Your AI Agent’s Wallet
Web3 Companion is the secure agentic wallet that lets your AI agent autonomously check balances, execute trades, and bridge across chains, without ever seeing your private key or changing your security rules. No compromise between capability and control.
Security Review
Checks Passed- Simulation
- Calldata Decoded
- Counterparty Clear
Signing Policy
Enforced in Code- Per Transaction
- $500
- Daily Budget
- $2,000
- Recipient Allowlist
Passkey Approval
Required Above LimitSecure Signature Module
Private Key IsolatedAgent Has No Access
Why Agentic Wallets Are Dangerous
Two failure modes, two independent defenses: here’s how Web3 Companion closes both.
Agent Can Access Private Keys
Most agentic wallets give the AI agent direct access to private keys. In February 2026, researchers disclosed CVE-2026-25253, a remote-code-execution flaw in OpenClaw exposing 135,000+ instances with plaintext keys. One malicious link was enough to drain every connected wallet.
Private keys live in an isolated process with zero shared memory: a Secure Signature Module (SSM) your agent can never reach. Your agent only submits unsigned transaction requests; the SSM signs them, and only after every check below passes.
Automated Transactions Can Be Manipulated
Even without key access, an agent that signs its own transactions can be manipulated: a malicious prompt, phishing address, or spoofed price feed can trick it into approving a transfer it shouldn’t.
Three layers back each other up: AI security review flags risk first (detection, not guarantee), then hard-coded spending limits, enforced in code, backstop it. Anything above your policy limit still needs a hardware-bound Passkey confirmation your agent cannot forge.
Private keys never leave the Secure Signature Module
Web3 Companion’s agent runs on the Claude Agent SDK. The isolation above holds at the OS level, backed by:
How Every Transaction Gets Protected
Every transaction crosses four checkpoints that resolve into three independent boundaries: security review, hard enforcement, and user confirmation, so breaching one still leaves the other two standing.
Catch Obvious Traps Before They Happen
Before signing, every transaction is simulated: calldata decoding, revert prediction, unlimited-approval and burn-address detection. This catches obvious problems, but it is detection, not the final word: a novel attack pattern or an RPC outage can still get past it.
Know Who You're Sending To
Every recipient address is screened through the same compliance and risk intelligence that powers BlockSec x402, checking for sanctions exposure, mixer involvement, and known-fraud patterns. Like simulation, this layer informs the decision but doesn’t force it. It doesn’t have the final say on whether a transaction goes through.
Hard Spending Limits: Code, Not Trust
Per-transaction caps, daily budgets, and recipient allowlists are enforced in code. Your agent cannot edit its own limits, and even if the review layers above are fooled, a transaction that breaks policy is rejected outright.
Your Fingerprint Is the Veto
Anything above your policy threshold (or any attempt to change the policy itself) requires a hardware-bound biometric confirmation your agent cannot forge. No software-only exploit can substitute for a physically present user.
See what a risk check actually returns
This is Checkpoint #2 in action. The address-label data behind it is sourced from MetaSleuth, BlockSec’s on-chain investigation tool, the same data layer that powers Phalcon Compliance, BlockSec’s AML/CFT platform for regulated institutions.
What your agent can do, and what it can never do
Your agent can
- Check portfolio balances and holdings across your connected chains
- Send native tokens and ERC-20 transfers, right now, without waiting
- Quote and execute trades across leading DEX aggregators, and bridge assets cross-chain when needed
- Auto-sign transactions within your configured policy limits; once set, they go through without further approval
Your agent never
- Reads or exports the private key; it never leaves the Secure Signature Module, period
- Changes its own signing policy; any policy change requires your Passkey confirmation
- Skips a Passkey approval for transactions over your threshold, no matter what
- Reuses an old security verdict if you've modified the transaction; every change means a fresh check
Get Started in Three Steps
From zero to a running agentic wallet in three commands: no private key handoff, no reading through documentation, just deploy and configure.
Deploy in One Command
One Docker command launches the Secure Signature Module and a browser-based setup wizard, no config needed.
$ docker run -d --name web3-companion \
-p 8081:8081 \
-v web3-data:/home/web3 \
blocksecteam/web3-companion
✓ SSM initialized
ℹ http://localhost:8081 (Setup Wizard)Configure Your Limits
Once locked in, your agent can never increase these limits without your Passkey approval.
# set your own limits in the wizard
max_per_tx: $500
daily_limit: $2,000
whitelist: [Uniswap, 1inch]Your Agent Trades: Within Limits
Watch as your agent autonomously executes trades within the policy you set, requesting approval only when needed.
✓ Swap 50 USDC → ETH auto
✓ Transfer 0.1 ETH auto
● Swap 1,500 USDC → ETH passkeyThe Docker command is exact; policy and transaction values above are illustrative, so set your own in the wizard.
Frequently Asked Questions
Related research
Web3 Companion: The Open-Source Secure Agentic Wallet
The full security design behind Web3 Companion: the OpenClaw incident, the five design principles, and how private-key isolation works end to end.
Read researchAgent-Native Crypto Compliance: Build KYA/KYT with x402
How the compliance data behind Web3 Companion's Counterparty Assessment check connects to BlockSec x402's institutional-grade risk intelligence, and what pay-per-request compliance checks look like for AI agents and trading systems.
Read researchAI Trading Security: The Evolution of Risk in the Age of Intelligent Trading
A broader look at the risks autonomous trading agents introduce, and how security has to evolve alongside them.
Read researchReady to try it?
Deploy Web3 Companion on your own infrastructure, or talk to our team about production hardening and enterprise compliance.
Web3 Companion is an open-source research preview. It has not completed a comprehensive production security audit. Use at your own risk before deploying with real funds.