When a new client starts setting up Premium Wallet, almost always the same question comes up: why do client funds arrive at some admin wallet that "has no access", and why is there a split into two types of wallets at all. This isn't complexity for its own sake - it's the basic security principle the whole self-hosted storage model rests on. Let's break down the concept: what hot wallet and admin wallet are, how they differ, whose key sits where, and how funds move between them.
The core principle: separation by access level
The idea is simple. Part of the infrastructure has to run automatically - accept deposits, process withdrawals, dispatch fees. For that, its private keys have to be available to the system, meaning they sit on the server. But if the keys to all funds sit on the server, then a server compromise means losing everything.
So funds are split into two levels. A small working portion - on a wallet whose key is on the server (this is the hot one). The main mass - on a wallet whose key is only with you, off-server. Then even in the worst case only the small operational portion is at risk, not your entire capital.
Admin wallet: storage under your control
The admin wallet is the address where all client deposits are collected. When a client makes a deposit, the funds don't stay scattered across many separate addresses - a dedicated sweep process automatically collects them onto the admin wallet. This is your main storage.
The key point that raises the most questions: the admin wallet's private key should not sit on the Premium Wallet server. You create the admin wallet in your own non-custodial wallet - for example, TronLink for TRC20 networks or Electrum for Bitcoin - and the private key stays only with you. That's exactly why the system "has no access" to these funds: it's by design. Only you have access.
This is the essence of the self-hosted model. The system collects deposits onto an address you control, not a third-party custodian. No one but you can move these funds.
Hot wallet: the working wallet for operations
The hot wallet handles outgoing operations: withdrawals to clients and dispatching fees to the temporary wallets needed to process transactions. To do this automatically, without your involvement every second, the hot wallet's key sits on the server - hence "hot", meaning available to the system in real time.
Since the key is on the server, the hot wallet holds only a small portion of funds - exactly as much as is needed to cover current withdrawals. If the server is compromised, the loss is limited to this operational portion, not all your capital.
How much to keep on each: the 80/20 rule
The working split we recommend: about 80% of liquidity on the admin wallet and about 20% on the hot wallet. Twenty percent is usually enough to cover current withdrawals without delays, while the bulk stays protected on the admin wallet under your key.
You adjust the ratio yourself to fit your operation. If withdrawals are frequent and fast - you can keep a bit more on hot for a liquidity buffer. If the main flow is incoming - you can keep less. The main rule doesn't change: on the server (hot) - the minimum needed to work, the main mass - under your key (admin).
How funds move
The full cycle looks like this:
Client deposits arrive at addresses, and the sweep process collects them onto the admin wallet - your protected storage. As the hot wallet spends liquidity on withdrawals, you periodically transfer the needed amount from admin to hot manually, maintaining a working balance. The hot wallet spends these funds on client withdrawals and on fees.
The manual transfer from admin to hot isn't an inconvenience - it's part of the protection. Since admin is under your key off-server, only you can top up the working wallet. The system cannot move the main mass of funds on its own, even if someone tries to compromise it.
An important technical detail: a separate address for each blockchain
Each blockchain has its own address format, its own key type, and its own mechanism. So there's no single private key that would work across all networks at once. For each blockchain you use, you need to create a separate admin wallet in the corresponding non-custodial wallet: for Tron networks - in TronLink, for Bitcoin - in Electrum, and so on for each network.
This means the admin wallet isn't one address but a set of addresses, one per supported network, and the keys to all of them are yours. The hot wallet works the same way - its own address in each network.
An additional layer: firewall and static IPs
Separating hot and admin is the foundation, but not the only layer of protection. If your server has static IP addresses, it makes sense to configure a firewall, restricting access to the infrastructure. This matters especially if, for some reason, more funds are kept closer to the server. The stricter the network perimeter, the smaller the attack surface.
In short
The two-wallet model comes down to one principle: separate what has to run automatically from what should stay under your sole control.
The hot wallet is the working wallet on the server for withdrawals and fees, holding a small portion of funds. The admin wallet is your main storage in your own non-custodial wallet, with the key only with you, holding the bulk. Between them - a manual transfer you control. The split is roughly 20% on hot and 80% on admin. Separate addresses for each blockchain.
This architecture is what makes storage truly self-hosted: even the Premium Wallet system itself cannot dispose of your main funds. Only you can.
This is a conceptual explanation of the storage model in Premium Wallet. The specific steps to set up admin and hot wallets for your set of networks are covered individually during onboarding. If you have any questions - reach out to us.