Crypto Custody

What Is Crypto Custody?

Crypto custody refers to how and where digital assets are stored, secured, and accessed. Because ownership on a blockchain is determined by who controls the private keys (the cryptographic credentials that authorize transactions), custody is fundamentally about key management. Lose the keys, and the assets are gone forever. Have the keys stolen, and the assets can be taken instantly and irreversibly.

This is a departure from traditional finance, where custodians hold assets within regulated ledger systems and lost credentials can be recovered through identity verification. In crypto, there is no password reset. The phrase "not your keys, not your coins" captures the core principle: if you delegate key control to a third party, you hold an IOU, not a bearer asset.

Custody solutions exist on a spectrum. Individual users may opt for self-custody through hardware or software wallets. Institutions typically require regulated third-party custodians that provide insurance, compliance infrastructure, and operational controls. The right choice depends on the use case, regulatory requirements, and risk tolerance.

How It Works

All crypto custody ultimately comes down to one question: who holds the private keys, and how are they protected? The answer determines the custody model.

Self-Custody

In self-custody, the asset owner generates and stores their own private keys. No third party can access, freeze, or seize the funds. This provides maximum sovereignty but places full responsibility on the owner for security, backup, and recovery.

Self-custody wallets range from mobile apps (hot wallets) to dedicated signing devices (cold storage) and air-gapped hardware that never connects to the internet.

Third-Party Custody

Third-party custodians hold private keys on behalf of clients. Institutional custodians operate under regulatory frameworks, maintain insurance policies, implement access controls, and undergo regular audits. This model sacrifices some sovereignty in exchange for operational simplicity, regulatory compliance, and professional key management.

Wallet Temperature Models

Custodians categorize wallets by their internet connectivity, which directly correlates with both accessibility and attack surface:

Most institutional custodians keep the majority of assets in cold storage, with smaller allocations in hot or warm wallets for daily operational needs. Transactions from cold storage typically require multi-person approval workflows and physical access to signing devices.

Key Management Approaches

The technical architecture of how keys are generated, stored, and used defines the security profile of a custody solution. Three approaches dominate institutional custody:

• Hardware Security Modules (HSMs): tamper-proof physical devices that generate and store private keys in a secure enclosure. Keys are created inside the HSM and never leave it, enforcing security through hardware isolation.
• Multi-Party Computation (MPC): a cryptographic technique that distributes key shares across multiple independent parties. No single party ever has access to the complete private key. Transactions require a threshold of parties to cooperate, eliminating single points of failure. For a deeper comparison, see the MPC vs. multisig custody analysis.
• Multisig: a wallet requiring approval from multiple independent private keys to authorize a transaction (for example, 2-of-3 or 3-of-5). If one key is compromised, it is insufficient to move funds.

In practice, these approaches are often combined: each MPC party may store their key share inside a dedicated HSM, layering cryptographic distribution on top of hardware isolation.

// Conceptual MPC signing flow
// 3-of-5 threshold: any 3 key holders can authorize

const keyHolders = ["party_a", "party_b", "party_c", "party_d", "party_e"];
const threshold = 3;

// Each party generates a partial signature independently
// No party ever reconstructs the full private key
const partialSigs = await Promise.all(
  selectedParties.map(party => party.computePartialSignature(txHash))
);

// Combine partial signatures into a valid transaction signature
const finalSignature = mpc.combinePartialSignatures(partialSigs);
const signedTx = transaction.applySignature(finalSignature);

Institutional Custody Requirements

Institutional custodians must meet rigorous operational, regulatory, and insurance standards that go far beyond secure key storage.

Regulatory Compliance

In the United States, the SEC's qualified custodian rule (Investment Advisers Act Rule 206(4)-2) requires registered investment advisers to maintain client assets with a qualified custodian. Qualified custodians include federally regulated banks, registered broker-dealers, and state- chartered trust companies meeting specific conditions.

The OCC has been granting national trust bank charters to crypto custodians: Anchorage Digital received approval in January 2021, BitGo and Fidelity Digital Assets in December 2025, and Coinbase received preliminary conditional approval in April 2026. In March 2025, OCC Interpretive Letter 1183 confirmed that crypto-asset custody is a permissible activity for national banks.

In the EU, the Markets in Crypto-Assets (MiCA) regulation established a unified framework for digital assets, with an absolute compliance deadline of July 1, 2026 for all crypto-asset service providers.

Insurance and Audits

Institutional custodians carry crime and specie insurance policies, typically covering theft, private key loss, and insider malfeasance for assets in cold storage. Coverage amounts vary by provider:

• Evertas (Lloyd's coverholder): up to $420 million per policy
• BitGo: up to $250 million through Lloyd's of London
• Crypto.com Custody: $120 million arranged through Aon and Lloyd's
• Fidelity Digital Assets: in excess of $100 million per claim

Custodians also undergo SOC 2 Type II audits from independent accountants, examining whether operational controls are suitably designed and operating effectively over extended periods. Segregation of client assets from the custodian's own holdings is a fundamental requirement, a lesson reinforced by the FTX collapse where commingled customer funds led to billions in losses.

Major Custody Providers

The institutional custody landscape includes both crypto-native firms and traditional financial institutions. For a comprehensive comparison, see the Bitcoin custody solutions comparison.

Traditional banks are also entering the space. The rescission of SEC Staff Accounting Bulletin 121 in January 2025 (replaced by SAB 122) removed the requirement for banks to record custodied crypto as liabilities on their balance sheets, eliminating a major barrier to entry. Citigroup announced plans to launch crypto custody services in 2026, joining BNY Mellon and Standard Chartered.

Use Cases

• Individual investors storing Bitcoin or stablecoins in self-custody wallets for long-term holding
• Crypto exchanges maintaining hot, warm, and cold wallet tiers to balance withdrawal speed with security
• ETF issuers using qualified custodians to hold Bitcoin and Ethereum on behalf of fund shareholders
• Corporate treasuries holding digital assets under institutional custody with insurance and regulatory compliance
• Fintech platforms integrating embedded wallets to offer users custody without exposing them to key management complexity
• Payment networks like Spark enabling self-custodial asset transfers while maintaining the user experience of custodial services. See the self-custodial vs. custodial wallets comparison for how these models differ in practice.

Risks and Considerations

Self-Custody Risks

Self-custody places the full burden of security on the user. Lost seed phrases, damaged hardware, and phishing attacks can result in permanent loss with no recourse. The irreversibility of blockchain transactions means mistakes cannot be undone.

Third-Party Custody Risks

Delegating custody introduces counterparty risk. The collapse of FTX in 2022 (over $10 billion in customer funds lost due to commingling) and the Mt. Gox failure in 2014 (approximately 850,000 BTC lost) demonstrated the catastrophic consequences of custodian failure.

Even sophisticated custody setups are not immune: in February 2025, the Bybit hack resulted in approximately $1.5 billion in Ethereum stolen when attackers compromised a third-party service used for moving tokens from cold to warm storage, injecting malicious code into the transaction signing process.

Regulatory Uncertainty

Custody regulations vary significantly across jurisdictions and continue to evolve. What qualifies as a "qualified custodian" differs between the SEC, state regulators, and international frameworks like MiCA. Custodians must navigate overlapping compliance requirements while the regulatory landscape shifts. For more on how regulation is shaping the custody market, see the institutional self-custody shift analysis.

Insurance Gaps

Even the largest custody insurance policies cover a fraction of the assets under management. Coverage typically addresses theft and key loss but excludes market volatility, protocol-level bugs, user errors, and loss from regulatory action. The gap between insured and total custodied value remains significant across the industry.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.