There is no dependency on a third-party server to sign in or transact. And because the wallet is a smart contract, you have a clear migration path away from any provider — update the recovery method and move on, keeping the same wallet address and all its assets. For server-side and AI agent wallets, you get low-latency, deterministic signing from your own infrastructure. A server key signer costs nothing per signing operation and supports throughput limited only by your backend. Separate recovery and signing secrets give you key rotation without wallet migration.

​

Why Smart Contract Wallets

Wallets are becoming a foundational primitive for the entire economy and not just for crypto users, but for every person, company, AI agent, and connected device that needs to hold value or authorize payments. At that scale, wallet infrastructure must be extremely cheap to operate, flexible enough to support any custody model, and publicly auditable so that security is a matter of proof, not trust.

​

The Problem with Off-Chain Key Storage

Most wallet infrastructure today stores keys off-chain, inside proprietary enclaves or distributed across MPC networks. This means:

• Provider dependency: Wallets depend on a specific provider’s infrastructure to function.
• Latency overhead: Key reconstruction adds latency to every signature.
• Painful migration: Moving to a new provider means exporting keys and creating new wallet addresses.

These are reasonable trade-offs for certain use cases — but they are not the right foundation for millions of wallets transacting continuously.

​

A Different Approach

Smart contract wallets take a different approach. The wallet is a program deployed on a public blockchain — it does not live in anyone’s private infrastructure. The signer is completely separate and can be anything: a passkey on a user’s phone, an AWS KMS key in your cloud, or a recovery credential. The key stays whole. No splitting, no reconstruction, no added latency.

• Security comes from authorization logic that is readable onchain.
• Recovery rotates the wallet’s onchain signers.
• Migration swaps signers instead of exporting keys.

​

Why We Chose This Architecture

We chose this architecture because it is the only one that scales to the future we are building toward: wallets as ubiquitous and permanent as email addresses, but programmable, auditable, and owned by no one except the people and systems that use them.