Wallet Retirement Desk: watchers and decommission records for exchanges' old wallets
Monitors retired exchange wallets and records each decommission step. Mid-size crypto exchanges pay.
Early · $16M loss tied to retired wallet
Written for: Small startup team
Next step
Call the head of treasury operations at a mid-size licensed exchange such as Bitpanda and ask how many retired deposit or hot wallets they still hold keys for, and who watches them today.
Why now
India's largest crypto exchange absorbed a $16M loss from an internal process failure tied to a retired wallet. A separate Bitcoin wallet bug let rogue servers steal funds when users bumped fees. Both are operational failures, not broken cryptography, and licensing regimes increasingly ask exchanges to show evidence of controls.
What became possible
Nothing new technically. The building blocks (address monitoring, signer and approval checks, runbook workflows) are standard. The change is evidence that skipped operational steps around retired wallets cost real money.
Two ways in
- Retired Address Watch
An inventory of every deprecated deposit, hot and contract wallet, with alerts on inbound funds, new token approvals or signer changes, and a sweep-or-burn recommendation.
- Customer
- Treasury operations at mid-size exchanges and OTC desks with in-house wallets
- Model
- Monthly subscription priced by address count
- Decommission Record
A signed checklist for retiring a wallet (key custody, balance sweep, deposit-address shutdown, user-notice records) exported as audit evidence for licensing reviews.
- Customer
- Compliance teams at exchanges seeking MiCA or VARA licences
- Model
- Per-entity annual licence
Competition
Watching addresses for inbound funds, approvals and signer changes is already well covered by Hypernative, Range, Tenderly and the custody platforms. A standalone retired-address watcher would be hard to sell.
Full competition notes (8 competitors)
Watching addresses for inbound funds, approvals and signer changes is already well covered by Hypernative, Range, Tenderly and the custody platforms. A standalone retired-address watcher would be hard to sell. What is missing is a process and evidence layer that works across every custody setup an exchange uses. BitGo, Fireblocks, Circle and Privy each offer only an archive or sweep step inside their own platform, with no documented audit log for it. Exchanges announce deposit-address retirements one at a time with their own cutoff dates. No product I found turns a wallet retirement into a signed checklist covering key custody, balance sweep, deposit-address shutdown and user notices, exported as audit evidence. The auditor guidance I found, mostly vendor material, expects key-control logs and evidence that controls are actually run. I did not check MiCA or VARA rule text and found nothing on decommissioning specifically. A new entrant could win by leading with the Decommission Record for compliance teams at exchanges seeking MiCA or VARA licences, pulling wallet inventories from Fireblocks, BitGo, Cobo and in-house systems, and treating monitoring as a supporting feature. The risks are a small buyer pool and the chance that Hypernative or a custody provider adds a "retired" tag and an export cheaply. So the product has to win on regulator-ready evidence and coverage across all custody setups, not on alerting.
- Hypernative (exchanges product)
Sells directly to centralized exchanges and custodians. It watches all of an exchange's hot, warm and cold wallets on every chain and alerts on unauthorized movements and slow-drain patterns. It could easily cover retired addresses, but its marketing makes no mention of decommissioning or audit records.
- Range (Safe multisig alert catalogue)
Has ready-made alerts for Safe owner add, remove and swap, threshold changes, module enablement and first-time contract interactions. This covers the signer-change part of Retired Address Watch.
- Tenderly Alerts
General developer alerting on token transfers, balance changes and on-chain events across tagged addresses, with webhook delivery. An exchange team could use it to build its own watchlist of retired addresses.
- Webacy Wallet Watch
SMS and email alerts on inbound, outbound and interaction activity at an address. It appears aimed at individual users rather than institutions.
- Cobo Portal Safe risk controls
A custody platform that decodes pending Safe transactions and enforces approval policies. Its docs mention retiring Safe smart contract wallets but describe no general decommission audit trail.
- BitGo Wallet Archiving
Built-in archive feature that stays disabled until the on-chain balance is zero. It only covers BitGo wallets and does not produce a signed retirement checklist or evidence export.
- Fireblocks vault archiving
Vaults cannot be deleted, only archived in the console, and an archived vault reappears if a deposit arrives. This basic inbound alert is limited to Fireblocks-held wallets, and the source is a community forum answer, not official docs.
- Circle developer-controlled wallets retirement guide
Recommends a manual retirement flow of sweep, re-tag and stop using, with no disable endpoint. This confirms that retirement is left to the customer's own process.
Checked 2026-10-26
Risks
- The input gives no detail on the $16M failure, so the exact control gap is unconfirmed
- Custody platforms may add retirement workflows
- There are few mid-size exchanges, and crypto budgets swing with prices
Strong tech readiness; market pull is the weak point (5).
tech 9 · pull 5 · space 6 · fit 7 · build 8
Exposed
Companies that could benefit or be threatened. News and context, not investment advice.
Momentum of its main topic
Sources
Status history
- 2026-10-26 Flagged as buildable