Crypto Custody Explained: Who Really Holds Your Coins?

Every crypto balance you see on a screen comes down to one question: who holds the private keys? Coins never sit inside an app or a company's server. They stay on the blockchain, and whoever controls the keys controls the coins.

Crypto custody is the business, and the habit, of looking after those keys. Sometimes a company does it for you. Sometimes you do it yourself. Most people end up somewhere in between without ever thinking about it.

That choice shapes what happens when an exchange freezes withdrawals, a phone is stolen, or a family member needs to inherit your holdings. Here is how custody works and how to pick an arrangement that fits.

What crypto custody actually means

A private key is a long secret number that signs transactions. Anyone who has it can move the funds tied to it, and the network will not ask who they are. If the concept is new, our guide to public and private keys walks through the basics.

Custody is simply responsibility for that key. The custodian is whoever can sign: you, an exchange, a specialist firm, or a group of people who must agree before anything moves.

This is different from a bank account. A bank holds a claim on your behalf and can reverse mistakes. In crypto, a valid signature is final, so the person or firm holding the key carries almost all of the risk.

Custodial vs self-custody

With custodial storage, a third party keeps the keys and shows you a balance. Buying bitcoin on a large exchange and leaving it there is the most common example. You log in with a password and two-factor code, never a private key.

Self-custody flips that around. You install a wallet, it generates keys, and you write down a recovery phrase. Nobody else can move the funds, and nobody else can help if you lose that phrase.

Neither model is automatically better. Custodial storage trades control for convenience and support. Self-custody trades convenience for control. The right answer depends on how much you hold, how often you trade, and how confident you are managing backups.

What a crypto custodian does

A crypto custodian is a company whose job is holding digital assets for others. Exchanges do this for their users, but there are also dedicated custodians that serve funds, companies and wealthy individuals.

The work is mostly about key management. Serious custodians keep the bulk of client assets in cold storage, meaning keys generated and kept on machines that never touch the internet. A smaller hot wallet handles day-to-day withdrawals.

Exchanges usually pool customer coins in a handful of large wallets and track who owns what in an internal ledger. That is why a transfer between two users on the same platform can be instant and free: nothing happens on the blockchain at all.

Many also split signing power. Some use multisig, where several independent keys must approve a transaction. Others use multi-party computation, or MPC, where a single key is never assembled in one place at all and separate parties each hold a fragment.

On top of the technology sit the controls: withdrawal whitelists, approval policies, audits, insurance and, for regulated firms, supervision by a financial authority.

Institutional custody and regulated custodians

Institutional custody is a niche of its own. Asset managers, pension funds and listed companies usually cannot keep keys on a laptop. Rules and investors expect segregated accounts, independent audits and a regulated party holding the assets.

In the United States, investment advisers who manage client money generally need to use a "qualified custodian," such as a bank or trust company. That is one reason trust-chartered firms like Coinbase Custody and Anchorage Digital have grown into large players.

The spot bitcoin ETFs approved in January 2024 rely on this structure. The fund itself does not manage keys. A named custodian holds the bitcoin, and the fund publishes who that custodian is in its filings.

For ordinary users, the useful takeaway is that institutional-grade crypto custody solutions exist, but they are built for compliance and scale, often with account minimums that rule out small holders.

The risks of leaving coins with someone else

The phrase "not your keys, not your coins" became popular for a reason. When a custodian fails, customers are often treated as unsecured creditors rather than owners.

Mt. Gox, once the largest bitcoin exchange, collapsed in 2014 after losing hundreds of thousands of bitcoin. Creditors waited roughly a decade for repayments to begin.

In 2022, the lender Celsius froze withdrawals and filed for bankruptcy. A US court later ruled that deposits in its Earn program belonged to the company under its terms of use, not to the customers who made them. A few months later, FTX collapsed amid evidence that customer funds had been misused.

None of this means every exchange is unsafe. It means the terms of service, the company's jurisdiction and whether client assets are kept separate matter as much as the trading features.

The risks of holding your own keys

Self-custody removes counterparty risk, but it replaces it with personal risk. Lose the device and the recovery phrase, and the funds are gone for good. There is no support line to call.

Theft does not disappear either. Phishing sites, fake wallet apps and malicious token approvals all target people who hold their own keys. A recovery phrase typed into the wrong website is as good as handing over the coins.

Inheritance is the risk people forget. If nobody else knows the wallet exists or how to reach the backup, those assets can be lost when the owner dies.

Choosing a custody setup that fits

Start with what you are protecting. Small amounts you trade often can reasonably sit on a reputable exchange with strong two-factor authentication and a withdrawal address whitelist.

Long-term savings are a different case. A hardware wallet keeps keys offline and makes you confirm every transaction on the device's own screen, which blocks most remote attacks.

Larger holdings, or money shared between business partners or family members, may justify a multisig wallet. Requiring two of three keys means a single lost or stolen key does not lose the funds.

Some people split the difference with collaborative custody. They keep one or two keys themselves and let a service hold a backup key, so the provider can help with recovery but cannot move funds alone.

Whichever route you take, test it before trusting it. Send a small amount first, restore the wallet from its backup on a spare device, and confirm the balance appears before moving anything you cannot afford to lose.

Questions to ask any custodian

Before trusting a company with your coins, look for clear answers on a few points. Are client assets held separately from company funds, or pooled on the balance sheet?

Ask what share of assets is in cold storage, whether the firm is licensed and where, and what any insurance actually covers. Policies often protect against theft from hot wallets but not against the firm's own insolvency.

Check whether the company publishes proof of reserves or audited statements, and read the terms of service on ownership. The answers will not remove all risk, but they show how seriously the custodian treats it.

Bottom line

Crypto custody is not a technical side issue. It decides who can move your money and who bears the loss when something goes wrong.

Many people settle on a mix: a small trading balance on an exchange, and savings in a wallet whose keys they control. Whatever you choose, make the decision on purpose, write down your recovery plan, and review it as your holdings grow.