Rabby Wallet for Ex-Employees: Why Outgoing Startup Staff Should Switch to Watch-Only Before Leaving Company Treasury Access

A blockchain-based startup has a technical founder, a CFO managing treasury operations, and a developer who was responsible for signing transactions. That developer is leaving the company to start a competing venture, but the wallet setup problem is not straightforward. The private keys exist on a hardware device controlled by the departed employee, the seed phrase may have been written down and stored in multiple locations, and the wallet software still recognizes their device on the company network. Before the separation is complete, the company needs to understand which funds remain accessible to the departing team member and which ones should transition to read-only observation without changing the underlying security architecture.

The core tension is practical rather than exotic. A departing employee with access to cryptocurrency private keys or signing authority represents custody risk, not merely as a personal integrity question but as an operational vulnerability. A watch-only wallet configuration allows the ex-employee to monitor balances and transaction history without approving transfers or changing settings. This preserves the operational value of their involvement—they can still observe the portfolio—while eliminating the security exposure. The challenge is implementing that transition cleanly, documenting the migration, and verifying that the arrangement actually works as intended before the employment relationship ends.

Why private key control becomes critical at departure time

During normal operations, a startup’s internal treasury may work acceptably with informal key management. A founder, CFO, and technical lead might each hold one hardware wallet, with no formal rotation policy and loose documentation of who can do what. That arrangement assumes continuity and good faith. When someone leaves, it stops working. The departing person’s hardware wallet still functions. Their recovery phrase, if written down, remains valid. Their access permissions on multisig vaults or institutional wallets do not automatically expire. A company that wants to remain in control of its assets must explicitly revoke these connections before the person walks out the door.

The legal and technical models here diverge. A departing employee’s contract may include clauses about return of company property and forfeiture of access, but a hardware wallet is physical property that the person owns, even if it holds company funds. A seed phrase written in a personal notebook is similar. The blockchain itself has no concept of employment termination; it does not care whether a private key holder still works at the company. A transaction signed by that key is valid regardless of the signer’s status. Therefore, the security procedure must address the wallet technology directly rather than relying on employment agreements to protect cryptographic access.

This is not a hypothetical risk. Cryptocurrency theft by departing employees has occurred in enough real cases to make it a standard part of institutional security discussions. The scenarios include transferring funds before the departure is finalized, selling company assets at unfavorable rates, transferring treasury access to a personal account, or simply withholding signing authority until demanding payment. Even if the departing employee has no intent to cause harm, their loss of device, compromise of their backup, or careless sharing of sensitive information could expose company funds to outside theft. From a custody perspective, the goal is to ensure that only active employees with current operational need can approve transactions.

Hardware wallets and institutional access structures

Rabby Wallet’s support for hardware wallets including Ledger, Trezor, GridPlus, OneKey, Keystone, BitBox02, CoolWallet, and AirGap Vault creates flexibility in how a startup manages treasury access, but flexibility also introduces configuration decisions. A hardware wallet in the departing employee’s possession is a permanent access point until either the wallet is destroyed or the funds are moved to a different custody model. Some companies request that employees return hardware wallets to a secure facility when they leave. Others require that key material be rotated entirely—that is, the company generates new wallets using fresh seed phrases and hardware, then transfers all funds from the old setup to the new one.

Institutional wallet integrations such as Safe, Cobo, Argus, Amber, Fireblocks, Jade Wallet, and MPCVault offer better separation. These systems typically use multisignature setups where no single person holds all signing authority. When an employee leaves, the company can remove their signing permission from the smart contract or institutional backend without needing to rotate keys or move funds. The departing person’s hardware wallet still exists, but the institutional wallet no longer grants it authority to approve transactions. This is a more robust model because it centralizes access control in the protocol layer rather than depending on key material recovery or destruction.

The transition should be documented in writing before implementation. A checklist that names each person’s current role, the keys or signing authority they hold, the location of hardware wallets, and the method for revoking access ensures that nothing is overlooked. If the company uses a Safe multisig, the checklist should specify which signer address belongs to the departing person and how it will be removed. If access is through Fireblocks or Cobo, the equivalent step should be listed. Once the departing person’s authority is formally revoked at the institutional level, the company is protected even if that person’s personal device still holds old key material.

Converting active access to watch-only observation

A watch-only wallet is a powerful tool for this transition because it allows the departing employee to retain visibility into company finances without holding signing authority. In Rabby Wallet, watch-only functionality can be implemented by importing addresses without private keys. The person can see balances, transaction history, and portfolio composition across multiple chains and tokens, but they cannot create transactions or change settings. This is useful for several reasons: it allows the departing person to verify that their own access has been revoked (the portfolio is visible but they cannot move funds), it preserves their ability to assist with operational questions during a transition period, and it documents clearly what view they have been granted after leaving.

To set up watch-only access correctly, the process should begin while the employee is still active. The company generates a list of all addresses that hold company funds—this includes token recipients from airdrops, vault addresses, contract-based treasury accounts, and any other blockchain location with company assets. These addresses are then imported into Rabby Wallet as watch-only addresses. The departing person is given access to a Rabby Wallet instance that includes only these watch-only imports and is instructed that this is their sole permitted access after departure. Critically, this instance should not include the departing person’s hardware wallet or any ability to create new transaction approvals.

The verification step is essential. Before the person’s last day, the company should test that the watch-only setup actually works—that balances load, that transaction history is visible, and that the person cannot interact with any signing mechanism. Testing in production with a small transaction is one option: if the departing person can see the movement in the watch-only wallet but cannot themselves approve transactions, the setup is correct. This verification should be done in front of a witness, preferably someone from operations or finance, and documented with a date and signature.

Revoking access to multisig vaults and WalletConnect connections

If the departing employee’s access is through a multisig vault such as Safe or an institutional wallet connected via WalletConnect, the revocation process is different from hardware wallet key rotation. The company should explicitly remove the departing person’s signer address from the multisig contract. This is a transaction in itself, typically requiring approval from the existing signers. The Safe wallet UI, for example, allows removing a signer and setting a new threshold if needed. Once that transaction is executed on-chain, the departing person’s signer address can no longer approve transactions, even if they still have access to the hardware wallet that controls that address.

For employees who connected mobile wallets via WalletConnect—MetaMask Mobile, Trust Wallet, TokenPocket, imToken, Math Wallet, Rainbow, Bitget Wallet, or Zerion Wallet—the revocation is software-based. The WalletConnect session is a connection between the phone wallet application and the treasury application or website. When the person leaves, the company should disconnect that WalletConnect session. This is typically done from the treasury application’s settings or the Rabby Wallet instance, not from the person’s phone. Once the session is disconnected, the person’s phone wallet cannot sign transactions on behalf of the company, though the wallet application itself still works for their personal use.

The documentation here is critical. A spreadsheet listing each person, their departure date, their connection method (hardware wallet, WalletConnect, institutional vault signer address, etc.), and the date that access was revoked becomes the audit trail. If a fund transfer occurs after a departing person’s access was supposedly removed, this documentation helps establish a timeline and identify where the revocation failed. Companies should keep this log for at least two years in case disputes arise later.

Handling contact management and address books

Rabby Wallet’s contact management feature, which stores frequently used addresses and labels, should also be reviewed during departure. If the departing person has a long list of frequent counterparties—exchanges, vendors, other company accounts—those contacts may remain in their local Rabby Wallet instance after they leave. This is not a direct security risk, but it can create confusion. The company should maintain its own master address book for treasury operations, separate from individual wallet instances. When a person departs, their personal contact list leaves with them. The company’s master address book remains in the custody of active finance or operations staff.

The watch-only instance provided to the departing employee should ideally include only the addresses necessary to observe company holdings. Adding unnecessary contacts or creating an elaborate address book in a watch-only wallet for a departed person is operationally messy and raises questions about what access they still retain. Simpler is better: the watch-only wallet imports the company’s treasury addresses and perhaps a handful of the most frequent counterparties, but it does not become a full financial management interface.

Migration from informal to institutional custody models

Many startups begin treasury management with informal setups—a founder with a hardware wallet, perhaps a CFO with a second hardware wallet, and shared documentation in a spreadsheet. This works until the first departure. At that point, companies often realize that upgrading to a more formal institutional model would reduce risk. Rather than managing multiple individuals’ hardware wallets and worrying about key rotation, a startup can move treasury funds into a Fireblocks, Cobo, or Safe multisig environment where employees have roles and permissions rather than direct cryptographic access.

The migration itself is a multi-step process. The company generates new addresses in the institutional system, transfers existing funds to those addresses, and verifies that the new setup works correctly. Once balances are confirmed in the new system, the old individual hardware wallets can be removed from operational use. Employees are then granted roles in the institutional system—signer, approver, viewer, etc.—rather than direct hardware wallet access. When someone leaves, the company simply removes that person’s role without moving any funds or rotating keys. This is why larger startups and established institutions prefer institutional custody: it scales departure and onboarding processes without constant key management.

The choice to upgrade should be made proactively, before people leave, not in crisis mode afterward. A startup with three to five employees managing treasury might not need Fireblocks, but once the team grows to ten or more, or once the treasury balance exceeds several million dollars, a formal system becomes cost-effective. The cost of institutional wallet services is typically much lower than the cost of a fund loss from poor access control or the distraction of managing key material manually.

Best practice checklist for departing employee access transitions

A concrete checklist reduces the chance of overlooking a critical step. First, conduct a complete access inventory: list every person with signing authority, private key access, or hardware wallet control, noting the location and type of each credential. Second, identify which departing person’s access needs to be revoked and create a plan specific to their access type—hardware wallet key rotation, multisig signer removal, WalletConnect disconnection, or institutional vault permission revocation. Third, set a specific date for the revocation to take effect, ideally aligned with the person’s last day, and designate responsible parties for each step.

Fourth, test the revocation in advance: confirm that the watch-only setup works and that the person cannot sign transactions. Fifth, execute the revocation and document it immediately with timestamps, names of witnesses, and transaction IDs where applicable. Sixth, distribute the documentation to finance, operations, and legal, with a copy retained in a secure archive. Seventh, conduct a final audit by checking blockchain records to confirm that the person’s addresses can no longer approve transactions. Eighth, if providing watch-only access, distribute that separately and confirm that the person has logged into the watch-only instance and verified it loads correctly.

This process can be completed in a day for a simple hardware wallet rotation, but institutional setups may take longer because multisig transactions require multiple approvals and block confirmations. Plan accordingly rather than rushing the last step of an employee’s tenure. A departing person who is asked to return their hardware wallet on their last day, without advance notice or clear explanation, may not cooperate fully. A process explained weeks in advance, with clear steps and a written handoff document, is more likely to be completed smoothly.

Watch-only wallets as operational documentation

Beyond security, a watch-only wallet instance serves a documentation function. A company can grant watch-only access to departing employees, auditors, accountants, or advisors who need to observe treasury activity but should never sign transactions. An accountant preparing tax filings needs to see transaction history and current balances but does not need signing authority. An advisor reviewing treasury strategy might need the same visibility without the responsibility of approving transactions. This is where Rabby Wallet’s flexibility becomes valuable: the same interface that departing employees use for monitoring can be deployed to any number of stakeholders, each seeing exactly what they need.

The implementation is straightforward. The company exports a read-only version of the treasury setup, importing only the addresses that the stakeholder should see. The stakeholder imports that configuration into their own Rabby Wallet instance via rabby-wallet.at, and they have immediate visibility into those balances and transactions. No private keys are shared, no signing authority is granted, and the company retains complete control of the actual cryptocurrency. If the stakeholder’s device is compromised, the compromise is limited to observation data, not to custody.

Why this matters more as companies scale

A solo founder with one hardware wallet does not need this level of process. But the moment a startup hires a second person to manage finances or operations, the question of who can move funds becomes critical. As teams grow and treasury balances increase, informal procedures become liabilities. Each departure without a clean access revocation leaves the company with uncertainty about who can still move funds. Each hardware wallet distributed without a formal inventory creates a risk that the location of key material is forgotten. Institutions managing hundreds of millions in treasury do not handle departures through informal conversation and hopes; they use institutional wallets, documented signing procedures, and auditable role-based access control.

The insight for growing startups is that the time to build proper custody procedures is now, before the next person leaves and creates an urgent problem. Implementing watch-only wallet access, testing multisig vaults, documenting hardware wallet locations, and establishing a formal access revocation procedure are not exciting or flashy activities. But they are the unglamorous work that separates companies that maintain control of their assets from those that discover too late that a departed employee still holds the keys.