Stateless Hierarchical Deterministic Wallet Custody for Institutional Blockchain Adoption

Institutional adoption of blockchain technology in supply chains, healthcare, and public administration remains constrained. Organizations that manage digital assets on behalf of large numbers of non-technical users lack custody architectures suited to their scale. Existing approaches either require users to manage private keys directly; rely on centralized custodians that store encrypted keys; or depend on distributed protocols such as multi-party computation, which impose substantial infrastructure and coordination overhead. This paper presents CryptoVault, a stateless custody architecture for institutional blockchain deployments that derives private keys on demand from a single master seed using BIP-44 hierarchical deterministic (HD) wallets, eliminating persistent storage entirely. Only an AES-256-GCM-encrypted derivation index is persisted per wallet; the corresponding private key is re-derived at signing time and discarded immediately after use, ensuring no private key material ever rests on disk. The security model requires the simultaneous compromise of three independent components (the encrypted derivation index, the encryption key, and the master seed) for full key recovery, compared to two components in custody systems that persist encrypted private keys. An empirical evaluation under concurrent load demonstrates 13 to 22 ms steady-state signing latency on development hardware, with re-derivation accounting for approximately 4 to 7% of that total, confirming that on-demand derivation introduces negligible overhead. Thus, CryptoVault has been validated against an agricultural cooperative deployment as a representative institutional scenario, with an architecture that generalizes to any organization managing wallets on behalf of users who have no direct interaction with cryptographic material. A reference implementation is available as open-source software.