DO NOT HAVE A WALLET/BITCOIN CLIENT ON YOUR WEBSITE.
instead have a database that stores withdrawal requests.. and then a secondary system that is remote, that reads the database to then process the withdrawals.
its not rocket science, its not a time-lag concern either, as its can be automated. it just protects customers funds because there would be no private keys on the website at all..
the added bonus of a withdrawal request database is that your website is then not API calling the remote hot-wallet, because using an API would allow hackers to plainly see the location of the remote system by reading the API.
instead data sits in the database, and the website has no code to highlight the remote system(hotwallet) at all its not pushing any data out.... separetly the remote system looks in to read the data.. rather than the website looking out.
analogy..
dont leave your car keys in the car door because its easier to unlock the door if you have the keys with your car at all times. instead get a keyfob to remotely unlock your car before you even get within 10 paces of the car.. the car will not tell burglars that your keyfob is in your pocket
How would you approach this?