How Aligned, Privy, Dynamic, Turnkey, and Magic compare
Summary
A small group of established providers leads wallet-as-a-service solutions (WaaS) on Ethereum, including Aligned , Privy, Dynamic, Turnkey, and Magic. All are non-custodial and primarily compete on four things: how they secure the key, how they handle accounts and gas, how much of the stack they cover, and who owns the company.
For a consumer app or a financial institution building on Ethereum, the wallet is the integration you most want to get right the first time. It’s what users touch directly and trust with their funds, and it signs every transaction they make. It’s also the decision that compounds: once people hold balances, switching providers means migrating live accounts, so getting it right early pays off most.
Today’s leading WaaS providers look almost identical on the surface. They’re all non-custodial, and they all spare users the crypto mechanics: no seed phrase, no gas token, no contract prompts to approve. The differences that shape an integration sit underneath: the key-security model, how accounts and gas work, how much of the stack comes from one vendor, and who owns that vendor.
WaaS Provider Key security model Account model Stack scope Ownership
Aligned The user’s key stays on their device (e.g. a passkey), and Aligned co-signs. Both signatures are required, and the account contract checks them on-chain EIP-7702 smart account, no bundler or paymaster Wallet + ZK rollup + proof aggregation + interoperability Founded by LambdaClass veterans
Privy Shamir 2-of-2: one share in a secure enclave (TEE), one stored by Privy, both on Privy’s side; reassembled in the TEE EOA by default; optional ERC-4337 smart wallets from third-party providers, with the EOA as signer; EIP-7702 authorizations supported Wallet only Stripe
Dynamic TSS-MPC (2-of-2 / 2-of-3), server share in a TEE EOA with native EIP-7702 smart-account features and gas sponsorship Wallet + auth + external-wallet connectors Fireblocks
Turnkey Keys held in a secure enclave (TEE), with a policy engine that checks every signature Signing layer where you build the account (ERC-4337 + EIP-7702 supported) Signing / key-management layer Independent
Magic Secure enclave (TEE), a cloud key-management service, and key sharding EOA + EIP-7702 smart account (via Alchemy) Wallet only Wallet business being acquired by Payward , Kraken’s parent company
Top wallet-as-a-service providers on Ethereum
The field of credible wallet providers is small but far from uniform. Each was built around a different priority, and they overlap enough to blur together. Understanding what each one is keeps the biggest name from standing in for the best fit.
Aligned: Independent, founded by the team behind LambdaClass , and the only provider in the group focused exclusively on Ethereum: it runs on Ethereum L1 and on ZK rollups built with ethrex , while the others prioritize multichain reach. Every account is an EIP-7702 smart account that requires two signatures : one from the user’s key on their device and one from Aligned’s backend. It ships as part of a larger stack, with the rollup, proof aggregation, and interoperability all coming from the same team. Sovra runs identity for 8M+ people on it.
Privy ( Stripe ): The most widely deployed of the group by self-reported counts, with 200M+ accounts and customers like Hyperliquid and Ramp. It splits each key into two Shamir shares, both held on Privy’s side (one inside a secure enclave), and reassembles the key only inside the enclave . Its default EOA wallet can be upgraded in place through EIP-7702, or act as the signer of a separate ERC-4337 smart wallet. It carries several independent audits plus SOC 2 Type I and Type II .
Dynamic ( Fireblocks ): As much a login-and-wallet-connection platform as an embedded wallet, with a wide range of sign-in methods and connectors to 800+ external wallets . That fits apps where plenty of users already have a wallet, alongside those who need one made. Its keys use threshold-signature MPC . Customers have included Kraken and Ondo .
Turnkey: The signing and key-management foundation other wallets build on . It generates and uses raw private keys inside secure enclaves, with a policy engine that checks every signature. Of the enclave-based providers, Turnkey is the one that lets you verify the enclave itself: reproducible builds and remote attestation confirm the exact code that touched the key. Independent, founded by an ex-Coinbase Custody team. Customers include Bridge and Polymarket .
Magic: The oldest of the group, launched in 2018 and known for email-first onboarding. It protects keys with a mix of secure enclaves, a cloud key-management service, and sharding, and it holds the widest set of compliance certifications in the group: SOC 2, SOC 3, and ISO 27001 . Its wallet business is being acquired by Payward , Kraken’s parent company, in a deal agreed in July 2026.
What you trust with wallet-as-a-service providers
Most top WaaS solutions today are non-custodial, meaning they can’t move users’ funds without their consent. But that label covers a wide range: how much you trust the provider depends on how it handles the private key, and that trust underpins what you can promise users about their money. The clearest divide is whether the full key is ever assembled in one place, and it splits these solutions into two camps.
Keys reconstructed in secure hardware
All three bring the full key together inside secure hardware, and they differ only on when. Privy splits it into two Shamir shares (not MPC), both held on its side, and reassembles them in a TEE at signing. Magic does the same with a TEE, a cloud key-management service, and sharding. Turnkey skips reassembly, keeping raw keys inside secure enclaves full-time behind a policy engine. Either way, the enclave exposes the full key, so its integrity is the security boundary.
Each gives you a different way to trust that boundary. Turnkey makes the enclave verifiable through open-source enclave code, reproducible builds, and remote attestation , so you can confirm the exact code handling the key. Privy leans on outside audits from Cure53, Zellic, and Doyensec , and Magic on the widest set of certifications in the group, SOC 2, SOC 3, and ISO 27001.
Keys that are never assembled
Dynamic and Aligned take the enclave out of the picture: no single key can move funds on its own, and they get there two ways. Dynamic uses threshold-signature MPC, where independent parties each hold a share and sign jointly, so no machine, Dynamic’s included, ever holds a spendable key. Aligned uses two separate keys and requires both to sign. The user’s key stays on their device (a WebAuthn passkey, a P-256 key, or an ECDSA key), Aligned’s key stays on its backend, and the account contract checks both signatures on-chain before it executes anything. Passkeys are verified on-chain as P-256 signatures inside the WebAuthn envelope. A breach of Aligned’s backend doesn’t move funds, and neither does a stolen device on its own.
The trade-off to plan for is availability: a signature needs a second party online. The two handle that differently. Dynamic’s 2-of-3 option lets any two of the three shares sign, so one being offline won’t lock the wallet. Aligned’s 2-of-2 doesn’t have that cushion: every transaction needs Aligned’s co-signer, so access depends on its backend staying reachable. For lost devices, Aligned offers optional guardian recovery: the guardian is set per app, and the timelock per account. The guardian can add a new key to an account, but that key can’t sign until a timelock expires (1 to 14 days, fixed when the account is created), which leaves a window to cancel an unwanted recovery. Accounts created without a timelock have no guardian.
One more point of trust sits above the accounts themselves. Aligned accounts route through a beacon contract, one per app, and the beacon’s owner can rotate the signers and point accounts to a new implementation without touching each one. That makes upgrades and key rotation simple to operate, and it means teams should know who controls the beacon for their app.
Account abstraction on wallet-as-a-service: EIP-7702 vs. ERC-4337
On its own, an Ethereum account is bare: a user needs ETH to do anything, every action is a separate approval, and losing the key means losing the funds. Account abstraction lifts those limits by giving the account programmable logic, so a product can cover gas for users, batch several steps into one confirmation, and offer recovery. All of them do this. They differ in the underlying standard, and providers are split between them.
ERC-4337 is the longest-running route, and Privy’s smart wallets build on ERC-4337 . It works entirely at the application layer: user actions become “UserOperation” objects that a separate mempool and “bundler” services collect, batch, and submit through a shared EntryPoint contract, with an optional paymaster covering gas. Because it needs no change to Ethereum itself, it went live on Ethereum mainnet in March 2023 and now has the deepest audit and tooling history of any account-abstraction approach.
That maturity comes with operational overhead. Each user needs a separate smart-contract account deployed and maintained, and much of the market reaches 4337 through shared third-party middleware such as ZeroDev . It’s a well-worn path, and it also puts a common external layer in the critical signing path for many apps at once, which is worth weighing at institutional scale.
Aligned builds on EIP-7702 , a 2025 protocol change that landed in Ethereum’s Pectra upgrade . It lets an ordinary account (an EOA) point to contract code and run it directly, so a user’s existing address gains smart-account behavior without deploying a second account alongside it. Aligned uses 7702 on its own, with no 4337 EntryPoint, bundler, or paymaster: its backend submits each transaction and pays the gas, so users never need to hold ETH or the chain’s native token. The result is leaner: one address, nothing extra to deploy or fund, and no third-party middleware between the user and the chain. Because it depends on 7702, it runs only on chains that have adopted Pectra.
The two standards side by side:
ERC-4337 EIP-7702
What it is An application-layer standard: smart-contract accounts with their own transaction flow (UserOperations, bundlers, an EntryPoint contract) A protocol change, activated in Ethereum’s Pectra upgrade (May 2025), that lets an existing EOA run smart-contract code
Account and address A new contract account at a new address, controlled by the user’s key The user’s existing address gains smart-account behavior
Deployment Each account is a contract deployed onchain, usually on first use No separate account to deploy: the EOA signs a delegation to contract code
Who submits transactions Bundlers collect UserOperations and submit them through the EntryPoint The user or any relayer sends a standard transaction to the account
Gas sponsorship A paymaster contract Whoever submits the transaction pays, so a relayer can cover gas
Live on Ethereum mainnet since March 2023 May 2025
EIP-7702 and ERC-4337 aren’t mutually exclusive: Privy signs 7702 authorizations for any implementation, Dynamic and Magic now offer 7702-based smart accounts, and Turnkey, as a pure signer, handles both transaction types and leaves the account model to you. Which one fits depends on whether a team wants established 4337 tooling or a simpler account with fewer moving parts.
Renting vs. building your wallet-as-a-service stack
Providers also differ in how much of the wallet you build yourself. The options fall on three levels, from a bare signing primitive you wrap in your own code to a full stack that arrives assembled. Where a provider sits decides how many vendors you take on and how independent the pieces of your stack stay.
Turnkey sits lowest, by design. It hands you a signing and key-management foundation and leaves the account-abstraction layer, gas handling, and smart-account logic for you to build. That’s the most work and the most control. Your wallet logic stays independent of any one chain or vendor, and signing sits behind a boundary you can attest. Teams with their own engineers often start here for that reason.
Privy, Dynamic, and Magic sit in the middle, as full embedded-wallet SDKs. They handle onboarding, key security, and gas, while you bring the chain and settle wherever you like. Dynamic leans hardest into authentication and wallet connection, with 800+ external-wallet connectors, so it suits apps where many users show up with a wallet already.
Aligned sits at the other end and sells the most in one piece: the wallet plus a rollup and proof aggregation, with interoperability, all from one team. Its ZK rollups are built with ethrex, the Rust Ethereum client from LambdaClass, and settle on Ethereum. That folds several procurement and integration decisions into one, and removes the seams between those layers.
It also concentrates your dependencies. The wallet, chain, and settlement all come from one provider, so they move together on a single roadmap and a single uptime, and more of your stack rides on one vendor. An institution gets one supplier to vet, and one point of dependence to weigh in return.
Who should pick what
Turnkey fits teams with their own engineers who want to build the wallet themselves on top of a signing layer they can attest.
Privy fits consumer apps that want the most widely deployed embedded wallet by self-reported counts and a long audit record behind it.
Dynamic fits apps where many users already have a wallet, and where login and wallet connection matter as much as creating new wallets.
Magic fits teams that need email-first onboarding and the broadest set of compliance certifications.
Aligned fits fintechs and institutions building financial products on Ethereum that want the wallet, the chain, and settlement from one team, with an on-chain signing rule and no third-party middleware in the transaction path.
The bottom line
A wallet provider is a long-term dependency, so the decision comes down to a few things each team has to settle: how much to trust a provider with key handling, how much of the account and gas experience to hand off, and how much of the stack to source from one vendor.
The demo won’t decide it for you, because they all deliver the same clean experience: no seed phrase, no gas token, a smooth login. Their real differences sit underneath, in the two choices hardest to reverse once users hold funds: how the key is secured, and how much of the product leans on a single company. Past that, the best fit depends on what you’re building and what stage it’s at.
Disclosure: This article was written by Aligned, one of the providers it compares. It is for informational purposes only and is not financial, legal, or security advice. Provider details, figures, and ownership information were checked against public sources as of November 2026 and may change; teams should confirm them with each provider before choosing one.
FAQ
What is a wallet-as-a-service provider?
Infrastructure that embeds a wallet inside an app through an SDK. Users get a wallet when they sign in, with no extension to install and no seed phrase to write down.
Are embedded wallets custodial?
All five providers in this comparison are non-custodial. What changes is how each one secures the key: Privy, Magic and Turnkey bring the full key together inside secure hardware, while Dynamic and Aligned never assemble a key that can move funds on its own.
What is the difference between EIP-7702 and ERC-4337?
ERC-4337 adds smart accounts at the application layer, using bundlers, an EntryPoint contract, and paymasters. EIP-7702 is an Ethereum protocol change that lets an existing address run smart-account code directly, with nothing extra to deploy.
Do users need ETH to pay for gas?
No. Every provider in the group can cover gas for the user. ERC-4337 setups usually do it with a paymaster. Aligned uses a relayer to submit each transaction and pay the gas.
What happens if a user loses their phone?
It depends on the provider. With Aligned, users can add a passkey on each device, and an account can also have an optional guardian with a timelock, which gives the owner time to cancel a recovery they did not start.
Which wallet-as-a-service provider is best for a fintech building on Ethereum?
It depends on what the team wants to own. Turnkey hands teams a signing layer to build their own wallet on, and Dynamic suits apps where many users already hold a wallet. Privy and Magic both offer embedded wallets for consumer apps, with Privy supporting a broad range of sign-in methods and Magic centered on email-first onboarding. Aligned is designed for teams building financial products on Ethereum that want a single integration for wallet, chain, and settlement.
