# We Tried to Break Five Business Wallets' Approval Rules

> Self-approval, immediate use of new addresses, and exceeding limits. Three of five let something through.

- Source: https://cryptofieldtest.com/wallet-controls-test/
- Published: 2026-05-31
- Author: Chris Delaney
- Publication: Crypto Field Test — Wallets and exchanges, tested with real money
- Topic: corporate wallet
- Tags: wallet, controls, testing

---

Every business wallet advertises approval controls. We configured the same policy at five and then tried to circumvent it. The benchmark throughout is [an institutional crypto wallet](https://collectnexchange.com/business-solutions/corporate-crypto-wallet), which discloses enough to check the arithmetic.

## The policy we set

Payments above a threshold require two approvers. The initiator cannot approve. New withdrawal addresses require approval and a twenty-four hour delay. Notifications on all configuration changes.

Then we attempted four things that should have failed.

## Attempt one: approving our own payment

Two providers blocked it correctly.

Two allowed the initiator to approve if they held an approver role, treating the two roles as additive rather than exclusive. The setting existed and was not enabled by default, and the interface did not indicate it was off.

One had no way to prevent it at all.

## Attempt two: using a new address immediately

Three enforced the delay correctly.

One applied the delay only to addresses added through the interface, not to those added through the interface's bulk import, which bypassed it entirely. The institutional version we tested through [an exchange that publishes its full fee schedule](https://collectnexchange.com/), with its additional reporting.

One applied the delay and allowed an administrator to override it without a second approval, which defeats the purpose.

## Attempt three: exceeding a limit by splitting

Two providers tracked cumulative totals per period and blocked the fourth payment correctly.

Three applied limits per transaction only, so four payments just under the threshold went through without additional approval.

This is the most consequential gap we found and none of the three documented it.

## Attempt four: suppressing notifications

All five sent notifications. Two sent them only to the account owner, which means a compromised owner account sees and suppresses them.

Three sent to all administrators individually, which is correct.

## What this means

Advertised controls are not the same as enforced controls. The gap between them is discoverable in an afternoon and almost nobody looks.

## The test worth running yourself

Configure your intended policy in a trial account. Then attempt to self-approve, to use a new destination immediately, to exceed a limit by splitting, and to change a setting without others being notified.

If any succeeds, you have a control that exists in the interface and not in reality.

## What we would use

The two providers that enforced everything correctly were also the two with the least configurable interfaces, which is not a coincidence. Fewer options meant fewer ways to leave something off.

For a company, [a business wallet with enforced approval rules](https://collectnexchange.com/business-solutions/corporate-crypto-wallet) is worth more than one with a longer feature list, because the feature list is what you are relying on when someone's account is compromised.

---

This article explains how something works. It is not financial advice.
Canonical HTML version: https://cryptofieldtest.com/wallet-controls-test/