Is it good idea of using online wallets for exchange

Bitcoin Questions and AnswersCategory: QuestionsIs it good idea of using online wallets for exchange
Vighanesh asked 2 years ago

Hello Sir,
I am trying to develop an online bitcoin exchange system, I am planning to develop online wallet system and keeping private and public keys on different databases. I am really concerned about whether it is good idea to keeping them over online or using hardware wallets and using API for communicating to hardware wallet to execute transactions.

The only issue with hardware wallet could be one point failure which I don’t want. So is there any other better alternative.

1 Answers
Steven Hay answered 2 years ago

Hi Viganesh,
Well, private keys should be stored stricly offline and this is what hardware wallets will do. When a customer withdraws from their address, your site will have to pass the transaction to the hardware wallet for signing. The hardware wallet will then return a signed approval to your site, without revealing the private key.
That seems like a reliable setup to me, but this is really something you’d want to consult with an expert on. You need to determine what are the best security practices and follow those. You need to secure all aspects of your service and that’s no easy matter.
It’s true that a hardware wallet is a single point of failure. You could use multiple hardware wallets via multisig, or involve humans in the multisig approval process too (although this will slow things down). Hardware wallets are only liable to fail if an attacker gains physical access to them however, so as long as your site is secure that doesn’t seem like a concern.
As for alternatives, perhaps some sort of airgapped system, which could even include hardware wallets. You’d need a blockchain / security expert to advise you on this however.

Bitcoin Video Crash Course 

Dummy-proof explainer videos enjoyed by over 100,000 students. One email a day for 7 days, short and educational, guaranteed.

We hate spam as much as you do. You can unsubscribe with one click.