Wallet Types

Finrock supports three distinct wallet architectures — MPC wallets, Legacy wallets, and HSM cold storage — each designed for different security postures and operational requirements. Understanding the trade-offs between them helps you select the right approach for your custody strategy, whether you prioritize automation, self-custody of key material, or the highest possible physical security.

MPC Wallets
Legacy Wallets
HSM Cold Storage

MPC Wallets (Recommended)

MPC wallets are Finrock’s default and recommended wallet type for most operational use cases. They use threshold cryptography to split key material across independent signing nodes, so the full private key is never assembled at any point — not during creation, signing, or storage.How it works:

Key shares are distributed across Node A (your application server), Node B (Finrock Mobile App, user-controlled), and Node C (backup/DR node).
A signing threshold (e.g., 2-of-3) determines how many nodes must participate to produce a valid signature.
Nodes communicate over encrypted P2P channels. No key material is ever transmitted between them — only partial signatures.
Distributed Key Generation (DKG) ensures the full private key never exists, even during wallet creation.

Best for:

High-volume operational workflows
Automated transaction processing
Businesses requiring institutional-grade security without air-gapped hardware

MPC wallets support ECDSA (secp256k1) for Bitcoin, Ethereum, and EVM chains, and EdDSA (Ed25519) for Solana. See How MPC Wallets Work for a full architectural overview.

Legacy Wallets

Legacy wallets give you complete ownership and control of your private keys by hosting a Key Management Server (KMS) on your own infrastructure. Finrock’s backend servers never access your private keys, mnemonic phrases, or wallet seeds at any time — by design.How it works:

You deploy the finrock/ng-signer Docker image on your own VM (AWS or Azure recommended).
Your KMS polls Finrock at regular intervals to pick up pending signing jobs — Finrock never pushes tasks to your KMS.
The KMS signs transactions locally and encrypts them before dispatching to the blockchain.
All communication is one-way, end-to-end SHA-512 encrypted. All inbound (ingress) traffic to the KMS must be blocked; only outbound (egress) traffic is allowed.

Deployment:

docker pull finrock/ng-signer

Config file (Legacy mode):

{
  "signer_mode": "LEGACY",
  "signer_id": "2df047e7-xxxxx-xxx-xxxxx-77673f0be16c",
  "rsa_prv_key": "rsa-----xx",
  "srds": [
    "YW1vdW50IGFixxxxxxxxxxxxxxxxxxxyIG1vb24=",
    "YW11c2VkIGFiYW5kbxxxxxxxxxxxxRyZXNzIGdyZWF0"
  ]
}

Running the signer (detached container):

docker run -d --restart always --name finrock \
  -v "$(pwd)"/config.json:/app/config.json:ro \
finrock/ng-signer

version: '3'
services:
  signer:
    image: finrock/ng-signer
    container_name: finrock
    restart: always
    volumes:
      - ./config.json:/app/config.json:ro

Environment variables:

Variable	Type	Description
`FINROCK_SIGNER_MODE`	ENUM	Set to `LEGACY` for this wallet type
`FINROCK_SIGNER_ID`	UUID	Unique signer ID provided by Finrock
`FINROCK_RSA_PRV_KEY`	RSA key	Your RSA private key
`FINROCK_PASSPHRASE`	String	Passphrase to encrypt the MPC keystore (MPC mode only)
`FINROCK_MNEMONIC_PHRASE`	String	12-word seed phrase
`FINROCK_SECRET`	String	Encrypted mnemonic phrase
`FINROCK_API_HOST`	String	Defaults to `https://sapi.finrock.io`

Key operational features:

Kill switch: Instantly take the KMS offline to halt all transaction signing.
Recovery option: Generate new private keys for specific addresses or address groups if needed.

Your KMS host must block all inbound network traffic. Only outbound (egress) connections to Finrock’s API are required. Exposing the KMS to inbound traffic defeats its security model.

HSM Cold Storage

HSM (Hardware Security Module) cold storage provides the highest level of physical key security available in Finrock. Private keys are stored inside tamper-resistant hardware devices that are never connected to the internet, making remote extraction or exploitation impossible.Hardware specification:

Standard: FIPS 140-2 Level 3 compliant HSMs
Recommended device: Yubi HSM-2 FIPS
Full key isolation with zero internet exposure
Physical tamper protection against unauthorized access or key exfiltration

Air-Gapped QR Code Signing Workflow:

Initiate the Transaction

Create a transaction from the Finrock platform. The platform converts it into a PSBT (Partially Signed Bitcoin Transaction) or equivalent unsigned payload.

Display the QR Code

The unsigned payload is rendered as a QR code on your Finrock workspace. No network transfer occurs at this stage.

Scan with Offline Device

Take your air-gapped device running the Finrock Mobile App — with Wi-Fi disabled, mobile data off, and in airplane mode — and scan the QR code. The app has no network access.

Sign Offline

The Finrock Mobile App signs the transaction entirely offline using private keys stored in the device’s secure enclave or connected HSM. The signed transaction is displayed as a return QR code.

Broadcast the Transaction

Scan the return QR code back into the Finrock platform. The platform broadcasts the signed transaction to the blockchain network.

Key benefits:

Zero Network Exposure

The signing device never requires a network connection. Remote exploits and malware are impossible by design.

FIPS 140-2 Level 3

Industry-standard certification for tamper-resistant hardware used in government and regulated financial environments.

Physical Protection

Keys are stored inside hardware designed to destroy itself if tampered with, preventing physical extraction.

Operational Usability

Designed for real-world treasury operations — not just security theory. The QR workflow makes air-gapped signing practical at scale.

Best for:

High-value treasury reserves and cold storage
Environments with strict physical security requirements
Institutions that cannot accept any online key exposure under any circumstances

Choosing the Right Wallet Type

	MPC Wallets	Legacy Wallets	HSM Cold Storage
Key location	Distributed across nodes	Your infrastructure	Offline hardware
Internet exposure	Encrypted P2P only	Egress-only polling	None (air-gapped)
Operational speed	Fastest (automated)	Near-real-time	Manual (QR workflow)
Self-custody	Shared (Node B)	Full	Full
Best use case	Day-to-day operations	Compliance-driven control	Treasury / cold storage
FIPS certified	—	—	✓ Level 3

Many institutions combine wallet types: MPC wallets for operational liquidity and hot wallets, with HSM cold storage for long-term treasury reserves. You can use both within the same Finrock workspace.

Get Started

Core Concepts

Guides

AI Agents

Platform Reference

MPC Wallets (Recommended)

Legacy Wallets

HSM Cold Storage

Zero Network Exposure

FIPS 140-2 Level 3

Physical Protection

Operational Usability

Choosing the Right Wallet Type