Institutional Crypto Custody Providers Compared

Institutional Crypto Custody Overview

Institutional crypto custody has become the critical infrastructure layer for digital asset markets. Since the approval of U.S. spot Bitcoin ETFs in January 2024, custodians now safeguard hundreds of billions in assets for ETF issuers, hedge funds, family offices, and sovereign wealth funds. The five dominant providers in this space are Coinbase Custody, BitGo, Fireblocks, Anchorage Digital, and Copper.

Each provider takes a different approach to key management, regulatory licensing, and insurance. Some operate as chartered trust companies with qualified custodian status under SEC rules. Others function primarily as technology platforms that power custody for banks and exchanges. The following table provides a high-level comparison across the dimensions that matter most to institutional allocators.

Security Architecture and Key Management

The core differentiator between custody providers is how they protect private keys. Two dominant approaches have emerged: multi-signature wallets and MPC (multi-party computation) wallets. Each carries distinct tradeoffs in security, flexibility, and protocol support.

Multi-Signature Architecture

Coinbase Custody and BitGo both built their platforms on multi-signature schemes. In a typical 2-of-3 multi-sig configuration, three separate keys are generated and distributed across different environments. Any two keys must co-sign a transaction for it to be valid. This approach is native to Bitcoin and auditable on-chain, but it requires chain-specific implementations and produces larger transactions with higher fees. BitGo pioneered this model for institutional use and continues to support it alongside newer MPC wallets.

MPC and Threshold Signatures

Fireblocks, Anchorage, and Copper use MPC-based threshold signature schemes (TSS). In this model, a private key is split into multiple shards distributed across independent parties. The full key is never reconstructed at any point during signing. Fireblocks' proprietary MPC-CMP protocol reduces the signing process to a single communication round (compared to nine rounds in the earlier GG18 standard), with key shards stored inside Trusted Execution Environments for hardware-level isolation. Anchorage pairs MPC with hardware security modules (HSMs) and biometric quorum approval: sensitive operations require multiple authorized individuals to authenticate via biometrics before a transaction can proceed.

Cold Storage vs. Always-On Models

Traditional custody relies on cold storage: keys are kept in air-gapped environments disconnected from the internet. Coinbase and BitGo both use this approach, with transactions created online, transferred to offline signing environments via physical media, and then broadcast. Anchorage takes a different stance, arguing that MPC eliminates the need for cold storage entirely. Their "always-on" architecture keeps assets accessible while distributing key shards across geographically dispersed HSMs, aiming to combine the security properties of cold storage with the availability of hot wallets.

Regulatory Licenses and Qualified Custodian Status

For U.S.-registered investment advisers (RIAs), the SEC's Custody Rule (Rule 206(4)-2) requires client assets to be held by a qualified custodian. This is the threshold regulatory requirement for institutional adoption, and it shapes which providers can serve the largest allocators.

Anchorage holds the strongest single credential: it is the only federally chartered digital asset bank in the U.S., granted its OCC charter in January 2021. This gives it a nationwide operating scope without needing state-by-state licensing. The OCC lifted a consent order against Anchorage in August 2025, removing the last constraint on its expansion.

Coinbase secured OCC conditional approval for a federal trust charter in April 2026, adding to its existing NYDFS trust charter and BitLicense. BitGo holds qualified custodian status through its South Dakota and New York trust charters, and obtained a MiCA CASP license in Germany in 2024, positioning it for the EU market ahead of the July 2026 full enforcement deadline.

Copper's regulatory position is the weakest among the five. It withdrew its UK FCA license application in December 2024 and holds no U.S. or EU custody license. Its only active authorization is Swiss VQF membership for AML compliance. For institutions subject to KYC/AML requirements or regulatory mandates around qualified custodians, this is a material gap.

The Custody Landscape After Bitcoin ETF Approval

The January 2024 approval of spot Bitcoin ETFs transformed institutional custody from a niche service into systemically important infrastructure. U.S. spot Bitcoin ETFs amassed $147.5 billion in AUM within their first 21 months. BlackRock's IBIT alone held over 734,000 BTC by mid-2026.

Coinbase emerged as the dominant ETF custodian, securing custody agreements with 8 of the original 11 spot Bitcoin ETF issuers. By April 2026, roughly 84% of all U.S. spot Bitcoin ETF assets were held by Coinbase Custody. This concentration created systemic risk concerns across the industry.

The diversification response has been significant. BlackRock added Anchorage as a second custodian for its IBIT Bitcoin ETF in April 2025 and for its ETHA Ethereum ETF. Grayscale selected Anchorage over Coinbase for its HYPE ETF. ARK 21Shares filings now list Coinbase, BitGo, and Anchorage as custodians. This multi-custodian trend is likely to accelerate as more traditional asset managers enter the space.

The rescission of SAB 121 in January 2025 (replaced by SAB 122) removed the requirement for banks to record custodied crypto as balance-sheet liabilities. This opened the door for traditional banks to enter custody directly. BNY Mellon received SEC no-objection to custody crypto for spot ETF clients, and State Street announced digital asset custody platforms. For a deeper analysis of these custody models, see our Bitcoin custody solutions comparison.

Custody Requirements by Jurisdiction

Regulatory requirements for crypto custody vary substantially across jurisdictions. Institutions operating globally must navigate overlapping and sometimes conflicting regimes.

United States

RIAs must use a qualified custodian under SEC Rule 206(4)-2 for client crypto assets. In September 2025, a no-action letter confirmed that state-chartered trust companies can serve as qualified custodians for crypto under specific conditions. Due diligence requirements include SOC 2 Type II reports, audited financial statements, asset segregation agreements, and risk disclosures.

European Union (MiCA)

Under MiCA, crypto-asset service providers (CASPs) offering custody must segregate client assets from their own, maintain accurate real-time records of holdings, and bear liability for asset losses unless caused by force majeure. The minimum capital requirement for custody services is EUR 125,000. Full MiCA enforcement begins July 1, 2026.

Singapore

Singapore's MAS requires 90% of customer assets to be held in offline cold wallets, with segregated blockchain addresses per client and daily reconciliation. The minimum capital for a Major Payment Institution license is SGD 250,000. These requirements took full effect June 30, 2025 under the Financial Markets and Services Act.

Integration and API Capabilities

For institutions building automated workflows, API quality and integration depth are decisive factors. All five providers offer REST APIs for wallet management, transaction creation, and policy configuration.

Coinbase Prime provides REST, FIX, and WebSocket APIs with smart order routing across multiple liquidity venues. Fireblocks offers a programmable policy engine that allows institutions to codify governance rules (approval quorums, withdrawal limits, address whitelisting) directly into their API workflows. BitGo's developer portal covers wallet management, transaction policies, and stablecoin-as-a-service minting.

Copper's ClearLoop is unique in the market: it enables off-exchange settlement where assets remain in Copper custody while trading power is mirrored on integrated exchanges including Coinbase International, Deribit, OKX, Bybit, and Kraken. This eliminates counterparty risk from exchange insolvency, a capability that processes over $50 billion per month in notional volume.

How to Choose an Institutional Custody Provider

The right custodian depends on your regulatory obligations, operational requirements, and asset mix.

For U.S. ETF issuers and RIAs requiring qualified custodian status: Coinbase, BitGo, Anchorage, and Fireblocks Trust all qualify. Coinbase has the deepest ETF track record. Anchorage holds the only federal bank charter.

For European institutions planning for MiCA: BitGo is the strongest positioned with its Germany CASP license. Fireblocks supports DORA compliance for bank clients. Copper's lack of MiCA authorization is a risk factor.

For trading firms prioritizing exchange integration: Copper's ClearLoop offers a unique off-exchange settlement model that reduces counterparty exposure. Coinbase Prime provides deep native liquidity.

For asset breadth: BitGo leads with 1,550+ assets across 69 chains. Anchorage covers 1,800+ tokens. Coinbase supports 470+ assets on 52 chains. Fireblocks integrates with 100+ blockchains.

Many institutions now adopt multi-custodian strategies to avoid concentration risk, following BlackRock's model of splitting assets across Coinbase and Anchorage. For a broader comparison of custody approaches including self-custody options, see our custody comparison tool and the custody insurance comparison.

Note: For digital assets on Bitcoin, custody providers increasingly support Layer 2 protocols. Spark enables fast, low-cost transfers of Bitcoin and stablecoins like USDB while assets remain anchored to the Bitcoin base layer, offering institutional-grade settlement with programmable spending policies.

Frequently Asked Questions

What is a qualified custodian for crypto assets?

A qualified custodian is an entity authorized under SEC Rule 206(4)-2 to hold client assets on behalf of registered investment advisers. For crypto, this typically means a state-chartered trust company (like Coinbase Custody Trust Company or BitGo Trust), a federally chartered bank (Anchorage Digital), or a broker-dealer. The designation requires regular SOC audits, asset segregation, and regulatory oversight. Institutions managing client crypto without a qualified custodian face SEC enforcement risk.

Which custodian holds the most Bitcoin ETF assets?

Coinbase Custody holds approximately 84% of all U.S. spot Bitcoin ETF assets by dollar value as of April 2026. It serves as custodian for BlackRock's IBIT, Grayscale's GBTC, ARK 21Shares' ARKB, Bitwise's BITB, and several others. However, the industry is moving toward multi-custodian models: BlackRock added Anchorage as a second custodian in 2025, and other issuers have followed.

What is the difference between MPC and multi-sig custody?

Multi-signature custody uses multiple complete private keys and requires a threshold (such as 2-of-3) to co-sign transactions on-chain. It is natively supported by Bitcoin and produces verifiable on-chain signatures. MPC custody splits a single private key into shards distributed across multiple parties, with the full key never reconstructed during signing. MPC is chain-agnostic and produces standard single-signature transactions, but the security model depends on the implementation rather than on-chain verification.

How much insurance do crypto custodians carry?

Published insurance caps vary significantly. Copper carries the largest base policy at $500 million for cold storage assets. Coinbase covers up to $320 million. BitGo covers $250 million. Fireblocks holds a $1 billion aggregate policy but caps individual workspaces at $30 million. Anchorage does not publicly disclose its coverage amounts. All major policies are placed through Lloyd's of London syndicates. See our custody insurance comparison for a detailed breakdown.

Did the repeal of SAB 121 change crypto custody?

Yes. The SEC's SAB 121 (issued in 2022) required banks to record custodied crypto as on-balance-sheet liabilities, effectively making custody uneconomical for traditional banks. Its replacement by SAB 122 in January 2025 removed this requirement. This opened the door for major banks (BNY Mellon, State Street, Morgan Stanley) to offer crypto custody services. BNY Mellon has already received SEC no-objection to custody crypto for spot ETF clients.

What custody requirements does MiCA impose in Europe?

Under MiCA, CASPs providing custody must segregate client crypto-assets from their own holdings, maintain real-time records, and accept liability for asset losses. The minimum capital requirement is EUR 125,000. Providers must demonstrate IT security, risk management, and governance controls. Full enforcement begins July 1, 2026, after which any CASP operating in the EU without authorization faces penalties.

Can institutions use multiple custody providers?

Yes, and this is increasingly standard practice. BlackRock uses both Coinbase and Anchorage for its Bitcoin ETF. ARK 21Shares lists three custodians. Multi-custodian strategies reduce concentration risk, provide operational redundancy, and ensure business continuity if one provider experiences an outage or regulatory issue. The tradeoff is increased operational complexity and the need to manage multiple API integrations, reporting systems, and audit relationships.

This tool is for informational purposes only and does not constitute financial advice. Data is approximate and based on publicly available information as of mid-2026. Insurance coverage, regulatory statuses, and supported assets change frequently. Always verify current details directly with providers before making custody decisions.