Custody means the safekeeping of assets. In crypto, what gets safeguarded is a private key, the secret number that authorizes transactions from an address. If a key is lost, the assets it controls cannot be recovered. If it is stolen, the thief can move the funds and the transfer cannot be reversed. There is no password reset and no chargeback. That is why custody is one of the most developed parts of crypto infrastructure.
What Custody Actually Means
In traditional finance, a custodian is a bank or broker that holds stocks, bonds or cash for a client. The client remains the owner, and the custodian keeps records and protects the assets.
Crypto custody follows the same principle with one big difference. The asset lives on a public blockchain, and control depends entirely on who can sign with the private key. Custody is therefore about three things: keeping keys from being stolen, keeping them from being lost, and making sure only authorized people can use them.
Hot, Warm and Cold Storage
- Hot wallets: keys are held on systems connected to the internet. Withdrawals are fast, but the keys are exposed to hacking, malware and phishing.
- Cold storage: keys are generated and kept on devices that never connect to the internet, such as hardware security modules or air-gapped computers. Moving funds takes longer and usually needs several people.
- Warm wallets: a middle tier that is online but protected by extra approval steps and limits.
Most exchanges and custodians keep a small share of assets hot to handle daily withdrawals and hold the majority in cold storage. Individuals can apply the same idea on a smaller scale. Bitcoin.org's guide to securing your wallet covers backups, encryption and offline storage.
Multisig and MPC
Two methods are widely used to avoid relying on a single key.
- Multi-signature (multisig): the address requires several separate keys to approve a transaction. In a 3-of-5 setup, any three of five keyholders must sign. One stolen or lost key is not enough to move or lose the funds.
- Multi-party computation (MPC): one key is split into shares held by different parties or devices. The shares jointly produce a signature without the full key ever being assembled in one place.
Multisig rules are enforced on-chain and are visible to anyone. MPC works off-chain, looks like a normal single signature, and works across blockchains that lack native multisig. Both reduce the damage a single insider or a single compromised device can do.
Who Provides Custody
- Exchanges: when you leave coins on an exchange, the exchange holds the keys. You have a claim on the company, not direct control of the coins.
- Dedicated custodians: firms such as Coinbase Custody, BitGo and Anchorage Digital hold assets for funds, companies and ETF issuers. Many operate as trust companies under state or federal charters.
- Banks: some banks now offer digital asset custody, directly or through a partner.
- Self-custody: the owner holds the keys, using hardware wallets or an in-house setup.
Qualified Custodians and Regulation
In the United States, registered investment advisers that hold client funds or securities must generally keep them with a qualified custodian under the SEC's custody rule. Qualified custodians include banks, registered broker-dealers and certain trust companies. How this rule applies to crypto assets has been debated for years and guidance has shifted, so institutions check the current position before choosing a provider.
One accounting change is worth knowing. In 2022, SEC staff guidance known as SAB 121 told companies that safeguard customers' crypto to record it on their own balance sheets, which made custody costly for banks. The SEC rescinded that guidance in January 2025.
In the European Union, the Markets in Crypto-Assets Regulation (MiCA) treats custody and administration of crypto assets on behalf of clients as a regulated service that requires authorization.
Segregation and What Happens in a Failure
The key question with any custodian is what happens if it goes bankrupt. If client assets are properly segregated and held in trust, they should stay separate from the company's own property. If they are mixed with company funds, customers may end up as unsecured creditors waiting years for partial repayment.
History shows the cost. Mt. Gox, once the largest Bitcoin exchange, collapsed in 2014 after losing customers' coins. FTX failed in November 2022 after customer assets were misused. In both cases customers had no control over the keys.
Insurance and Audits
Some custodians carry insurance against theft or employee dishonesty. Policies have limits, often well below total assets held, and many exclude certain events. Bank deposit insurance and brokerage protection schemes generally do not cover crypto assets. The SEC's crypto asset resources for investors explain these limits.
Reputable custodians publish independent control audits, such as SOC reports. Some exchanges publish proof-of-reserves reports. These show assets held at a point in time but do not always show liabilities.
Self-Custody: Control and Responsibility
Self-custody removes the risk that a third party fails, freezes withdrawals or is hacked. It replaces that with the risk of your own mistakes. An institution that holds its own keys needs secure facilities, hardware security modules, access controls, audit trails and trained staff. An individual needs a hardware wallet and a safely stored backup.
Common Mistakes
- Storing a seed phrase in a photo, email or cloud drive.
- Keeping one copy of a backup in one location.
- Leaving large balances on an exchange for years.
- Typing a seed phrase into a website. No legitimate service asks for it.
- Having no plan for how family or colleagues can access the assets if the keyholder is unavailable.
Nothing in this article is financial advice.
Track on CoinMarketGuy
The exchanges page lists trading venues if you are comparing where assets are held. The Bitcoin and Ethereum pages show live price, market cap and supply for the two assets most often held in institutional custody.