Crypto custody providers safeguard the private keys or signing authority used to control crypto assets. A recognizable brand, insurance headline or security certification does not eliminate loss, insolvency, operational, legal or withdrawal risk. The right arrangement depends on the assets, users, transaction needs and jurisdiction.
Define the custody model
| Model | Control | Main questions |
|---|---|---|
| Self-custody | Investor controls keys | Backup, inheritance, device security and user error |
| Third-party custody | Provider controls or participates in signing | Legal claim, segregation, withdrawal and insolvency |
| Hybrid governance | Multiple parties or policies approve movement | Quorum, recovery, collusion and operational delays |
Wallets generally store keys, not coins themselves. Document which party can initiate, approve, block and recover each transaction.
Verify legal and regulatory facts
Identify the contracting entity, location, licenses or charters, regulator, asset scope and customer type. Verify claims directly with the responsible authority. Terms such as qualified custodian, regulated or insured have specific scopes; do not infer that every token, service or loss is covered.
Evaluate key and transaction controls
- Key generation, storage, backup and destruction
- Cold, warm and hot-wallet allocation
- Multi-signature or multiparty-computation design
- Role-based approval, velocity and destination limits
- Address allowlists and out-of-band verification
- Privileged access, employee screening and separation of duties
- Monitoring, incident response and tested recovery
Read insurance precisely
Request the insurer, policy period, named insured, aggregate and per-event limits, deductibles, exclusions and allocation among customers. Coverage for external theft may exclude market loss, customer credential compromise, protocol failure, employee conduct or provider insolvency. Insurance is a recovery layer, not a security control.
Test operations before funding
- Complete identity and account approvals.
- Deposit a small representative asset.
- Reconcile on-chain address, custody statement and internal ledger.
- Test a withdrawal, approval escalation and support response.
- Confirm reporting, tax-lot and audit evidence.
- Exercise key or data transition to another provider.
Connect custody records to crypto accounting and reconcile every movement, fee, fork, reward and balance.
Provider scorecard
Score legal status, asset support, governance, segregation, security testing, incident history, financial resilience, insurance, reporting, integration, service levels, withdrawal controls and exit terms. Weight each criterion by actual use rather than accepting a generic league table.
Frequently asked questions
Does cold storage remove all risk?
No. It can reduce online attack exposure while adding human, recovery, governance and transaction-delay risks.
Are assets protected like bank deposits?
Do not assume so. Legal protections and insurance differ from deposit insurance and must be verified for the exact entity and asset.
Should a business use one custodian?
Concentration may simplify operations but increases dependency. Evaluate diversification against control complexity and reconciliation burden.
Sources reviewed
Last reviewed: August 15, 2026. Crypto assets and custody arrangements can result in permanent loss and limited legal recovery.