There is no single Canton wallet. Wallets come in five categories, each built for a different job and a different risk: quick day-to-day use, holding funds you rarely move, sharing control, or leaving custody with a regulated firm.
This article first explains what decides custody on Canton, then walks through the five categories with examples from CCTools' wallet list, and ends with one way to split funds across them.
01Who Holds the Key on Canton
On Canton, your account is a party, and every party is hosted by a validator node. The hosting validator records your party's contracts and transactions, so its operator can see that activity. Many wallets run their own validator and host their users' parties.
What decides custody is who holds the key that authorizes your party's transactions. With an external party, the signing key stays outside the validator, with you or a key service you choose, and the validator has no permission to submit a transaction for you. With a local party, the hosting validator controls the key and can act for the party.
A wallet's own documentation should say which model it uses. The custody labels below follow CCTools' wallet list, which states a custody model only where one is established.
02Browser, Mobile and Web Wallets
Quick to open and sign with, for day-to-day use and swaps. CCTools' wallet list names self-custody wallets such as 5N Loop, Console Wallet, Nightly and Zoro. Canton Wallet by Send signs in with a passkey; the list does not state its custody model, so check Send's documentation.
Strength: speed. Signing takes a click or a tap, which suits frequent, small activity.
Weakness: the device is online, so it is exposed to phishing sites and malware in a way an offline device is not. Recovery depends on the backup method each wallet offers.
Fits: funds you move often, in amounts small enough that one mistake would not cost much.
03Hardware Wallets
The signing key stays on a dedicated device, and you confirm every signature on it. CCTools' wallet list names Cypherock X1 and Ledger for CC; check the maker's documentation for the models and apps that support it.
Strength: the key never sits on an online computer or phone, so malware on the host cannot sign without your confirmation on the device.
Weakness: friction on every signature, which makes frequent trading slow. Recovery depends on the backup the maker provides, such as a recovery phrase, and that backup needs the same care as the device.
Fits: funds you keep for months and rarely move. The friction is a feature here, not a bug: it protects against rushed or impulsive moves.
04MPC Wallets
The signing key is split across several parties or devices, and signing is a threshold protocol: enough of them must take part to sign, so losing one device does not lose the wallet. Bron, in CCTools' wallet list, is a self-custody MPC wallet whose recovery does not rely on a seed phrase.
Strength: no single device holds the whole key.
Weakness: recovery depends on the wallet's own process, so read how it works before you rely on it.
Fits: holders who want to avoid both a single key and a seed phrase.
05Multi-Sig Wallets
Several approvers must sign before anything moves. On Canton this can be native, in two ways. A Daml contract names the parties that must authorize each action on it, so a contract can require the approval of several parties. And an external party can register several signing keys with a threshold, so a set number of those keys must sign each transaction. CCTools' wallet list includes C8 (Cantor8), a multisig wallet.
Strength: explicit policy. No single person can move the funds alone.
Weakness: coordination. Each transaction waits until enough signers approve it, which is slow for routine activity.
Fits: teams and shared treasuries, where a collective decision is the point.
06Custodial Wallets
An exchange, a custodial app or a regulated custodian holds the keys, and you give instructions through its app or API; it signs on your behalf. Enterprise custodians in CCTools' wallet list, such as BitGo and Zodia Custody, require KYC.
Strength: a firm handles key management for you, which some institutions need for their own compliance.
Weakness: counterparty risk. A custodian can fail, delay withdrawals or freeze an account under its terms, and regulation reduces that risk without removing it. Access also depends on KYC and on whom the service accepts.
Fits: regulated institutional flows, and balances you need to trade or settle at that venue soon.
07One Way to Split Funds Across Wallets
One pattern splits funds by how often you move them and how much one mistake could cost:
Hot wallet (browser, mobile or web): what you use this week. Kept small: no more than you could afford to lose to a phishing site.
Warm wallet (hardware): funds you keep for months but might still move.
Cold storage (a hardware wallet kept in a safe place, or institutional cold storage): funds you rarely move.
Shared funds (MPC or multi-sig): funds controlled by more than one person, or where no single key should be able to move them.
Custodial (an exchange or a regulated custodian): only what you need to trade or settle there soon, since the custodian holds the keys while the funds sit with it.
Funds move from custodial to hot to warm to cold as you plan to hold them longer, and back the other way when you are about to spend or trade.
None of these wallets needs a separate balance for gas, as you would keep ETH on Ethereum. Canton has traffic fees instead of gas: the validator that submits your transactions pays for the traffic they use, beyond a small free allowance, by burning CC. Since CIP-0078 (approved 15 Sep 2025), CC transfers carry no transfer fee. An app can still charge its own fee, so check an app's fees before you use it.