Crypto custody is the safekeeping of private keys and the operating controls that decide who can move digital assets. This article explains custody models, key protection, 2026 US and EU rules, and the build-versus-buy decision for teams planning wallet or custody infrastructure.
Crypto custody (also called digital asset custody or crypto asset custody) is the safekeeping of the private keys that control crypto assets, plus the processes around who can move them. A digital asset may sit on a public blockchain, but custody decides who can sign a transaction, so whoever holds or controls the keys effectively controls the assets.
Two events in late 2026 put custody back on the agenda. On October 1, the SEC proposed a crypto custody framework for advisers and funds. On October 29, about $6.36 billion moved out of Binance wallets in a single incident, according to TRM Labs as cited by AP News.
What is crypto custody?
A blockchain records balances and ownership changes, but funds move only after a valid signature from the right private key is submitted. Custody means holding those keys, deciding who may approve transfers and recording what happened.
A wallet is the tool that signs; custody is the arrangement that controls who may use that signing power. Three related terms are often confused:
| Term | What it is | Who controls the keys | What the user holds |
| Wallet | Software or hardware that stores keys and signs transactions | The wallet owner or an appointed operator | Private keys and direct signing power |
| Crypto custodian | Regulated firm holding client keys under contract | Custodian, under agreed approvals and policies | Account rights and client-level custody records |
| Exchange account | Trading account with custody bundled into the platform | The exchange | An account claim, not direct signing power |
For a deeper split, see our guide to custodial vs non-custodial wallets.
“Not your keys, not your coins” and institutional custody ask the same question from opposite ends: who can sign? Teams building that signing layer usually start with crypto wallet development and add policy and audit controls later.
Crypto custody models: self-custody, third-party and co-managed
A custody model depends on who controls the signing keys and who may carry the loss if those keys are compromised or the firm holding assets fails. That choice shapes audit evidence, withdrawal speed and bankruptcy exposure.
| Model | Who holds keys | Who approves transfers | If the provider fails | Typical users |
| Self-custody | Owner holds keys | Owner approves all transfers | No counterparty; owner bears loss | DAOs, treasuries, Web3 teams |
| Third-party custody | Custodian holds keys | Client instructs, custodian executes | Depends on segregation, contract terms and records | Funds, banks, asset managers |
| Co-managed custody | Client and provider split keys | Both approve by quorum | Shared control continues by design | Fintechs, exchanges, institutions |
Self-custody suits treasuries with in-house security teams and fast on-chain operations. A seed phrase backup that is lost or copied becomes a single point of failure.
Third-party crypto custody can provide regulated record-keeping and stronger insolvency protection when assets are properly segregated and customer rights are documented. Co-managed custody is common when a firm wants a regulated partner but refuses to give up unilateral control.
None of the three crypto custody models is safest by default. Self-custody trades counterparty risk for key-loss risk, third-party custody trades key-loss risk for counterparty and contract risk, and co-managed custody splits both, so the choice depends on security skills and regulatory duties.
How to Build a Crypto Wallet: a Complete Guide
Inside Crypto Wallet MVP Development: Process, Costs, and Real-World Lessons
How crypto custodians secure private keys
Custodians make two design decisions: where private keys live, from offline vaults to production servers, and how signing power is split between people, devices and code.
Cold, warm and hot storage
A cold wallet keeps keys generated and stored offline, often with air-gapping. A hot wallet stays online and signs automatically within preset limits, so it should hold only working balances. Warm storage sits between them: online, but gated by human approval or time delays. Most assets usually stay cold, and hot wallets are refilled on a schedule.
Multisig, MPC and HSMs
A multisig wallet uses several independent private keys and an on-chain rule, such as 2-of-3 or 3-of-5. MPC, or multi-party computation with threshold signatures, means one complete key never exists in one place. Parties hold shares and jointly produce one standard signature. MPC wallet development is often paired with HSMs, which are tamper-resistant devices that generate and use keys without exporting them. Buyers should ask for FIPS 140-3 validation, because NIST moved FIPS 140-2 validations to its Historical list on September 21, 2026 (NIST FIPS 140-3 transition).
| Criterion | Multisig | MPC (threshold signatures) | HSM |
| Where the key exists | Separate full keys | Distributed key shares | Inside hardware module |
| What the chain sees | Multisig script or contract | One standard signature | One standard signature |
| Chain support | Chain-specific | Broad, signature-based | Broad, signature-based |
| Key rotation | Often visible on-chain | Off-chain share refresh | Device-backed ceremonies |
| Main weakness | Contract or chain limits | Off-chain policy trust | Hardware and access dependency |
| Fits best | Transparent shared control | Scalable institutional custody | Regulated key protection |
None of these schemes helps if approvers cannot see what they sign. That is why clear signing and transaction simulation now sit next to MPC and HSMs, including in MPC wallet budgets.
Who needs institutional crypto custody
Institutional crypto custody applies to firms that hold client assets or large corporate crypto balances.
- Registered investment advisers with custody of client assets generally must use a qualified custodian unless an exception applies.
- Banks and trust companies add custody to broader crypto banking solutions.
- Exchanges and brokers hold client balances and process withdrawals around the clock.
- Corporate treasuries hold bitcoin or stablecoins and need approvals and disaster recovery.
- Token issuers and tokenization platform development teams may hold reserves or investor allocations.
- Fintech and payment apps hold user balances behind a consumer interface.
Banks are already in: BNY Mellon took its Digital Asset Custody platform live in the US on October 11, 2022 for select clients holding bitcoin and ether (BNY Mellon announcement).
Crypto custody regulation in 2026
In plain terms, US advisers cannot park client crypto with any exchange or wallet provider and call it compliant custody. Under Advisers Act Rule 206(4)-2, qualified custodians include banks and FDIC-insured savings associations as defined in the rule, registered broker-dealers holding client assets in customer accounts, certain futures commission merchants, and qualifying foreign financial institutions (17 CFR 275.206(4)-2).
On October 1, 2026, the SEC proposed custody rules for registered investment advisers and regulated funds. The proposal would allow certain state trust companies to custody crypto assets, subject to proposed conditions, and would permit adviser self-custody where no qualified custodian is available, subject to safeguards (SEC press release). It is a proposal, not final. Advisers would have to document, per asset, that no custodian is available and recheck quarterly; the Advisers Act rule would be redesignated Rule 223-1; comments are due December 7, 2026 (Sullivan & Cromwell summary).
Unfortunately, our rules and regulations have not kept pace. … today’s proposal would provide a clear regulatory framework for the custody of crypto assets, giving investment advisers and funds a compliant pathway where none existed before…
Paul S. Atkins
Chairman, U.S. Securities and Exchange Commission U.S. Securities and Exchange Commission
Three other US actions matter for digital asset custody. On January 23, 2025, SEC staff issued SAB 122, rescinding SAB 121, whose balance-sheet treatment had discouraged banks from crypto custody (SAB 122). On March 7, 2025, OCC Interpretive Letter 1183 confirmed national banks may provide crypto-asset custody and removed the prior supervisory non-objection step (OCC release). New York DFS requires supervised custodians to segregate and separately account for customer virtual currency; its September 30, 2025 guidance replaced the 2023 version and added direction on sub-custodians (NYDFS guidance).
SAB 121 was SEC staff accounting guidance for entities safeguarding crypto assets for others, and its balance-sheet treatment discouraged banks from offering crypto custody. SAB 122 rescinded that guidance on January 23, 2025. Entities now decide whether to recognize a liability for the risk of loss by applying loss-contingency guidance (ASC 450-20 or IAS 37). Per KPMG, SAB 122 applies fully retrospectively in annual periods beginning after December 15, 2024, with early adoption permitted.
In the EU, MiCA has applied since December 30, 2024. Article 75 requires custody providers to sign a client agreement, keep a client-by-client position register, segregate client crypto from their own estate operationally, and accept liability for losses attributable to them, capped at market value at the time of loss (Regulation (EU) 2023/1114). More background: SEC crypto regulation and MiCA explained. This is a summary, not legal advice.
| Jurisdiction / rule | Status in November 2026 | What it means for custody design |
| Advisers Act qualified custodian rule | Binding SEC rule, in force | Design around eligible custodian categories and account controls |
| SEC October 2026 proposal | Proposed rule, comments due December 7, 2026 | Track asset-level custodian availability and self-custody safeguards |
| SAB 122 | Staff accounting guidance, January 23, 2025 | Reassess bank accounting treatment for custody offerings |
| OCC IL 1183 | Agency interpretation, March 7, 2025 | National banks may provide crypto-asset custody |
| NYDFS custody guidance | State supervisory guidance, September 30, 2025 | Segregate customer assets and govern sub-custodian arrangements |
| MiCA Article 75 | EU regulation, applies since December 30, 2024 | Use agreements, registers, segregation, and liability controls |
From Chaos to Compliance: How Cryptocurrency Regulation Is Shaping Up
Crypto Compliance: Key Regulations and Consequences of Non-Compliance
What FTX, Bybit and Binance teach about custody risk
FTX, Bybit and Binance failed in different places.
The US Department of Justice charged that Sam Bankman-Fried misappropriated billions of dollars of FTX customer funds, and he was sentenced to 25 years on March 28, 2024, according to the DOJ. This was a segregation and verification failure, not a key-management one.
On February 21, 2025, one Bybit Ethereum cold wallet was drained of about $1.5 billion, and the FBI attributed the theft to North Korea’s TraderTraitor actors in an FBI alert. Post-mortems describe a compromised Safe{Wallet} developer machine, malicious JavaScript injected into the wallet’s web interface, and signers approving what looked like a routine transfer but was a delegatecall to a malicious contract, according to Cyfrin’s analysis. The cold wallet and multisig worked as designed. The signing interface lied.
Cyfrin’s analysis says the approved transaction was a delegatecall to a malicious contract, while the Safe{Wallet} interface showed what looked like a routine transfer. The multisig and cold storage worked as designed. A signer can decode the raw transaction data on a separate device, check the call type and destination contract, and refuse any delegatecall that the policy does not expect.
Chainalysis counted more than $3.4 billion stolen in crypto from January to early December 2025, with Bybit the largest single incident. Then Binance became the endpoint and response-speed case. On October 29, 2026, about $6.36 billion moved out of Binance wallets on ten blockchains, mostly in about 20 minutes, according to TRM Labs as reported by AP News. Binance said its initial investigation pointed to a compromised laptop; the investigation is ongoing, so treat cause and attribution as provisional. Attackers target people and endpoints with signing access, so velocity limits, anomaly holds, and blockchain security basics decide how much leaves before humans react.
| Incident | What failed | Control that limits the damage |
| FTX 2022 | Segregation and independent asset verification failed | Bankruptcy-remote segregation and external proof of holdings |
| Bybit 2025 | Signing interface served malicious transaction context | Clear signing, interface integrity checks, independent transaction simulation |
| Binance 2026 | Endpoint compromise enabled high-speed outflows | Velocity limits, anomaly holds, human escalation triggers |
How to choose a crypto custodian: a due diligence checklist
Seven questions to put to crypto custody providers before you sign:
- Confirm legal status: qualified custodian standing, trust charter or MiCA authorization in your jurisdiction.
- Verify segregation terms: client assets off the custodian’s balance sheet, named or omnibus accounts, and insolvency treatment.
- Review key management: MPC, multisig or HSM, FIPS 140-3 validated hardware and key ceremony records.
- Test signing controls: policy rules, quorum approvals, clear signing, allowlists and velocity limits.
- Request SOC 1 or SOC 2 Type II reports, penetration tests, and on-chain holdings verification through security audit and risk management.
- Assess operations: supported assets and chains, withdrawal SLAs, staking and API quality.
- Read insurance and liability terms: internal theft, hot and cold storage coverage, and the liability cap.
How to Ensure Infrastructure Security: Best Practices for Your Business
Overview of DeFi Security Challenges and Best Practices to Overcome Them
Build, buy or integrate a crypto custody platform
In practice, teams pick which layers to own rather than choosing between a vendor and a blank repository. Licensing, insurance and qualified custodian status are hard to build. The product layer clients touch, from approvals to reporting, is where crypto custody platforms compete.
Core components of a custody platform
A custody platform has six main components.
- Key management layer uses MPC nodes or HSM clusters, key ceremonies, backups, rotation, and HD wallet design.
- Wallet tiers split cold, warm and hot wallets and rebalance them within policy limits.
- Policy engine controls initiators, approvers, quorum rules, allowlisted addresses, asset limits, and period-based velocity.
- Transaction pipeline builds, simulates, clear-signs, broadcasts, and confirms with readable previews before any digital signature.
- Ledger and reconciliation maintain client position registers against on-chain balances, with immutable audit evidence.
- Compliance hooks connect KYC, sanctions screening, transaction monitoring software, and Travel Rule requirements messaging.
Build vs buy vs integrate
Buying a regulated custodian is usually the fastest route to compliance. Building the full stack fits firms that plan to become custodians or need chains and workflows vendors do not support. Integrating is the common middle path: use a custodian or MPC provider for keys, then run your own policy, ledger, and client UI on top of those crypto custody solutions. Owning signing infrastructure does not by itself make a company a qualified custodian.
| Approach | What you own | What you rely on | Choose it when |
| Buy | Client experience, reporting, and operating procedures | Custodian licensing, controls, custody operations, and wallets | Compliance speed matters more than deep product control |
| Integrate | Policy, ledger, UI, and workflow logic | Custodian or MPC provider for key operations | You need differentiated workflows without full custody licensing |
| Build | Key management, policy, ledger, and operations | Internal engineering, security, compliance, and audit teams | Custody is a regulated core business line |
Signing interfaces, endpoint access and withdrawal velocity failed in the incidents above, and they stay your responsibility on any path. Write them into requirements and test them under load before client assets arrive, together with crypto compliance screening.
How PixelPlex helps
We build the layers around custody: wallets, signing flows, custodian integrations, and the records auditors ask for. That includes Canton wallet development for browser and mobile.
Rio DeFi was delivered for a Hong Kong blockchain company in 2020–2021. We rebuilt its web and mobile wallet with support for Rio Chain, OKEX Chain, and BSC, then integrated Hex Trust for secure distributed storage of private keys.
CoinDepo was a 2025 ERC-20 token and vesting contract project. We implemented a “custody beneficiary” role, letting an admin claim vested tokens on behalf of beneficiaries for secure off-chain or centralized storage. The MVP took three weeks.
See how Console Wallet brings clear signing to self-custody on Canton
Console Wallet is a self-custodial wallet and dApp access layer for the Canton Network. Keys stay on the device, approvals run through passkeys, and each transaction is clear-signed with a fee preview and built-in risk checks.
200,000 users and growing, with 30,000+ users in the first month
Top 3 app within the Canton ecosystem
$3M+ in app rewards through Canton’s integrated incentive system
Browser extension shipped in 3 weeks, iOS and Android versions followed in 1 month each
Explore this case studyCanton Loop was built for FiveNorth in 2025 as the first non-custodial wallet for the Canton Network. The MVP took 2.5 months, and the wallet was featured in the official Canton ecosystem marketplace within days of launch.
More on high-stakes Canton vaults and our blockchain consulting services.
FAQ
Someone, either you or a regulated firm, keeps the private keys that move your crypto and runs the approvals around them. That is crypto custody.
BNY Mellon launched its US service in October 2022, and the OCC confirmed in March 2025 that national banks may provide digital asset custody. Other categories include national trust banks, state trust companies and broker-dealers with the right permissions.
Under current Advisers Act Rule 206(4)-2, qualified custodians include banks and FDIC-insured savings associations, registered broker-dealers, certain FCMs and qualifying foreign financial institutions. The SEC’s October 2026 proposal would allow certain state trust companies to custody crypto assets if proposed conditions are met.
It is an account at a custodian where your assets sit in a segregated wallet or in an omnibus wallet tracked per client in the custodian’s ledger. You instruct transfers, and the custodian signs under agreed policies. Check segregation and withdrawal terms in the contract.
It removes counterparty and insolvency risk but adds key-loss and recovery risk. Under the SEC’s October 2026 proposal, advisers could self-custody only when no qualified custodian is available.
MPC splits one key into shares, so a full key never exists in one place, and the chain sees a normal signature. Multisig uses several full keys and an on-chain rule, which is transparent but chain-specific.
Many custodians carry crime or specie policies, but coverage and limits differ by provider. Ask what is covered for hot versus cold storage and whether internal theft is included.
The answer depends on asset segregation and the customer contract. MiCA requires crypto-assets held for clients to be operationally segregated from the provider’s estate. NYDFS guidance says the customer’s beneficial interest in virtual currency remains with the customer.
