Crypto Gloss

Crypto Custody

Crypto custody describes how the private keys and signing authority that control crypto assets are created, protected, backed up, and used. The central question is who can authorize a transaction: you, a service provider, or several parties working together.

A wallet does not contain coins in the way a physical wallet holds cash. A blockchain records the assets and transactions; a wallet manages the credentials and software used to interact with that network. An exchange balance may instead represent a claim governed by the exchange’s terms and the law that applies to it. Seeing a balance in an app does not by itself show who holds the keys or what happens if the provider fails.

What Crypto Custody Covers

Custody includes more than the device or software used to sign. It can include key generation, transaction approvals, backups, access controls, recovery, recordkeeping, and the legal arrangement between a customer and a provider. “Hot” and “cold” describe whether a wallet is connected to the internet; they do not tell you who controls it. Either a user or a provider can use hot or cold storage.

Common Custody Models

Self-custody

With self-custody, you control the private key or recovery phrase needed to authorize transactions. You can use a connected software wallet for frequent activity or an offline device for less connected key storage. Offline storage can reduce exposure to some online attacks, but it cannot prevent every risk: a device or backup can be lost, damaged, stolen, misused, or compromised during setup or recovery.

Self-custody gives you direct control over signing, while placing the work of securing backups, checking addresses and networks, and planning recovery on you. If the only usable key or recovery method is lost, there may be no provider able to restore access.

Third-party custody

A custodian, which may be an exchange or a specialist provider, controls the keys and processes customer instructions through an account or service. This can provide managed security operations and account support, but it adds dependence on that organization’s systems, policies, legal obligations, and financial condition. Access can be affected by outages, account reviews, withdrawal limits, legal orders, or insolvency.

Do not assume an account balance is a bank deposit, that customer assets are always segregated, or that losses are insured. The contract and applicable law matter. Some providers may lend, reuse, or commingle assets under specified conditions; check what the agreement permits and whether you have consented.

Shared control: multisig and MPC

Multisignature arrangements require a defined number of separate keys to approve a transaction. Multi-party computation (MPC) uses a cryptographic protocol in which participants hold key shares and cooperate to produce a signature; a full private key need not be reconstructed in some designs. These approaches can distribute authorization across people or systems, but the actual threshold, recovery process, and provider control depend on the implementation and contract.

Shared signing can reduce reliance on one key or person, yet it adds coordination and recovery questions. Ask who controls each key or share, who can change the policy, what happens if a participant disappears, and whether the service can block or approve a transaction.

Risks to Compare

  • Control and access: Who can sign, pause a withdrawal, or restrict an account? Can you move assets without a provider’s approval?
  • Operational mistakes: Self-managed keys can be lost or exposed through phishing, malware, unsafe backups, or a mistaken transaction. A custodian can face cyber incidents, insider risks, system failures, or weak controls.
  • Provider and legal risk: Hosted assets depend on the provider’s solvency, custody records, contract terms, and treatment in insolvency. Review whether assets may be lent, pledged, or combined with other assets.
  • Recovery and succession: Determine how access can be restored after a lost device, lost key, death, or service shutdown. A recovery plan should not create an easy route for someone else to take control.
  • Insurance: If a provider advertises insurance, read the actual policy terms. Coverage can have limits, exclusions, named insureds, and conditions; it is not automatically equivalent to bank-deposit protection.

Custodians and Regulation

Regulatory labels are specific to a jurisdiction and a legal context. In the United States, “qualified custodian” is used in particular investment-adviser and regulated-fund rules; it is not a general safety rating for every company that holds crypto. On October 1, 2026, the SEC proposed amendments concerning custody by advisers and regulated funds. A proposal is not a final rule, and its scope does not turn every retail exchange account into a protected bank deposit.

In Indonesia, OJK’s digital financial asset and crypto trading framework includes POJK 27/2024, as amended by POJK 23/2025. Those rules concern regulated providers and market activity; they do not make every crypto holding risk-free or establish that a customer has bank-style deposit insurance. For any provider, check its current authorization, the legal entity named in your agreement, the custody arrangement, withdrawal terms, and the protections that apply to your specific assets.

How to Assess a Custody Arrangement

Before relying on a provider or setting up self-custody, document the answers to practical questions: who controls the signing credentials; where keys or shares are held; whether assets are segregated; whether the provider can lend or reuse them; what can delay withdrawals; how backups and recovery work; who bears losses after a breach; and exactly what any insurance covers. For self-custody, test the recovery process with a small amount before depending on it. These checks help compare tradeoffs; they cannot eliminate risk.

Social Media Sentiment

An August 2026 discussion in r/Bitcoin about whether self-custody is too risky for many users drew opposing replies. The original post emphasized the learning curve and transaction mistakes; responses highlighted exchange freezes and failures, while others described lost keys and scams as serious self-custody risks. This is one subreddit thread, not a representative survey or a measure of wider public opinion. Its useful takeaway is that the two models exchange operational risk for counterparty and access risk.

Last updated: 2026-10

Related Terms

See Also

Sources