WWCWildWildCrypto

Wallet safety / Updated 2026-08-04

Crypto Custody Explained: How Custodians Hold Your Coins, and What Actually Protects Them

How professional crypto custodians hold your coins, what proof of reserves really proves, why crypto isn't FDIC-insured, and the FTX lesson behind it all.

How this guide is checked

Official sources first, no wallet connection, no guaranteed returns.

Reviewed on 2026-08-04 by WildWildCrypto Safety Desk. Method: Human editorial review with official-source checks, affiliate-disclosure checks, and no-financial-advice checks.

Publisher: WildWildCrypto Editorial. Corrections go through the contact page. We do not ask for seed phrases or tell you what to buy.

crypto custody explained matters because When your crypto sits on an exchange or with a custodian, someone else holds the keys — and most people have no idea what that company is actually doing with their coins, or what would happen if it failed.

This guide explains how professional custody really works, what proof of reserves and custody insurance do and do not protect, and how to decide where your holdings should live.

You will learn the two custody models, how custodians store keys, what proof of reserves leaves out, why crypto is not FDIC-insured, and the FTX lesson underneath it.

What does 'crypto custody' actually mean?

Custody is simply the question of who controls the private keys. There are two models. In custodial custody, a company — an exchange, a broker, or a dedicated custodian — holds the keys on your behalf; you have an account balance and a login, but the company controls the coins. In self-custody, you hold the keys yourself, usually in a software or hardware wallet, and no third party can move your funds. The trade is control for convenience: custody gives you password recovery, support, and fast in-app trading, while self-custody gives you sole control and no counterparty who can freeze, lose, or misuse your assets.

This guide is about the custodial side — how the companies that hold crypto for others actually do it, and what the safeguards you hear about really mean. If your question is the personal one of whether to keep your own coins on an exchange or in your own wallet, our exchange-versus-self-custody guide covers that decision directly; here the goal is to understand what is happening on the other side of a custodial balance.

Checklist

  • Custody = who controls the private keys.
  • Custodial: a company holds your keys (exchange, broker, custodian).
  • Self-custody: you hold your own keys, no counterparty.
  • The trade-off is convenience and recovery versus sole control.

How do professional custodians hold crypto?

Serious custodians do not just leave coins in a hot wallet. The keys that control client assets are typically kept in cold storage — generated and held offline, away from any internet-connected system — and increasingly split so that no single person or device holds a complete key. Two common techniques do this: multi-signature setups require several separate keys to approve a transaction, and multi-party computation (MPC) splits a single key into shares held in different places, so a transaction can be signed without any one location ever holding the whole key. Layered on top are access controls, withdrawal approvals, audits, and — critically — segregation, meaning client assets are kept separate from the custodian's own operating funds.

A 'qualified custodian' is a regulated version of this: a licensed provider that stores keys under compliance and reporting obligations, keeps client accounts segregated, and usually carries insurance. Institutions gravitate to these providers — names like Coinbase Custody, BitGo, Fidelity Digital Assets, and Anchorage — because fiduciary duties and regulators expect it. For a retail reader, the useful takeaway is what 'good custody' looks like: offline keys, no single point of key control, segregated client funds, real audits, and a regulator the provider answers to.

Checklist

  • Good custody uses cold (offline) storage, not hot wallets.
  • Multi-sig or MPC means no single key or person can move funds alone.
  • Client assets are segregated from the company's own money.
  • Qualified custodians add regulation, reporting, audits, and insurance.

Proof of reserves: what it proves and what it doesn't

After FTX, 'proof of reserves' became the transparency signal exchanges point to. It usually has two parts: evidence of assets — wallet addresses the platform controls, or an accountant's attestation of holdings — and a Merkle tree of hashed customer balances that lets each user cryptographically confirm their own account was included in the published total. Done well, it lets you check that the platform holds coins and that your balance is counted among the liabilities it claims.

What proof of reserves does not do is prove solvency. It shows assets, but usually not the full picture of liabilities: a platform can display a wall of coins while owing far more than it holds through off-chain debts a reserves snapshot never captures. It is also point-in-time — a platform could borrow assets, pass the snapshot, and return them the next day — and it says nothing about whether keys are secure or management is honest going forward. Treat proof of reserves as a genuine improvement and a useful filter (a platform that refuses to publish any is a red flag) but as one signal among several, never a guarantee that your funds are safe.

Checklist

  • Proof of reserves = assets evidence + a Merkle tree you can verify against.
  • It proves coins are held and your balance is counted.
  • It does NOT prove liabilities, ongoing solvency, or honest management.
  • It's point-in-time and gameable — a useful filter, not a guarantee.

The FTX lesson: why these rules exist

Every one of these safeguards exists because of failures, and FTX is the defining one. When the exchange filed for Chapter 11 bankruptcy in November 2022, it faced an estimated shortfall of around $8 billion in customer funds. The mechanism was not an exotic hack — it was the absence of the basics above. Customer assets were commingled with the company's own operating and trading capital, and customer funds were used to back margin positions and venture bets. There was no meaningful segregation and no independent proof that the coins customers saw in their accounts still existed.

The lesson the industry drew is exactly the checklist a custodian should meet: keep client assets segregated, prove reserves transparently, and submit to real oversight. It is also the origin of the mantra 'not your keys, not your coins' — a reminder that a balance shown in an app is a claim on a company, and only keys you control are ownership that no third party's collapse can erase. (Under a plan approved in 2024, most FTX creditors are being repaid in full and then some — but in dollars valued as of the November 2022 bankruptcy date, not the crypto they had deposited, so they missed the price recovery that followed, and it still took years of proceedings to arrive.)

Checklist

  • FTX filed Chapter 11 in Nov 2022 with a ~$8B customer shortfall.
  • Cause: commingling customer funds and using them for the firm's own bets.
  • The fix is the basics: segregation, proof of reserves, real oversight.
  • 'Not your keys, not your coins' — an app balance is a claim, not ownership.

Is custodied crypto insured?

Less than most people assume. Government deposit insurance — the FDIC scheme that protects cash in a US bank account up to a limit — does not cover cryptocurrency. If a crypto platform or custodian fails, there is no government backstop that makes customers whole the way there is for an insured bank deposit, a distinction regulators have repeatedly stressed. That gap is one of the most misunderstood facts in crypto.

What can exist is private custody insurance that some custodians carry, and it is narrower than the word 'insured' suggests. These policies typically cover theft of keys through a cyberattack, insider theft by employees, fraudulent transfers from custodial wallets, and physical destruction of key material. They typically do not cover the losses people most fear: falling market prices, your own credentials being phished or reused, blockchain protocol failures, or regulatory seizure. Coverage is usually capped, too: a custodian insures a fixed policy tower — often a few hundred million dollars — against total client assets that can be far larger, so 'insured' rarely means every coin is covered. So 'our assets are insured' can be true and still leave you unprotected against the scenario that actually hits you. Read what a policy covers, and never assume a custodial balance carries bank-like protection.

Checklist

  • Government deposit insurance (like the FDIC's) does NOT cover crypto.
  • A failed platform has no government backstop for customers.
  • Private custody insurance covers key theft/hacks/insider/physical loss.
  • It does NOT cover market losses, your own credential compromise, or seizure.
  • Even private insurance is capped — it rarely covers every coin under custody.

What this means for you

Match custody to the amount and the purpose. For long-term holdings you do not need to trade, self-custody in a hardware wallet removes custodian risk entirely — no exchange failure, commingling, or frozen withdrawal can touch keys only you control, provided you handle your recovery phrase safely. For active trading or convenience, a reputable, regulated custodian or exchange that publishes proof of reserves and segregates client funds is a reasonable place to keep working balances — but treat what sits there as exposed to that company's survival, and keep no more there than you would accept losing if it failed.

The practical rule most experienced holders converge on is boring and effective: trade on a platform, store on your own keys. Use custodians for what they are good at — liquidity, access, and convenience — and use self-custody for what it is good at — durable ownership no third party can undo. And whichever you choose, remember that the safeguards in this guide reduce risk; none of them eliminate it.

Checklist

  • Match custody to the amount and how soon you need to trade it.
  • Long-term holdings: self-custody removes custodian risk entirely.
  • Working/trading balances: reputable, regulated, proof-of-reserves platforms.
  • Trade on a platform, store on your own keys — and keep no more on a platform than you'd accept losing.

Authority sources used

Outbound links are included for verification and entity authority, not decoration.

FAQ

What is crypto custody?

Crypto custody is about one thing: who controls the private keys that can move your coins. In custodial custody, a company such as an exchange or a dedicated custodian holds those keys for you — you have an account and a login, but the provider ultimately controls the assets and could freeze, lose, or misuse them. In self-custody, you hold the keys yourself in your own wallet, so no third party can touch your funds, at the cost of being solely responsible for your recovery phrase. Professional custodians hold client crypto using offline cold storage, key-splitting techniques like multi-signature or multi-party computation so no single person controls a whole key, and segregation that keeps client assets separate from the company's own money. The core idea to carry away is that a balance shown in an app is a claim on a company; only keys you personally control are ownership that no third party's failure can erase.

Does proof of reserves mean my money is safe on an exchange?

No — it helps, but it is not a safety guarantee. Proof of reserves is a platform's attempt to show it actually holds customer coins, usually by publishing wallet addresses or an attestation of assets plus a Merkle tree that lets you verify your own balance was counted in the total. That is genuinely useful, and a platform refusing to publish any proof of reserves is a warning sign. But it has real limits: it shows assets without necessarily showing liabilities, so a platform can appear full of coins while secretly owing far more through off-chain debts. It is also a point-in-time snapshot that could be passed with briefly borrowed funds, and it says nothing about whether the keys are secure or management is honest going forward. Treat proof of reserves as one helpful filter among several, never as proof that your funds are safe — the safest coins are still the ones whose keys you control yourself.

Is crypto held on an exchange FDIC insured?

No. Government deposit insurance such as the FDIC's, which protects cash in a US bank account up to a limit, does not cover cryptocurrency, and regulators have repeatedly stressed this. If a crypto exchange or custodian fails, there is no government scheme that makes customers whole the way there is for an insured bank deposit — recovery instead depends on bankruptcy proceedings that can take years, if funds are recovered at all. Some custodians carry private insurance, but it is narrower than it sounds: such policies typically cover theft of keys through hacking, insider theft, fraudulent transfers, or physical loss of key material, and typically exclude the things people most fear, including falling prices, your own login being phished, protocol failures, and regulatory seizure. So a platform can accurately say it has insurance while you remain unprotected against the scenario that actually affects you. Never assume a custodial crypto balance carries bank-like protection.

Should I use a custodian or hold my own keys?

It depends on the amount and what you are doing with it, and most experienced holders split the difference. For long-term holdings you are not actively trading, self-custody in a hardware wallet is the stronger choice because it removes custodian risk entirely — no exchange collapse, fund commingling, or frozen withdrawal can reach keys only you hold, as long as you protect your recovery phrase. For active trading, or simply for convenience, a reputable and regulated custodian or exchange that publishes proof of reserves and keeps client funds segregated is a reasonable place to keep a working balance — but treat whatever sits there as dependent on that company's survival and keep no more than you could accept losing. The rule many converge on is simple: trade on a platform, store on your own keys. Use each for what it does well, and remember that these safeguards reduce risk rather than remove it.