What Is Crypto Custody?

On a blockchain, control of an asset is control of its private key — transfers are irreversible and there is no central authority to reset a password or claw back funds. Lose the key and the assets are gone; expose it and they can be stolen.

That makes custody a core security decision: either take on the responsibility of self-custody, or place trust in a third party whose controls, regulation, and track record you have assessed.

Self-custody means the owner holds their own keys, typically in hardware or software wallets. Third-party or qualified custody means a regulated provider safeguards assets on a client's behalf.

Keys are also managed along a hot-to-cold spectrum — hot wallets are online for fast access, cold storage is kept offline for security — and increasingly with multisignature or multi-party computation (MPC) so that no single person or device holds a complete key.

Robust custody combines several controls: offline cold storage and hardware security modules (HSMs); MPC or multisignature so key material is split; withdrawal whitelists, limits, and multi-approval workflows; segregation of duties; audited operational procedures; and, for many providers, insurance against theft.

Institutions often must use a qualified custodian, segregate client assets from company assets, enforce governance and approval workflows, maintain disaster-recovery and key-backup procedures, and provide assurance such as audits or proof of reserves. The right model depends on asset types, transaction frequency, regulatory obligations, and risk tolerance.