Crypto Custody
Also known as: digital asset custody, institutional crypto custody, qualified custodian (crypto), crypto asset management
Crypto custody refers to the management and secure storage of cryptographic private keys that control access to digital assets.
For individuals, custody ranges from self-custody (hardware wallets, seed phrases) to exchange custody. For institutions (funds, companies, family offices), custody must meet fiduciary and regulatory standards: qualified custodians (Coinbase Custody, BitGo, Anchorage, Fidelity Digital Assets) provide regulated, insured, audited custody of digital assets with institutional-grade security, reporting, and legal segregation of assets. Regulated investment advisors and funds may be legally required to use a qualified custodian for digital asset holdings.
Crypto Custody, explained at three levels
At home
Crypto custody is how your cryptocurrency is stored and kept safe. For individuals, custody is either with an exchange (they hold your keys and you have a balance) or self-custody (you hold the private keys yourself via a hardware wallet). For businesses or investors holding significant amounts, institutional custody services hold the cryptocurrency on your behalf using bank-vault-level security -- insured, audited, with multiple employees required to authorize any transaction.
At work
If your organization holds cryptocurrency as a treasury asset, on behalf of clients, or as part of investment operations, custody is a fundamental governance and security decision. Options range from self-custody (you manage the private keys internally -- high control, high responsibility) to institutional custodians (Coinbase Custody, BitGo -- regulated, insured, and audited, but reliant on the custodian). For most organizations without deep crypto security expertise, institutional custody is significantly safer than attempting to build self-custody infrastructure.
At home
MPC (Multi-Party Computation) custody is the leading institutional key management technology: instead of storing a private key in a single location (vulnerable to theft if the location is compromised), MPC distributes key shards across multiple parties or secure environments. A transaction is signed cooperatively by the shards without the full private key ever being reconstructed in any single location. This eliminates the single point of compromise inherent in traditional private key storage. Fireblocks, Copper, and Curv (acquired by PayPal) are major MPC custody technology providers.
At work
Qualified custodian status in the US is defined by the Investment Advisers Act: registered investment advisers (RIAs) managing client assets must hold those assets at a qualified custodian -- an entity meeting specific regulatory standards (banks, registered broker-dealers, futures commission merchants, and certain foreign financial institutions). The SEC's evolving position on whether digital assets must be held at a qualified custodian (and whether current crypto custodians meet the definition) is an active area of regulatory development. Most institutional fund managers holding crypto assets use custodians with explicit qualified custodian licensing to avoid regulatory ambiguity.
At home
Staking and DeFi from custody is an emerging product: institutional custodians are increasingly offering staking (delegating crypto to validators for yield) and controlled DeFi interaction from within the custody environment, allowing institutions to earn yield on assets without removing them from regulated custody. Custody-integrated staking (offered by Coinbase Custody, BitGo) lets institutions earn ETH staking rewards while maintaining custodial security. DeFi interaction from custody environments (via protocol integrations or MPC-enabled smart contract interactions) enables institutions to access DeFi yields within their compliance perimeter.
At work
Proof of Reserves (PoR) is a cryptographic technique that allows a custodian to demonstrate that they hold assets backing their liabilities without revealing individual account details. After FTX's collapse demonstrated that an exchange could misrepresent its asset backing, demand for PoR attestations from custodians and exchanges increased. PoR uses Merkle tree structures to prove that specific user account balances are included in the total reserves being audited. While PoR proves assets exist, it does not prove liabilities (an exchange could have hidden liabilities not reflected in the PoR), so full third-party accounting audits remain the gold standard.
Real-world examples
At home
After accumulating $500,000 in Bitcoin, Fatima felt uncomfortable managing the private keys herself -- worried about loss, theft, and disaster scenarios. She moved her Bitcoin to a qualified custodian (Coinbase Custody). Her assets were insured, held in cold storage with institutional-grade security, and she could authorize transactions through multi-approval workflows with full audit logging. She paid a custody fee of 0.5% annually in exchange for professional security management.
At work
Marcus was the CFO of a hedge fund that began allocating 3% of AUM to Bitcoin. The fund's prime broker required custody at a qualified custodian to maintain regulatory compliance. They selected BitGo Trust Company (a chartered trust company providing qualified custodian services): crypto was held in cold storage, legally segregated from BitGo's own assets, covered by $700M in insurance coverage, and audited by a Big Four firm. These specifications satisfied both the fund's LP (limited partner) requirements and regulatory examination standards.
Common confusions
- Many investors assume that an exchange holding their crypto is equivalent to institutional custody — Crypto exchanges hold customer assets as an operational convenience, not in the regulated, segregated manner of a qualified custodian. FTX held customer assets that management then used for other purposes -- something that would be illegal under qualified custodian rules. Qualified custodians are legally required to segregate customer assets from their own, maintain sufficient reserves, submit to regulatory examination, and carry insurance. Most retail exchanges are not qualified custodians and make no legal commitment of the same standard.
- Some assume that self-custody (hardware wallet) is always safer than institutional custody — Self-custody transfers all security responsibility to the individual or organization. The risk is not eliminated -- it is transformed: instead of custodian counterparty risk, you have operational risk (seed phrase loss, device failure, human error, internal theft). For organizations without dedicated security infrastructure, the human and operational security risks of self-custody typically exceed the counterparty risk of a well-regulated institutional custodian. Self-custody is appropriate for individuals with strong security practices and small-to-medium holdings; institutional custody is appropriate for organizations and large holdings.
For analysts
When a corporate client is establishing crypto treasury management, custodian selection is the foundational governance decision. The evaluation framework: regulatory licensing (qualified custodian status or equivalent in your jurisdiction), insurance coverage (what is covered, sub-limits, exclusions), security architecture (cold storage percentage, MPC vs. traditional cold storage, access controls), proof of reserves and audit practices (third-party audited?), operational capabilities (staking, DeFi access, multi-chain support), and fee structure. Clients often default to the largest-name custodian without evaluating the specific features that match their use case -- the right custodian depends on the client's specific asset types, operational needs, and regulatory context.
History & origin
Institutional crypto custody emerged as a distinct product category around 2018-2019 as hedge funds, family offices, and corporate treasuries began acquiring cryptocurrency at scale but lacked the infrastructure to self-custody securely. Coinbase Custody launched in 2018 as one of the first qualified custodians for digital assets (qualified under New York's Division of Financial Services regulations). BitGo became one of the earliest to obtain qualified custodian status. The OCC (Office of the Comptroller of the Currency) issued guidance in 2020 that national banks could provide crypto custody services, opening the door for traditional banks (State Street, BNY Mellon) to enter the market. FTX's collapse (2022) -- where customer assets were misappropriated by the exchange's management rather than held in proper custody -- accelerated institutional demand for segregated, regulated custody from licensed custodians.