What is crypto custody? How custodians hold bitcoin, and the risks
What crypto custody means, how custodians store keys (cold storage, multisig, MPC), what a qualified custodian is, how MiCA and US rules apply, and what to check.
CryptoGroup Newsroom · · 6 min read
Crypto custody is the safekeeping of the private keys that control crypto assets on behalf of someone else. Whoever holds the keys can move the coins, so choosing a custodian is really choosing who you trust with that power. This explainer covers how custody works, the technology behind it, what regulators require, and how it compares with holding coins yourself. It is educational and not financial advice.
Custody in one paragraph
A bitcoin or ether balance is not stored "in" a wallet; it sits on a blockchain, and a private key proves the right to spend it. If you keep that key yourself, you are self-custodying. If an exchange, bank, broker or specialist firm keeps it, you are using a custodian, and what you hold is a claim on that company. Our guide to custodial vs non-custodial wallets covers this choice from a retail user's point of view; this page focuses on how professional custody works.
Who uses custodians
- Exchange customers. Coins left on an exchange account are held by the exchange, usually in pooled ("omnibus") wallets.
- ETFs and funds. A spot bitcoin ETF must keep its coins with a custodian. Most US spot bitcoin ETFs, including BlackRock's iShares Bitcoin Trust, named Coinbase as custodian in their filings; Fidelity's fund uses its own Fidelity Digital Assets. See bitcoin ETF vs buying bitcoin.
- Companies and trusts. Public companies, fiduciaries and trusts are often required to use a regulated "qualified custodian". AnchorWatch, which opened as a Nevada trust company in October 2026, targets exactly these clients.
- Banks' clients. BNY added XRP and RLUSD custody, Deutsche Bank received MiCA authorisation from BaFin for a corporate custody service, and Standard Chartered agreed to buy Zodia Custody.
How custodians protect keys
| What it is | Main benefit | Main trade-off | |
|---|---|---|---|
| Cold storage | Keys generated and kept on devices never connected to the internet | Out of reach of online attackers | Withdrawals are slower and need manual steps |
| Hot wallet | Keys on internet-connected servers | Fast withdrawals | Main target for hackers; kept small |
| Multisig | A transaction needs several separate keys (e.g. 2 of 3) | No single key can move funds | Setup and recovery are more complex |
| MPC | One key is split into shares held by different parties; it is never assembled | Works on chains without native multisig | Relies on the provider's software being sound |
Most custodians keep the bulk of client coins in cold storage and only a small float in hot wallets for withdrawals. Signing usually requires several employees in different locations, plus policy rules such as withdrawal limits and allow-listed addresses. Some providers split control between institutions: AnchorWatch's multi-institution option, for example, divides key control between itself, BitGo and CoinCorner so that no single company can move the coins.
What regulators require
- EU (MiCA). "Custody and administration of crypto-assets on behalf of clients" is a licensed service under Article 75 of MiCA. Providers must sign a custody agreement with each client, keep a register of every client's positions, send a statement at least every three months, and keep client coins legally and operationally separate from their own. ESMA has said that means different wallet addresses for client and company coins. Providers are liable for losses caused by incidents attributable to them.
- United States. Accounting rules once discouraged banks: the SEC's staff bulletin SAB 121 (2022) made custodians book client crypto as a liability on their own balance sheet. SAB 122, issued on 23 January 2025, rescinded it, which is one reason US banks have been expanding crypto custody since.
- Australia. ASIC's consultation paper CP 392 proposes capital and custody standards for crypto platforms, including at least A$14 million in net tangible assets for operators without qualifying third-party custody.
Why custody failures matter
When a custodian fails, customers usually become creditors in a bankruptcy rather than owners of specific coins, unless the assets were properly segregated. Mt. Gox, then the largest bitcoin exchange, collapsed in 2014 saying about 850,000 bitcoin were missing; creditors waited roughly a decade for repayments. FTX collapsed in November 2022 after customer deposits were used by its affiliated trading firm. Both cases are why segregation, independent audits and proof of reserves became standard questions.
Checklist before trusting a custodian
- Licence: which regulator authorised it, and for custody specifically?
- Segregation: are client assets held separately and outside the firm's estate in insolvency?
- Audits: SOC 1/SOC 2 reports, regular attestations or proof of reserves, and who performed them.
- Insurance: what is covered (theft, insider fraud, key loss), the limit, and whether it is shared across clients.
- Rehypothecation: may the custodian lend or stake your coins? Under MiCA staking needs explicit consent.
- Exit: how fast can you withdraw to your own wallet, and at what fee?
Custody or self-custody?
Self-custody with a hardware wallet removes the middleman but makes you responsible for backups and security; see how to store crypto safely. Professional custody suits funds, companies and people who need a regulated third party, insurance or inheritance planning. Many holders split the difference: a custodian or exchange for trading balances, self-custody for long-term savings. Newer tools try to combine both, such as Chainlink's CustodySync, which lets Anchorage clients borrow in DeFi without moving collateral out of custody.
Frequently asked questions
What is crypto custody in simple terms?
It means a company holds the private keys to your crypto and is responsible for keeping them safe. You hold a claim on that company rather than the keys themselves.
What is a qualified custodian?
In the US it is a regulated institution, such as a bank or trust company, that investment advisers and many funds must use to hold client assets. Crypto firms with state trust charters or federal bank charters can act as qualified custodians.
Is crypto held by a custodian insured?
Not automatically. Bank deposit insurance does not cover crypto. Some custodians buy private insurance against theft or key loss, with limits and exclusions you should read.
Can a custodian lose my crypto?
Yes. Hacks, insider fraud or insolvency can cause losses. Segregation of client assets, audits and insurance reduce but do not remove this risk.
What is the difference between custody and self-custody?
With custody a third party holds the keys; with self-custody you hold them, usually in a software or hardware wallet, and nobody can freeze or recover them for you.
This article is for information only and is not financial advice. Crypto assets are volatile; do your own research. Read our disclaimer
More from Security
View all →Read next
Robinhood to add Ripple's RLUSD despite backing rival USDG
Ripple's $2.5B RLUSD stablecoin is coming to the Robinhood app by end-2026 and will settle Bitstamp trades on the XRP Ledger. How it sits next to Paxos's USDG.
Brazil's companies piled into stablecoins on election day
Corporate accounts made 78% of Mercado Bitcoin's election-day volume as USDT trading jumped nearly 800%. Next day the Ibovespa fell 14% and the dollar rose 8%.
Crypto.com launches US crypto perps with up to 5x leverage
Crypto.com and partner OG.com began offering crypto perpetual futures to eligible US traders, with up to 5x leverage, after registering with the NFA.