A hot wallet keeps its keys on an online system so it can sign payouts automatically; a cold wallet keeps its keys offline, so nothing online can move its funds. A crypto payment platform needs both: enough in hot storage to pay out without delay, and the rest where a compromised server cannot reach it. This article shows how CryptoLike splits funds between the two, who can move them, what you see when the hot wallet runs low — and how to apply the same idea to your own treasury.
Hot and cold wallets compared
A hot wallet trades exposure for speed: a program can sign with its keys at any moment, which is what automatic payouts need, and also what an attacker on that system would use. A cold wallet trades speed for isolation: its keys never touch a networked machine, so spending from it takes people and time. Every custodial platform balances the two.
| Aspect | Hot wallet | Cold wallet |
|---|---|---|
| Where the keys are | On an online system that signs automatically | Offline, outside every networked system |
| What it is for | Payouts and day-to-day movements | Funds that payouts do not need right now |
| Speed of spending | As soon as the checks pass | Hours or more: a manual procedure with several people |
| Main risk | Compromise of the online system | Loss of the offline keys, slow access |
| How much it holds | Up to a ceiling, where one is set for the asset | Everything above the ceiling |
In CryptoLike the hot wallet is a set of addresses per network, and the cold wallet is an address per coin whose keys the platform does not hold online. The glossary entries on the hot wallet and cold wallet give short definitions.
Where your customers' payments go
CryptoLike receives every payment on a deposit address of its own: each payment and each static address has a separate one, and an address index is never reused. After the payment is confirmed and credited to your balance, the platform consolidates deposit addresses into the hot wallet, which funds payouts. Your balance does not change during consolidation — it is an entry in the ledger, not the content of one address.
- Deposit address. The customer pays; the transfer is credited after the asset's confirmations.
- Consolidation. The platform moves funds from deposit addresses to the hot wallet in batches, paying the network fees itself. On TRON this needs energy and bandwidth, which the platform pays for in TRX from its own gas wallet — see TRON energy and bandwidth.
- Hot wallet. Funds your payouts and the platform's other outgoing transfers.
- Cold storage. Receives the surplus above the hot ceiling, after an approval.
This is a custodial model: CryptoLike runs the wallets and holds the keys, and you control where your money goes through payouts. You do not run nodes, store keys or manage addresses.
Who can sign, and under which rules
CryptoLike's private keys exist only inside a separate signing service. The API, the cabinet and the main database hold addresses and public keys, never private keys. A request to sign arrives over mutually authenticated TLS (mTLS) from a fixed list of internal services, and the signing service checks it against its own rules before it signs.
- A payout is signed only when it is in processing and has a matching hold on your balance in the ledger. A request for anything else is refused.
- Consolidation goes only to allowlisted addresses. Adding an address to the signing service's allowlist takes two different administrators, each confirming with a separate one-time code; removing one takes a single administrator.
- No configured limit means no signature. Above the per-transaction or daily limits a request waits in a manual queue until an operator approves it; wrong codes lead to a lockout.
- The cold wallet is watch-only. The signing service sees its balance but has no key to sign from it.
The full list of controls, including account protection and webhook signatures, is on the security page.
How the surplus reaches cold storage
The platform can set a ceiling for the hot wallet of each asset. A scheduled job checks the hot balances, and when an asset with a ceiling rises above it, it proposes a transfer of the surplus to cold storage. Nothing moves on its own: an operator approves each proposal with a fresh 2FA code, and a proposal that nobody approves expires without moving anything.
| Rule | What it prevents |
|---|---|
| At most one open proposal per asset | Two transfers of the same surplus |
| No proposal while the exchange rate is older than 5 minutes | A ceiling in dollars applied to a wrong price |
| The cold address must be on the signing service's allowlist | A transfer to an address that was never approved |
| A new cold address needs two different administrators | One person redirecting cold storage |
| Proposal records cannot be edited | Rewriting who approved what |
The transfer itself is still signed by the signing service, so a large amount can also land in its manual queue and need a second approval there. Moving funds back from cold storage is an offline procedure with several people and physical access; it is never triggered by a request to the platform.
What you see when the hot wallet runs low
When the hot wallet of an asset cannot cover a payout, CryptoLike keeps the payout waiting instead of failing it. The payout stays pending, and the cabinet shows "Processing. The amount stays on hold until the withdrawal is sent; you can still cancel it." Operators receive an alert with the shortfall and the queue, top up the hot wallet from cold storage and resume the payout.
What this means in practice:
- A large payout can take longer than a small one. A payout above what the hot wallet holds waits for a top-up from cold storage, which is a manual procedure.
- Nothing is lost while it waits. The hold on your balance is kept, and the payout is signed only when it can be paid in full.
- You can plan around it. For an unusually large payout, talk to support in advance, or split it into several payouts over time.
Webhooks report the payout's status changes as withdrawal.* events; the payout statuses and their meaning are in the API reference.
How your balance is checked against the blockchains
Your CryptoLike balance is a double-entry ledger: every change is a posting with a debit and a credit, entries cannot be edited or deleted, and a balance cannot go below zero. A reconciliation job regularly compares what the blockchains hold on the platform's deposit and hot addresses with what the ledger says they should hold, and raises an alert on any difference.
The ledger is also why a block reorganisation is handled cleanly: if a confirmed transfer disappears from the chain, the credit is reversed with its own posting, and you receive invoice.reverted or deposit.reverted. Every movement has a transaction ID you can look up.
How to run your own treasury on top of CryptoLike
The same split works for your business: keep on CryptoLike what your payouts need, and move the rest to a wallet you control. CryptoLike gives you the tools to make that transfer hard to abuse; the routine is yours to define.
- Decide a working balance per asset. Enough for a normal week of payouts and refunds. Anything above it is your surplus.
- Whitelist your cold wallet address. Enforce the payout whitelist: payouts then go only to addresses you added, and a new address becomes usable 24 hours after it is added with 2FA.
- Set a second approval threshold. Payouts created in the cabinet or the Telegram bot above the amount you choose for an asset wait for a second owner or admin, not the person who created them; API payouts do not. See second approval.
- Move the surplus on a schedule. A weekly payout from the cabinet to the whitelisted cold address, confirmed with 2FA. Check the estimate first: it shows the platform fee, the network fee and the total debit.
- Keep API keys narrow. A key for your shop needs
create_invoiceandread; givewithdrawonly to the system that pays out, and limit that key to your servers' IP addresses — API payouts need no 2FA code.
The guide protect payouts with a whitelist and a second approval walks through the settings step by step, and mass crypto payouts covers paying many recipients at once.
FAQ
Does CryptoLike hold the keys to my balance?
Yes. CryptoLike is custodial: payments arrive on addresses the platform manages, and the keys stay in a separate signing service that signs only requests passing its own checks. Your balance is a record in the ledger. You decide where money goes through payouts: cabinet and Telegram payouts need a fresh 2FA code, API payouts need a key with withdraw, and a whitelist is optional.
Can CryptoLike move funds to cold storage automatically?
No. When a hot balance rises above the ceiling for its asset, the system only proposes a transfer. An operator approves each proposal with a fresh 2FA code, and a proposal that nobody approves expires without moving anything. The cold address itself changes only with two different administrators.
Why does my payout say "Processing" for a long time?
The payout is waiting to be signed and sent. The usual reason for a long wait is that the hot wallet of that asset needs a top-up from cold storage before it can pay the full amount. The amount stays on hold on your balance, and you can cancel the payout while it is still pending.
How often is my balance reconciled with the blockchain?
Automatically, on a fixed schedule. A reconciliation job compares the balances of the platform's deposit and hot addresses on each blockchain with the ledger and raises an alert on any difference. The ledger itself is append-only: entries cannot be edited or deleted.
Should I keep all my crypto on CryptoLike?
That is your decision. A common routine is to keep a working balance for payouts and refunds, and move the surplus regularly to a wallet you control, through a payout to a whitelisted address with a second approval above a threshold you set.