Deposit-address swaps, explained: how a cross-chain swap works without connecting a wallet

Arnold Tsing — Fri, 06 Nov 2026 17:22:56 +0000

Most people meet cross-chain swaps through a "connect wallet" button. You approve a token allowance, sign a transaction, and hope the contract on the other side does what the UI promised. There is a second execution model that predates most of DeFi and is still how a large share of retail swaps actually settle: the deposit-address swap. This post explains how it works under the hood, where its risk surface is genuinely smaller, and where it is not.

The two execution models

Wallet-connected swaps keep your keys in the loop the whole time. Your wallet signs an approval and a swap transaction against a contract (or an aggregator that routes through contracts). You never "send money to a website", but you do grant contracts spending rights over your tokens, and the swap executes inside your transaction.

Deposit-address swaps split the exchange into two ordinary transfers:

The service quotes you a rate and generates a single-use deposit address on the source chain, bound to your order.
You send the source asset to that address from any wallet or exchange account — no connection, no approval, no signature beyond the transfer itself.
Once the deposit confirms, the service executes the trade on its side (typically by letting market makers bid on the route) and pays the destination asset to the payout address you specified.
If anything in the order cannot execute — wrong asset, expired quote conditions, a failed leg — the deposit is refunded to your refund address automatically.

That is the entire protocol. The "smart" part is not a contract; it is order state management: matching an inbound transfer to an order, executing against liquidity, and paying out.

Why the risk surface is different (not just "smaller")

With wallet-connected swaps, the dominant risks are approval risk (a malicious or later-exploited contract draining an unlimited allowance) and signing risk (blind-signing a payload you did not fully parse). Both have produced nine-figure losses, and both disappear in the deposit model: there is no allowance to exploit, and the only signature you ever produce is a plain transfer you initiate yourself.

The deposit model has its own, different risks, and it is worth being precise about them:

Counterparty/custody window. Between your deposit confirming and the payout landing, the service holds your funds. The window is minutes, not days, but it is real. You are trusting the operator's solvency and honesty for that window — the same trust model as an instant-exchange, because that is what this is.
Address errors are on you. Send the wrong asset, or the right asset on the wrong chain, and recovery depends on the operator's tooling (many publish a wrong-address recovery policy). A contract swap would simply have reverted.
Quote risk. A good implementation shows you a minimum received amount in the all-in quote before you send — fees and expected slippage included — and refunds rather than re-quotes you silently if the market moves beyond it. If a service only shows an "estimated" rate with no floor, that is where your risk concentrates.

A fair summary: wallet-connected swaps minimize counterparty trust and maximize signing/approval risk; deposit-address swaps do the opposite. Which trade-off is right depends on the user, the amount, and whether the source funds even live in a self-custody wallet (funds sitting on a centralized exchange cannot "connect" to anything — a deposit transfer is the only option).

What a good quote should show you

Before sending anything, you should be able to see, in one place:

The exact input amount and the minimum output amount (not just an estimate)
The service fee as a number, not buried in the rate (a transparent example: a flat 0.25% fee schedule)
The deposit deadline and what happens on expiry
The refund address the funds return to if execution fails

If any of those are missing, you are not looking at a quote — you are looking at an advertisement.

When each model wins

Deposit-address swaps are the pragmatic choice when funds start on an exchange, when the destination chain has no mature DEX liquidity, when you want zero approvals touching a cold wallet, or when you are integrating programmatically — the model maps cleanly onto a REST API (create order → get deposit address → watch status), which is how aggregators embed it; see a typical API quickstart for the shape of that flow.

Wallet-connected swaps win when you want settlement atomicity, when amounts are large enough that even a minutes-long custody window matters, and when deep on-chain liquidity exists on both sides.

Neither model is "the future" to the exclusion of the other. But if your mental model of swapping starts and ends with a connect button, it is worth knowing the older machine is still running a lot of volume — and exactly which risks it trades away, and which it keeps.

I work with AllSwap, a non-custodial cross-chain swap service built on the deposit-address model described above (46 chains, no account, no KYC). Longer comparison of swaps vs. bridges: Cross-Chain Swap vs Bridge.

DEV Community: Arnold Tsing

Deposit-address swaps, explained: how a cross-chain swap works without connecting a wallet

The two execution models

Why the risk surface is different (not just "smaller")

What a good quote should show you

When each model wins