Top Wallet-as-a-Service Providers for Ethereum in 2026

How Aligned, Privy, Dynamic, Turnkey, and Magic compare

Summary

Wallet-as-a-service solutions (WaaS) on Ethereum are led by a small group of established providers, including Aligned, Privy, Dynamic, Turnkey, and Magic. All are non-custodial and primarily compete on four things: how each secures the key, how it handles accounts and gas, how much of the stack it covers, and who owns the company.

For a consumer app or a financial institution building on Ethereum, the wallet is the integration you most want to get right the first time. It's what users touch directly and trust with their funds, and it signs every transaction they make. It's also the decision that compounds: once people hold balances, switching providers means migrating live accounts, so getting it right early pays off most.

Today's leading WaaS providers look almost identical on the surface. They're all non-custodial, and they all spare users the crypto mechanics: no seed phrase, no gas token, no contract prompts to approve. The differences that shape an integration sit underneath: the key-security model, how accounts and gas work, how much of the stack comes from one vendor, and who owns that vendor.

Top wallet-as-a-service providers on Ethereum

The field of credible wallet providers is small but far from uniform. Each was built around a different priority, and they overlap enough to blur together. Understanding what each one is keeps the biggest name from standing in for the best fit.

Aligned: Independent, founded by the team behind LambdaClass, and the only provider in the group focused exclusively on Ethereum: it runs on Ethereum L1 and on ZK rollups built with ethrex, while the others prioritize multichain reach. Every account is an EIP-7702 smart account that requires two signatures: one from the user's key on their device and one from Aligned's backend. It ships as part of a larger stack, with the rollup, proof aggregation, and interoperability all coming from the same team. Sovra runs identity for 8M+ people on it.

Privy (Stripe): The most widely deployed of the group by self-reported counts, with 200M+ accounts and customers like Hyperliquid and Ramp. It splits each key into two Shamir shares, both held on Privy's side (one inside a secure enclave), and reassembles the key only inside the enclave. Its default EOA wallet can be upgraded in place through EIP-7702, or act as the signer of a separate ERC-4337 smart wallet. It carries several independent audits plus SOC 2 Type I and Type II.

Dynamic (Fireblocks): As much a login-and-wallet-connection platform as an embedded wallet, with a wide range of sign-in methods and connectors to 800+ external wallets. That fits apps where plenty of users already have a wallet, alongside those who need one made. Its keys use threshold-signature MPC. Customers have included Kraken and Ondo.

Turnkey: The signing and key-management foundation other wallets build on. It generates and uses raw private keys inside secure enclaves, with a policy engine that checks every signature. Of the enclave-based providers, Turnkey is the one that lets you verify the enclave itself: reproducible builds and remote attestation confirm the exact code that touched the key. Independent, founded by an ex-Coinbase Custody team. Customers include Bridge and Polymarket.

Magic: The oldest of the group, launched in 2018 and known for email-first onboarding. It protects keys with a mix of secure enclaves, a cloud key-management service, and sharding, and it holds the widest set of compliance certifications in the group: SOC 2, SOC 3, and ISO 27001. Its wallet business is being acquired by Payward, Kraken's parent company, in a deal agreed in July 2026.

What you trust with wallet-as-a-service providers

Most of today's top WaaS solutions are non-custodial, meaning they can't move users' funds without their consent. But that label covers a wide range: how much you're trusting the provider comes down to how it handles the private key, and that trust is the foundation of what you can promise users about their money. The clearest divide is whether the full key is ever assembled in one place, and it splits these solutions into two camps.

Keys reconstructed in secure hardware

All three bring the full key together inside secure hardware, and they differ only on when. Privy splits it into two Shamir shares (not MPC), both held on its side, and reassembles them in a TEE at signing. Magic does the same with a TEE, a cloud key-management service, and sharding. Turnkey skips reassembly, keeping raw keys inside secure enclaves full-time behind a policy engine. Either way, the whole key is exposed inside the enclave, so its integrity is the security boundary.

Each gives you a different way to trust that boundary. Turnkey makes the enclave verifiable through open-source enclave code, reproducible builds, and remote attestation, so you can confirm the exact code handling the key. Privy leans on outside audits from Cure53, Zellic, and Doyensec, and Magic on the widest set of certifications in the group, SOC 2, SOC 3, and ISO 27001.

Keys that are never assembled

Dynamic and Aligned take the enclave out of the picture: no single key can move funds on its own, and they get there two ways. Dynamic uses threshold-signature MPC, where independent parties each hold a share and sign jointly, so no machine, Dynamic's included, ever holds a spendable key. Aligned uses two separate keys and requires both to sign. The user's key stays on their device (a WebAuthn passkey, a P-256 key, or an ECDSA key), Aligned's key stays on its backend, and the account contract checks both signatures on-chain before it executes anything. Passkeys are verified on-chain as P-256 signatures inside the WebAuthn envelope. A breach of Aligned's backend doesn't move funds, and neither does a stolen device on its own.

The trade-off to plan for is availability: a signature needs a second party online. The two handle that differently. Dynamic's 2-of-3 option lets any two of the three shares sign, so one being offline won't lock the wallet. Aligned's 2-of-2 doesn't have that cushion: every transaction needs Aligned's co-signer, so access depends on its backend staying reachable. For lost devices, Aligned offers optional guardian recovery: the guardian is set per app, and the timelock per account. The guardian can add a new key to an account, but that key can't sign until a timelock expires (1 to 14 days, fixed when the account is created), which leaves a window to cancel an unwanted recovery. Accounts created without a timelock have no guardian.

One more point of trust sits above the accounts themselves. Aligned accounts route through a beacon contract, one per app, and the beacon's owner can rotate the signers and point accounts to a new implementation without touching each one. That makes upgrades and key rotation simple to operate, and it means teams should know who controls the beacon for their app.

Account abstraction on wallet-as-a-service: EIP-7702 vs. ERC-4337

On its own, an Ethereum account is bare: a user needs ETH to do anything, every action is a separate approval, and losing the key means losing the funds. Account abstraction lifts those limits by giving the account programmable logic, so a product can cover gas for users, batch several steps into one confirmation, and offer recovery. All of them do this. They differ in the standard underneath, and the providers here are split between them.

ERC-4337 is the longest-running route, and Privy's smart wallets build on ERC-4337. It works entirely at the application layer: user actions become "UserOperation" objects that a separate mempool and "bundler" services collect, batch, and submit through a shared EntryPoint contract, with an optional paymaster covering gas. Because it needs no change to Ethereum itself, it went live on Ethereum mainnet in March 2023 and now has the deepest audit and tooling history of any account-abstraction approach.

That maturity comes with operational overhead. Each user needs a separate smart-contract account deployed and maintained, and much of the market reaches 4337 through shared third-party middleware such as ZeroDev. It's a well-worn path, and it also puts a common external layer in the critical signing path for many apps at once, which is worth weighing at institutional scale.

Aligned builds on EIP-7702, a 2025 protocol change that landed in Ethereum's Pectra upgrade. It lets an ordinary account (an EOA) point at contract code and run it directly, so a user's existing address gains smart-account behavior without a second account deployed alongside it. Aligned uses 7702 on its own, with no 4337 EntryPoint, bundler, or paymaster: its backend submits each transaction and pays the gas, so users never need to hold ETH or the chain's native token. The result is leaner: one address, nothing extra to deploy or fund, and no third-party middleware between the user and the chain. Because it depends on 7702, it runs only on chains that have adopted Pectra.

The two standards side by side:

EIP-7702 and ERC-4337 aren't mutually exclusive: Privy signs 7702 authorizations for any implementation, Dynamic and Magic now offer 7702-based smart accounts, and Turnkey, as a pure signer, handles both transaction types and leaves the account model to you. Which one fits comes down to whether a team wants the established 4337 tooling or a simpler account with fewer moving parts.

Renting vs. building your wallet-as-a-service stack

Providers also differ in how much of the wallet you build yourself. The options fall on three levels, from a bare signing primitive you wrap in your own code to a full stack that arrives assembled. Where a provider sits decides how many vendors you take on and how independent the pieces of your stack stay.

Turnkey sits lowest, by design. It hands you a signing and key-management foundation and leaves the account-abstraction layer, gas handling, and smart-account logic for you to build. That's the most work and the most control. Your wallet logic stays independent of any one chain or vendor, and signing sits behind a boundary you can attest. Teams with their own engineers often start here for that reason.

Privy, Dynamic, and Magic sit in the middle, as full embedded-wallet SDKs. They handle onboarding, key security, and gas, while you bring the chain and settle wherever you like. Dynamic leans hardest into authentication and wallet connection, with 800+ external-wallet connectors, so it suits apps where many users show up with a wallet already.

Aligned sits at the other end and sells the most in one piece: the wallet plus a rollup and proof aggregation, with interoperability, all from one team. Its ZK rollups are built with ethrex, the Rust Ethereum client from LambdaClass, and settle on Ethereum. That folds several procurement and integration decisions into one, and removes the seams between those layers.

It also concentrates your dependencies. The wallet, chain, and settlement all come from one provider, so they move together on a single roadmap and a single uptime, and more of your stack rides on one vendor. An institution gets one supplier to vet, and one point of dependence to weigh in return.

Who should pick what

• Turnkey fits teams with their own engineers who want to build the wallet themselves on top of a signing layer they can attest.

• Privy fits consumer apps that want the most widely deployed embedded wallet by self-reported counts and a long audit record behind it.

• Dynamic fits apps where many users already have a wallet, and where login and wallet connection matter as much as creating new wallets.

• Magic fits teams that need email-first onboarding and the broadest set of compliance certifications.

• Aligned fits fintechs and institutions building financial products on Ethereum that want the wallet, the chain, and settlement from one team, with a signing rule enforced on-chain and no third-party middleware in the transaction path.

The bottom line

A wallet provider is a long-term dependency, so the decision comes down to a few things each team has to settle for itself: how much to trust a provider with key handling, how much of the account and gas experience to hand off, and how much of the stack to source from one vendor.

The demo won't decide it for you, because they all deliver the same clean experience: no seed phrase, no gas token, a smooth login. Their real differences sit underneath, in the two choices hardest to reverse once users hold funds: how the key is secured, and how much of the product leans on a single company. Past that, the best fit depends on what you're building and what stage it's at.

Disclosure: This article was written by Aligned, one of the providers it compares. It is for informational purposes only and is not financial, legal, or security advice. Provider details, figures, and ownership information were checked against public sources as of November 2026 and may change; teams should confirm them with each provider before choosing one.