Reintroducing Crossmint Wallets: natively built for programmable money

The first crypto wallets had a simple job. They held funds and let one person sign for them. Embedded wallets made that easier by taking the seed phrase out of the picture, and most wallets still work that way today.

Wallets are being asked to do a lot more now. Fintechs run global money apps on them, enterprises move stablecoins through them, and AI agents are starting to pay with them. In those products a wallet works more like a bank account. Several people and systems need access to it, the money in it needs rules, and it has to keep working for years as technology develops and businesses change.

Money itself is becoming programmable, and it's happening fast. With the GENIUS Act and MiCA giving stablecoins clear rules in the US and EU, enterprises are moving real money onchain, and they want more security, more control, and no risk of a painful migration later. More assets are getting tokenized too, from treasuries to stocks, so wallets need room for whatever comes next. And AI agents are starting to spend money on people's behalf, which only works if you can give software limited access to an account.

That's why we're reintroducing Crossmint Wallets, our wallet-as-a-service. With Crossmint, the wallet itself is programmable, not just its keys, and that makes it a natural fit for programmable money.

Wallets need to be fully programmable

A programmable wallet is a smart contract wallet whose signers and spending rules live onchain, so you can change who controls it and what they can do without changing its address.

Most embedded wallets today are externally owned accounts, or EOAs. One private key controls one address, so whoever holds the key controls everything in it. It's the same design the first wallets used, and it works well when one person holds their own funds.

Global money apps, enterprise stablecoin payments, and agentic commerce all need more than that. They need programmability at two levels. At the signing level, more than one party can act on the wallet, like your customer, your finance team, or an AI agent, each with its own role, and you can add or remove them as things change. At the funds level, rules decide how money moves, like spending limits, approved recipients, and a second approval for large payouts.

Most wallet providers get partway there by adding this programmability around the key. Your backend or an agent asks for a signature, and the provider checks its policies on its own servers before it signs. That covers a lot of use cases. But the wallet underneath is still one key, so when the key itself has to change, the wallet changes with it.

That usually happens for one of these reasons.

• A key is exposed. Once it leaks, you can't trust it again, so you need a new one.
• You switch providers. Unless you export the raw private key out of the old provider's secure hardware, you need new keys. That's vendor lock-in.
• You bring signing in-house. It's the same choice. Pull the key out of the provider, or start over with new ones.

Every new key means a new address. Every balance has to move, and every integration needs updating.

There's a security gap too. With programmable keys, the provider checks its policies before it signs, but the key itself can still do anything onchain. If the key is ever exported, or someone gets past the provider's checks, those limits don't apply.

Crossmint makes the wallet itself programmable. Its signers (the approvers on the wallet) and the rules they follow are built into it and enforced onchain, so the rules hold no matter who signs. You can change who controls the wallet and what they're allowed to do without replacing it. Programmable keys are like a smart lockbox for your house key. It controls who gets the key, but if the key is compromised, you still have to change the lock. A Crossmint Wallet is a smart lock. Everyone gets their own code with their own limits, and you can revoke one without changing the lock.

That's also why Crossmint Wallets fit so naturally into programmable money. When something new comes up, like an agent that needs a weekly budget or a tokenized asset that only certain signers should move, you add a signer or a rule. The wallet, its address, and everything connected to it stay put.

What fully programmable wallets make possible

Because signers and rules live in the wallet, one wallet API covers very different jobs. A neobank needs something different from its wallets than a payroll company does, and an AI agent needs something else again. Each gets there by setting up different signers and rules, not by using a different kind of wallet.

That also matters as your product grows. When a consumer app adds business accounts or lets AI agents pay for customers, it builds them on the same wallet API, and existing wallets take on new signers and rules without migrating. There's no second wallet provider to integrate.

Global money apps need wallets that last like accounts

In a neobank or remittance app, the wallet is the customer's account, and customers expect it to behave like one. It should stay the same through new phones, new login methods, and lost devices. It should also feel like part of your app: under your brand, with balances in dollars and payments in one tap. Your team needs it to work across markets with different custody rules, so customers in one country can hold their own keys while others use a custodial setup.

Stablecoin payments need controls finance teams can trust

When a payroll company pays contractors or a fintech settles across borders, the stablecoin wallet holds company money. Finance and compliance teams need controls they can rely on: approval steps, spending limits, approved recipients, and several sign-offs for large payouts. The wallet also has to connect to how money gets in and out, from card funding to payouts in local currency.

Agentic commerce needs authority you can limit and revoke

AI agents are a new kind of user: software that spends money on someone's behalf. An AI agent wallet should give the agent enough authority to do its job and no more: a budget, approved places to pay, an expiry date, and a way to switch it off. Those limits have to hold even if the agent's key leaks.

The anatomy of a programmable Crossmint Wallet

A Crossmint Wallet is programmable itself, not just through its key. Instead of one fixed key, the wallet is a smart contract wallet with a permanent address. The keys that control it are signers the wallet can add, remove, or limit, and the rules for who can do what live in the wallet itself, onchain.

Layer 1: the wallet

The wallet is a smart contract that lives on the blockchain, not on a provider's server. The address, balance, and history belong to the contract, so they don't change when the people or systems controlling it do. On EVM chains, Crossmint wallets are ERC-4337 smart accounts (the account abstraction standard) with ERC-7579 modules. On Solana and Stellar, Crossmint built its own smart account contracts.

Layer 2: signers

Signers approve what the wallet does. There are two kinds:

• Operational signers approve everyday payments. For customers, that's a device key held in the phone's secure hardware. For backends and AI agents, it's a server signer derived from a secret in your own infrastructure. For treasury wallets, it's a key in your cloud KMS (AWS, Azure, or GCP) that can't be extracted.
• Recovery methods decide who the operational signers are. For customers, that's a code sent by email, SMS, or WhatsApp. For company wallets, it's a separate server or KMS key. Recovery methods add and remove signers and restore access, but they don't handle day-to-day payments.

Rules the wallet enforces

Each operational signer can carry its own rules: which tokens it can move, a spending limit, a list of approved recipients, and an expiry date. Enterprise treasury wallets can also be set up as multisig, requiring several approvers, such as 3 of 5 members. The smart contract enforces these rules, not Crossmint's backend, so they can always be audited onchain.

Custodial or non-custodial. Change the custody model without migrating wallets.

Who should hold the keys depends on your product, your licenses, and where you operate:

• Custodial: your company holds the server or KMS keys for signing and recovery. It fits when you already hold customer funds and the licenses that come with that, and for treasury and payout wallets.
• Non-custodial: the customer holds the device key and controls recovery. It fits when customers should own their funds outright, or when you'd rather not hold customer assets in a market.
• Hybrid: control is split, for example a customer's device key plus your server signer or recovery. It fits when customers should approve their own payments while you keep a safety net.

Because the custody model comes from who holds the signers, you switch models by changing signers. The wallet's address, balance, and history stay the same, and you can run different models for different customers or markets at the same time.

What happens when something changes

Here's how a Crossmint Wallet handles the two changes that leave EOA wallets stuck, plus giving an AI agent access.

When a key is exposed, you rotate it: a recovery method approves removing that signer and adding a new one. The address doesn't change, so no balances move and no integrations need updating. And because each signer can carry its own limits, an exposed signer with limits can only act within them until it's removed.

When you bring signing in-house, you add a server signer or a key in your own cloud KMS, then remove the old one. When you switch providers, you swap signers and recovery methods instead of exporting keys. Either way, no private key leaves its hardware, and the wallet keeps its address.

When you give an AI agent access to a wallet, you add a server signer with a spending limit and an expiry date. The wallet enforces those limits onchain, so the agent can't go past them, even if its key is compromised. Every existing signer keeps working.

In each case, the wallet stays the same. Only the signers change.

The whole payment flow, one platform

Wallets hold money. Most fintechs also need to get money in, move it, and pay it out in local currency. Crossmint Wallets are part of the Crossmint platform, so the same integration covers the rest of the flow:

• Onramps: customers fund wallets with cards, Apple Pay, or Google Pay.
• Stablecoin Orchestration: move money across borders on stablecoin rails, with Regulated Transfers for payouts to customers, businesses, and other third parties.
• Offramps: convert stablecoins into local currency.
• Financial services on the wallet: offer yield on balances and fund cards from the wallet.
• Agentic Payments: let AI agents pay with cards and stablecoins.

One integration covers wallets for your customers, your treasury, and your AI agents, with one compliance review and one team to call for the whole flow. You don't stitch together separate providers. It's fiat in to fiat out on stablecoin rails, with a platform that reaches 160+ countries.

Compliance also comes with the platform: AML screening, KYC/KYB, sanctions checks, and Travel Rule support. Crossmint is authorized under MiCA and PSD2 in the EU, registered with FinCEN in the US and FINTRAC in Canada, and SOC 2 Type II compliant.

Proven in production

Crossmint Wallets run at fintechs, enterprises, and governments. MoneyGram went live in 60 days on Crossmint wallet and stablecoin orchestration infrastructure. Wirex runs on Crossmint smart wallets and "can launch new products and expand to new chains without re-architecting wallet logic." Tala embedded Crossmint smart wallets in its app for its 1M+ active customers in Mexico, where rewards for on-time loan repayments "land in seconds rather than days." Crossmint also partners with Western Union to support the USDPT stablecoin and digital asset network on Solana.

Flexible by design. Built to last.

Your product will change. Your wallets don't have to. Read the wallet docs to see how the wallet API handles signers, recovery methods, and custody models, or talk to our team about your setup.