Crypto custody is a safekeeping arrangement that determines who controls the private keys behind a digital asset, whether that is the owner, an exchange or a regulated custodian, and therefore who can move the asset and who bears the loss if something fails. The same Bitcoin balance can sit in a hardware wallet in a drawer, in an exchange account or at a bank-supervised vault, and the legal position of its holder differs in each case. This guide is educational and not financial or legal advice.
What is crypto custody?
Crypto custody is the holding and control of the private keys that authorize transfers of a digital asset such as Bitcoin or Ethereum. Whoever holds the keys can spend the asset, which is why how the underlying blockchain records ownership matters less for safekeeping than who can sign for an address. FINRA says storing and securing crypto assets mainly comes down to securing private keys, and that investors either use a custodian or hold the keys themselves.
- Custody
- Control over the private keys of an asset. In US securities law, "custody" has its own definition, which is why exchange accounts and wallets are not interchangeable with the legal term.
- Private key
- The secret number that signs transactions. Lose it and the asset is stuck; leak it and the asset can be taken.
- Recovery phrase
- A list of words that regenerates a wallet's keys, defined for many wallets by BIP-39, the Bitcoin standard for mnemonic codes. Anyone holding the phrase holds the funds.
- Qualified custodian
- A legal category under the SEC's Advisers Act custody rule, not a synonym for any firm that holds crypto. It covers specific entity types such as banks and registered broker-dealers.
- Wallet versus custody
- A wallet is a tool for storing keys. A cold wallet can be self-custodied by its owner or held by an institutional custodian on the owner's behalf.
Self-custody, exchange custody and qualified custodians
Digital asset custody falls into three models, and the difference is who holds the keys when something goes wrong. FINRA notes that crypto trading platforms are not registered national securities exchanges and lack broker-dealer protections, so an account at Coinbase or Kraken is a different thing from an arrangement with a qualified custodian. The collapse of FTX is the standard reminder that exchange custody carries counterparty risk.
| Model | Who holds the keys | Protection if the provider fails | Main risk | Typical user |
|---|---|---|---|---|
| Self-custody | The owner | No provider involved; the owner bears any loss | Lost or stolen recovery phrase | Individual holders |
| Exchange custody | The platform | Depends on the platform's terms and segregation | Platform insolvency or commingling | Active traders |
| Qualified custodian | A supervised third party | Depends on charter, supervisor and segregation rules | Sub-custodian and operational failures | Advisers, funds, companies |
Wallet hardware sits underneath all of this. The hardware, software and paper wallet types and their trade-offs are covered separately, including devices from Ledger and Trezor and software such as MetaMask. What matters here is that a wallet type does not decide the custody model.
Holding Bitcoin in self-custody
- Generate the keys on a hardware wallet rather than on a general-purpose computer.
- Record the recovery phrase offline, following the BIP-39 mnemonic specification, on durable media.
- Store copies in separate secure places so one fire or theft does not take everything.
- Test a restore with a small amount before moving a large balance.
- Plan how heirs could regain access without exposing the keys in the meantime.
How custodians secure keys: cold storage, multisig and MPC
Crypto custody providers protect private keys with storage and signing techniques, and these are security methods rather than custody categories. A self-custody user and a bank can both rely on cold storage or on a multisignature wallet. The terms below recur in custodian marketing, so their meaning is worth fixing.
- Cold storage
- Keys kept on devices that are offline or rarely connected, which shrinks the exposure to remote attacks at the cost of slower withdrawals.
- Multisignature (multisig)
- A wallet that needs several separate keys to approve one transaction, so no single stolen key can move funds. Multisig is enforced on the blockchain itself.
- Multi-party computation (MPC)
- A cryptographic method where several parties jointly produce a signature without any of them holding the full key. As of October 2026, Gemini describes its custody as signing transactions with multi-party computation without assembling the complete private key.
- Hardware security module (HSM)
- A hardware security module is a tamper-resistant device that generates and uses keys internally. The NIST Cryptographic Module Validation Program, run jointly with Canada's national cybersecurity agency, validates modules against FIPS 140-3; a custodian's marketing claim of an HSM does not itself prove a validated module.
Who are the largest crypto custodians?
No regulator publishes an official ranking of the largest crypto custodian, and the order changes with the metric and the date, so this guide names none. The table below lists several providers and how each describes its own service as of October 2026. Each description is the provider's own.
| Provider | Provider type | How it describes its custody | Where to verify |
|---|---|---|---|
| Coinbase Prime | Exchange-affiliated platform | Institutional custody and trading, covered in the guide below this table | Coinbase's own site and regulatory filings |
| Anchorage Digital | Federally chartered crypto bank, per its own description | Qualified, federally regulated custody | Anchorage Digital site |
| BitGo | Custody and wallet platform whose BitGo Bank & Trust is an OCC-chartered national trust bank, per its own description | Self-custody and regulated custody wallets, hot and cold | BitGo site |
| Gemini Custody | Gemini's custody service | Regulated custody secured with MPC | Gemini custody page |
| BNY | Global bank | Says it is one of the first G-SIBs to offer regulated digital asset custody in the European Union | BNY digital assets page |
Coinbase Prime is the institutional arm of a large exchange, and how a regulated exchange built an institutional custody and trading business is covered in its own guide. Anchorage Digital, BitGo, Gemini Custody and BNY show how different the field is: a crypto-native bank, a wallet platform with its own OCC trust charter, an exchange affiliate and a legacy bank each use the word custody for somewhat different services.
The rules: SEC, bank regulators and state trust companies
US rules for crypto custody depend on who the client is and who the custodian is. The list below is a dated snapshot, and the SEC item is a proposal, not final law.
- As of October 2026, per the SEC's proposing release IA-7023, the Advisers Act custody rule (Rule 206(4)-2) requires an adviser with custody to keep client funds and securities with a qualified custodian: a bank or savings association, a registered broker-dealer, a registered futures commission merchant or certain foreign financial institutions, subject to exceptions.
- As of October 2026, per the same IA-7023 release, published in the Federal Register on Oct. 6, 2026, the SEC proposed amendments that are not final law, with comments due Dec. 7, 2026. They would allow advisers to hold client crypto in "self-custody" only when no permitted custodian is available, determined quarterly, and would add eligible state trust companies as permitted custodians on an annual reasonable-basis determination. For ordinary advisory clients, the proposal applies only to crypto assets that are funds or securities; for a regulated fund's account it applies to crypto assets that are securities or similar investments, which would include Bitcoin or Ether an adviser self-custodies for the fund. Commissioner Hester Peirce's statement on the proposal notes that "self-custody" here means the adviser holds the keys, not true investor self-custody.
- As of October 2026, per the OCC, Interpretive Letter 1170 (July 22, 2020) says a national bank may provide crypto custody, including by holding the keys. Letter 1183 (March 7, 2025) reaffirms prior custody, distributed ledger and stablecoin positions and rescinds Letter 1179. Letter 1184 (May 7, 2025) confirms banks may buy and sell assets held in custody at the customer's direction and outsource custody and execution to third parties, subject to third-party risk management.
- As of October 2026, per the NYDFS, a state trust company chartered as a limited purpose trust company can custody virtual currency as a fiduciary. The NYDFS industry letter of Sept. 30, 2025 expects custodians to practice asset segregation and separate accounting of customer virtual currency, and addresses limits on the custodian's use of customer assets, sub-custody controls and customer disclosure.
This is a US overview, not legal advice.
Risks and how to evaluate a custodian
Crypto custody risk starts with custodian insolvency and commingling of customer assets. The SEC's Office Hours with Gary Gensler (Feb. 21, 2023) warns that when crypto companies fail, customer assets can end up as property of the failed company, leaving customers waiting in bankruptcy court. Exchange custody is exposed to this risk in a way that a supervised qualified custodian, bound by segregation rules, is meant not to be. Other risks are key loss, dependence on a sub-custodian, insurance exclusions and rehypothecation, where a firm lends out customer assets; what happens to assets once they move into DeFi lending protocols shows the same exposure in protocol form with Aave, Compound and Uniswap.
- Charter and supervisor: which regulator oversees the entity that holds the keys.
- Asset segregation: whether customer assets are held apart from the firm's own, as the NYDFS letter expects.
- Audit reports: independent auditors issue a SOC 1 report or a SOC 2 report, as described by the AICPA. A Type 2 SOC 2 report covers a period of operation rather than a single date.
- Proof of reserves: attestations often use a Merkle tree to show customer balances roll up into a total. A proof of reserves without a matching view of liabilities proves little.
- Insurance terms: the limits, what the policy covers and what it excludes. A large insurance figure means little until those are known.
- Sub-custodian disclosure: which third parties actually hold the keys.
Keys must also be recoverable by heirs, and a lawyer can advise on how to arrange that.
Custody for tokens beyond Bitcoin, such as XRP
Crypto-asset custody differs by chain, and XRP shows how.
- XRP Ledger accounts must hold a base reserve plus an owner reserve per owned object, and reserve requirements change through validator voting.
- Exchange deposits of XRP usually need a destination tag so the exchange credits the right customer.
- On Ethereum, ERC-20 tokens add smart-contract exposure beyond the keys themselves.
- Staking and signing work differently on proof-of-stake chains such as Solana and Cardano.
- Asset support varies by custodian, so a provider that holds Bitcoin may not hold a given token.
A token's legal classification changes which rules apply. Under the SEC proposal, native assets such as Bitcoin generally fall outside the adviser custody rule for ordinary clients because they are not funds or securities, but they would be covered when an adviser self-custodies them for a regulated fund.
Which custody model fits whom
Digital asset custody choices differ by holder, and this table describes common patterns rather than recommendations.
| Holder | Usual custody model | Main rule or consideration | Main risk |
|---|---|---|---|
| Individual | Self-custody or exchange custody | Owner controls the keys, or relies on platform terms | Key loss or platform failure |
| Registered investment adviser or fund | Qualified custodian | SEC custody rule and the pending IA-7023 proposal | Rules may change after comments |
| Company treasury | Bank or state trust company custodian | OCC letters for banks; NYDFS guidance for New York trust companies | Sub-custodian dependence |
The questions below cover the points readers raise most often.
Frequently Asked Questions
What is XRP custody?
XRP custody is the safekeeping of the private keys that control XRP held on the XRP Ledger, either by the owner or by a third-party custodian. XRP accounts also carry a ledger reserve that stays locked in the account, and exchange deposits usually need a destination tag to credit the right customer. Check the XRPL documentation for current reserve values before you move funds.
How do you hold Bitcoin in self-custody?
You hold Bitcoin in self-custody by generating and storing the private keys yourself, usually in a hardware wallet backed up with a recovery phrase. Write the phrase on durable media, keep copies in separate secure places, and test a restore with a small amount first. Nobody can recover the funds for you if the phrase is lost.
Who is the largest crypto custodian?
No regulator publishes an official ranking, so the answer depends on the metric and the date. Assets under custody, number of clients, and regulated status each give a different order. Compare named custodians on charter, audits and segregation practices instead of on a single league-table claim.
Is crypto held on an exchange the same as qualified custody?
No. An exchange account is not automatically a qualified custodian arrangement, because that term has a specific legal meaning under the SEC custody rule for investment advisers. FINRA notes that crypto trading platforms are not registered national securities exchanges and do not carry broker-dealer protections. Whether customer assets are segregated and who holds the keys decides your position if the platform fails.
