How crypto custody works: keys, exchanges and counterparty risk

A blockchain records balances against addresses. Authority to move a balance comes from a private key that can sign a transaction for that address. Custody, in crypto, is simply the question of who holds that key.

Self-custody

In self-custody you generate and store the key yourself, usually as a recovery phrase held in a software or hardware wallet. No intermediary can freeze your funds, and no intermediary can fail and take them with it. The trade-off is absolute: lose the phrase and the assets are unrecoverable; disclose it and they are gone.

Custodial accounts

When you buy on an exchange, the exchange typically holds the keys and credits your account in its own ledger. Trades between users may never touch the chain. Your position is a contractual claim against the platform, and its value depends on the platform's solvency, its segregation of client assets, and the insolvency law of its jurisdiction.

What the regulation now requires

The EU's Markets in Crypto-Assets Regulation (MiCA) creates an authorisation regime for crypto-asset service providers, including custody obligations such as segregating client holdings from the firm's own and maintaining a custody policy. Rules elsewhere vary substantially, and 'regulated' can mean anything from full prudential supervision to registration for anti-money-laundering purposes only.

Questions worth asking a custodian

• Which legal entity holds the assets, and under which regulator?
• Are client assets segregated from the firm's own balance sheet?
• What proportion is held in cold storage, and who controls withdrawal approvals?
• What happens to client assets if the entity enters insolvency?
• Is there insurance, what does it actually cover, and who is the named insured?

A proof-of-reserves attestation shows assets at a point in time. Without a corresponding, audited statement of liabilities, it does not establish solvency.