How to prove a wallet belongs to your company

A bank account has an institution behind it that will confirm, in writing, that the account belongs to your company. A self-custodial blockchain address has nobody behind it. The chain records that an address holds a balance and knows nothing about who controls it.

That gap has to be closed with evidence you produce. The accepted method is signed-message attestation, and it is both stronger and narrower than people expect.

What a signed message actually demonstrates

Public key cryptography lets the holder of a private key produce a signature over a chosen message. Anyone can verify that signature against the public address without ever seeing the key.

So the attestation works like this: an agreed string is chosen, you sign it with the key controlling the address, and the verifier confirms the signature matches. No funds move, nothing is exposed, and the result is mathematical rather than testimonial.

What it proves is narrow and precise: whoever produced this signature controlled the private key for this address at the time of signing.

That is a stronger statement than a bank confirmation in one way, because it is self-verifying and cannot be forged by anyone lacking the key. It is weaker in three ways that matter.

The three gaps

It proves control, not ownership. Control of a key is not a legal claim to the assets. An employee who holds a key can sign, and the signature says nothing about whether the company or the individual owns the balance. Ownership is established by your corporate records, agreements and governance, with the signature as corroboration.

It proves a moment, not a period. Signing in February says nothing about December. For a balance sheet date, an auditor needs evidence about control at that date, and a signature produced during fieldwork does not directly provide it. This is usually bridged with a dated signer roster, change records, and a management representation.

It proves one key, not the account's rules. On a multisig smart account, no single key controls the funds. A signature from one signer demonstrates that signer's participation, not authority over the account. For a smart account the stronger evidence is the account configuration itself, which is readable on-chain.

How to run the attestation

Make the message specific and unrepeatable, so it cannot be reused:

Plaitr Holdings Pte Ltd attests control of address
<address> on <chain> as of block <height>.
Nonce: 7f3a91c4. Date: 2026-10-09.

A nonce and a block height matter. A generic message signed once could be presented again later as evidence of control at a different time. Binding the message to a block height makes the claim time-specific.

Then:

1. Sign with the key controlling the address. Most wallets expose a message-signing function. Where keys sit in an embedded wallet service, signing is available through the provider's interface.
2. Record the signature alongside the message, the address, the chain and the date. All four are needed to verify; a signature alone is useless.
3. Have the verifier check it independently. They should not take your word that it validates.
4. Keep it in the audit file, not in someone's inbox.

For a multisig account, have each signer attest separately and provide the account configuration showing the threshold. Together these demonstrate who the signers are and what authority the account actually enforces.

The alternative that is weaker than it looks

A common substitute is the test transfer: send a small amount from the address to prove you can move funds.

It does demonstrate control, and it has a real advantage in that it proves the full operational path works, not just that a key exists. That is why it remains worth doing during vendor address verification.

As ownership evidence it is weaker. It costs a transaction, it puts a non-business movement into your ledger that then needs explaining, and it proves the same narrow thing a signature proves. Where the only goal is attestation, signing is cleaner.

Where embedded wallets change the picture

If signers use an embedded wallet provider rather than hardware wallets, the control question gains a layer, and auditors increasingly ask about it.

Privy, for example, splits each key using Shamir's secret sharing into a two-of-two share set: one share sealed inside a trusted execution environment, one encrypted share released only against the user's authentication credentials. Privy's documentation states that neither share in isolation provides any information or access to the wallet, and that only the TEE can combine them to produce a signature.

Two things follow that are worth being precise about.

The user controls signing, because nothing happens without their authentication. Privy's own security FAQ answers the question of who controls the wallet with "the user does."

But the key material lives within the provider's architecture rather than on your team's hardware. The meaningful mitigation is export: Privy supports exporting the full private key through the client SDK or REST API, in standard formats, usable in any wallet. That is what makes the arrangement genuinely self-custodial rather than a promise, because it is an exit that does not require anyone's cooperation.

If you use an embedded wallet provider, document the architecture and the export capability in your controls memo. An auditor asking "what if the provider disappears" should get a concrete answer rather than an assurance.

Keeping the record current

Attestation is not a one-time exercise, because the risk sits in changes.

• Re-attest at each period end, bound to that period's block height
• Maintain a dated signer roster mapping addresses and signers to named people and roles
• Treat signer changes as controlled events with approval and a record, since adding a signer is equivalent to adding a bank signatory
• Remove leavers promptly, and keep evidence of when. An ex-employee who is still a signer is an audit finding and a live risk
• Re-verify after any key rotation or recovery, because the control facts have changed

FAQ

How do you prove you own a crypto wallet?

By signing an agreed message with the private key controlling the address and letting the verifier check the signature against the address. No funds move. The signature proves control of the key at the time of signing; ownership of the assets is established by your corporate records, with the signature as corroboration.

Is a test transaction enough to prove wallet ownership?

It demonstrates control and confirms the operational path works, which is why it is useful in vendor verification. As audit evidence it is weaker than a signed message, because it costs a transaction, adds a non-business entry to the ledger, and proves no more about control than signing does.

How do you prove ownership of a multisig account?

Have each signer attest separately with a signed message, and provide the account configuration from the chain showing the signer set and threshold. No single signature proves authority over a multisig account, so the configuration is the stronger evidence of what the account actually enforces.

Can you prove you controlled an address in the past?

Not directly from a signature produced today. Signing is point-in-time. Evidence about a past date is built from a dated signer roster, records of signer changes, transaction history consistent with your records, and a management representation. Re-attesting each period end is what prevents this becoming a reconstruction exercise.

What should the attestation message contain?

The legal entity name, the address, the chain, a block height, a nonce and the date. The nonce and block height prevent a signature being reused later as evidence of control at a different time.

What should you do next?

If you hold on-chain balances and have never produced a signed attestation, do one now against a current block height, for every address, and file it. Then put re-attestation into your period-end checklist so the next audit is a lookup rather than a scramble.

Plaitr balances sit in a self-custodial Squads smart account with signing from wallets your team controls and the threshold enforced in the contract, which makes both the signer set and the rules independently verifiable. See security and control.