Cowrie Research

liminal

5 min read

Liminal

  • Name: Liminal
  • URL: https://www.liminalcustody.com/
  • Category: custody-and-wallet-operations company / signer-workflow operator / policy-and-approval middleware company
  • Tags: ethereum-ecosystem
  • Summary: Liminal matters here not just as a wallet product but as the operating company that sits above institutional signing workflows. Its own docs show that the company runs the Vaults web and mobile approval surface, role and quorum administration, address-whitelisting policy, transaction-policy checks, and—for at least one documented EVM multisig flow—the last-signature-and-gas path through its Gas Station. That makes Liminal useful as a separate company note rather than only a product note: incidents like WazirX were not just about a Safe wallet or multisig signers, but about a Liminal-mediated workflow where transaction display, whitelist state, policy approval, and final execution assistance became part of custody truth.
  • What it does:
    • Operates an institutional digital-asset business spanning Wallet-as-a-Service, Managed Custody, and a Whitelabel Solution
    • Runs Liminal Vaults, the web and mobile interface where organisations manage wallets, users, teams, quorums, policies, and transaction approvals
    • Supports hot API wallets, warm MPC wallets, cold multisig wallets, and watch-only monitoring flows across institutional operations
    • Packages transaction policy around whitelist management, spending limits, transaction limits, compliance screening, and Firewall-style approval routing
    • Documents an EVM multisig flow where a Gnosis Safe-style multisig is created in the background, the customer provides one signature fewer than threshold, and Liminal Gas Station supplies the concluding signature and gas fees
    • Also documents how customers can export a wallet key card and restore the same multisig directly in Safe/Gnosis outside Vaults, which clarifies that the protocol wallet and the Liminal workflow are related but not identical control surfaces
  • Key claims:
    • Liminal’s docs overview describes it as a software solution for web3 institutions, exchanges, and other VASPs, with wallet infrastructure plus web and mobile platforms for managing wallets, transactions, and operations
    • The same overview names three service lines: Wallet-as-a-Service, Managed Custody, and a Whitelabel Solution
    • The key-features docs say Vaults exposes role-based access control, teams, quorum controls, and transaction policies including whitelist-address rules
    • The key-features docs also say destination wallets must be whitelisted before a transaction request is created, and only whitelisted wallet addresses can be selected in the request flow
    • The address-whitelisting docs say whitelist additions themselves pass through policy approval, two-factor authentication, and risk screening, with Cube3/Cyvers-powered security checks and optional blocking or warning behavior
    • The wallets guide says Liminal supports protocol-level or smart-contract-based multisig with hardware wallets as signing devices for cold storage
    • The operate EVM multisig wallets outside Liminal Vaults docs say an EVM multisig set up through Liminal creates a Gnosis multisig contract in the background, registers predetermined signers with Liminal as the concluding signer, and lets customers later restore the wallet directly in Safe using the wallet key card and derivation path
    • WazirX’s preliminary incident report says its compromised wallet used Liminal’s infrastructure, had five WazirX signers plus one Liminal verifier, relied on Liminal-facilitated whitelisted addresses, and suffered a mismatch between what Liminal’s interface displayed and what was actually signed
  • Whitepaper: No canonical standalone company whitepaper surfaced. The useful primary materials here are Liminal’s docs corpus plus the WazirX incident disclosures that show how the company-layer workflow can become part of custody authenticity.
  • Sources:

Internal linkages

Protocol / company boundary

  • liminal is the broader product note. Keep that note on wallet types, Vaults workflow, Gas Station automation, Firewall policy behavior, compliance integrations, and the documented Safe-style multisig operating path.
  • Keep this company note narrower and sharper: it preserves where Liminal-the-operator sat in real signing and approval workflows rather than only what the product marketed.
  • safe is the wallet substrate note for the EVM multisig branch. Liminal’s own docs matter because they show that institutions could still be depending on a Liminal-managed proposal, policy, whitelist, approval, and concluding-signature workflow even when the final wallet onchain was a Safe-style multisig.
  • The operate outside Vaults and restore-wallet docs are analytically useful because they show the split explicitly: the onchain wallet can survive outside Liminal, but the day-to-day transaction-intent, whitelist, and policy-authorship path can still run through Liminal’s surfaces. That is exactly the kind of boundary confusion the WazirX incident made expensive.
  • In other words, multisig onchain and custody workflow in practice were not the same object. This note exists to keep those layers separate.

Control surface

  • The key lesson is that institutional custody risk does not stop at key storage. In Liminal’s own operating model, practical authority also runs through the web/mobile proposal surface, user-role and team administration, quorum settings, whitelist records, policy approvals, hardware-device linking, and in some EVM multisig setups the concluding-signature and gas-payment path.

  • The operate outside Vaults docs are useful because they show the split cleanly: the onchain wallet can exist independently of Liminal, but many institutions still choose to route day-to-day transaction intent through Liminal-managed interfaces and policies. Once they do, those interfaces and policies become part of the real authenticity boundary.

  • The hidden-threshold lesson is stronger than vendor risk. If Liminal controlled the transaction display, whitelist state, policy engine, last-signature path, and gas-submission path for a workflow, then the effective threshold was partly defined by Liminal’s operated systems rather than only by the visible signer count.

  • That is why WazirX is not just a generic Safe note. The preserved lesson is that a custody middleware company can become the decisive control surface even when the final wallet is still a multisig contract onchain.

  • Last reviewed: 2026-08-13 UTC

Graph View

Backlinks