A remote wallet protocol is a communication layer that lets an application ask a wallet to perform actions over a network connection. Those actions can include creating payment requests, signing transactions, approving transfers, or returning account state. Instead of calling a local wallet process directly, the app must cross a trust boundary and rely on network messages, authentication, and access control.
This matters because wallets hold signing authority. If the protocol is exposed to the internet, a bug, weak authentication, or poor network filtering can let an attacker request unauthorized actions and potentially move funds. In attacks, the protocol becomes the control plane: abuse may come through crafted requests, replayed messages, or session hijacking. Defensively, operators should restrict exposure, require strong authentication, limit which clients can connect, and log every sensitive request. In self-custody systems, the protocol is as security-critical as the keys themselves.