# Dedicated agent wallet

Keep the bot’s spend wallet separate from long-term holdings. Fund only what one bad run can lose. Revoke and rotate before you raise the balance. Hardware cold store vs hot agent wallet. Agent Lane does not hold keys or place trades.

Canonical HTML: https://agentlane.net/guides/dedicated-agent-wallet/

## Answer first

Before a live connector can move money: open a dedicated agent wallet (or brokerage Agentic sleeve) whose only job is agent spend; keep savings, payroll, and cold-store keys outside; fund only the ceiling for this day or project; keep review before place; empty or revoke that path before you put more money in.

## Two piles, one shield

- **Long-term holdings** — cold store, savings, payroll, seed phrases — outside the shield; agent never sees that login or key.
- **Agent spend** — hot wallet or Agentic account with one job: money this run may lose — inside the shield.
- **The gap is the shield** — one bad prompt must not drain the main stash.

## How to keep a dedicated agent wallet

1. Name two piles — long-term vs agent spend; never share login/key/sleeve.
2. Open a hot spend path — dedicated wallet or Agentic account for agent money only.
3. Park cold storage elsewhere — hardware wallet or cold store the agent cannot see or sign with.
4. Fund only one bad run — ceiling for this day or project; check balance before the session.
5. Require review before place — amount, destination, asset before place/signature.
6. Revoke and rotate before you raise — disconnect, empty/move sleeve, revoke grants, rotate tokens, then raise balance or debug.

## Hot agent wallet vs hardware cold store

- Hot agent wallet = balance the bot/signer can spend this session; small; empty when project ends.
- Hardware / cold store = long-term holds and seeds; never pasted into chat, `.env`, or agent machine when avoidable. Hard rule: [never-share-seed-with-agent.md](./never-share-seed-with-agent.md).
- Prefer a signer you approve over a raw key in `.env`.
- One login, one sleeve — do not share across people or agent accounts.

Related: [separate-funding-from-trading-wallet.md](./separate-funding-from-trading-wallet.md), [never-share-seed-with-agent.md](./never-share-seed-with-agent.md), [review-before-place.md](./review-before-place.md), [shield-crypto.md](./shield-crypto.md), [shield-brokerage.md](./shield-brokerage.md), [agent-spend-caps.md](./agent-spend-caps.md).

## Fund only what one bad run can lose

- Funded balance is the last hard stop if a rule fails.
- Refill after receipts — do not leave a fat balance “for later.”
- Pair with session/daily maxes: [agent-spend-caps.md](./agent-spend-caps.md).

## Revoke and rotate before raising the balance

1. Disconnect live connectors / payer MCP.
2. Lock or sign out of agent apps.
3. Move funds off the spend sleeve (or empty it).
4. Revoke grants and rotate tokens.
5. Then fund a higher ceiling or debug.

Related: [shared-box.md](./shared-box.md), [x402-buyer-basics.md](./x402-buyer-basics.md).

## FAQ

**What is a dedicated agent wallet?**
Hot spend path whose only job is agent money. Long-term holdings stay outside so one bad run cannot touch the main stash.

**Why separate from long-term holdings?**
A key/session the agent can see is a key/session the next prompt or leak can spend. Separation is the shield.

**How much to fund?**
Only the ceiling for this day or project — what one bad run can lose. Pair with spend caps.

**Hardware vs hot?**
Hardware/cold for long-term holds; separate hot wallet or Agentic sleeve for agent runs.

**Raise balance while live?**
No. Revoke connectors, empty/move the sleeve, rotate tokens first.

## Sources

- Canonical HTML: https://agentlane.net/guides/dedicated-agent-wallet/
- Related shelf: https://agentlane.net/resources/
- Site index for bots: https://agentlane.net/llms.txt

Some product links on this site may be affiliate links. They help keep these guides free. Details: https://agentlane.net/how-we-make-money/

Contact: agentlane@agentmail.to