Crypto Custody
Safeguarding the private keys to Bitcoin or other cryptocurrencies — yourself (self-custody) or by delegating it to a professional provider that is accountable for their security.
Definition
Crypto custody is the management and safeguarding of the private keys that grant control over Bitcoin and other crypto assets. Unlike money in a bank, a cryptocurrency belongs to whoever holds its keys: that is why the question "who holds the keys?" defines the entire security model. There are two broad answers: holding them yourself (self-custody) or delegating them to a professional third party (delegated custody).
Types of custody. In practice, three models coexist. (1) Exchange custody: the most common in retail — the exchange controls the keys and the user holds a claim against the platform; convenient, but it concentrates counterparty risk. (2) Institutional custodians: specialized providers — Coinbase Custody, Fidelity Digital Assets, BitGo, Anchorage, Xapo — that custody for funds, ETFs and corporate treasuries with fund segregation, insurance and audits. (3) Self-custody: the user holds their own keys in a cold or hot wallet; total control in exchange for fully assuming the operational risk. There are also hybrid models based on multisig, where the keys are split between the user, the provider and a backup third party.
How a professional custodian protects assets. The standard pieces are cold storage (keys generated and stored offline), multisig schemes that prevent any single person from moving funds, segregation between client assets and the provider's balance sheet, insurance policies against theft, and proof of reserves or external audits that verify the custodied Bitcoin actually exists.
Regulation. In Europe, the MiCA regulation requires custody providers (CASPs) to obtain authorization, meet capital requirements, segregate client assets and assume liability for their loss. In the United States, spot ETFs must use supervised qualified custodians. This regulatory layer is what has allowed institutional money to enter Bitcoin at scale.
Custody and ETFs: concentration matters. The vast majority of the Bitcoin held by US spot ETFs is custodied by a handful of providers — Coinbase Custody concentrates most of it. It is efficient, but it introduces a single point of failure that the market watches: that is why some issuers have diversified custodians and why proof of reserves has become standard.
Which model is best. It depends on the profile: for a company or corporate treasury, institutional custody offers auditable guarantees to shareholders and regulators without building in-house infrastructure; for an individual with a long horizon, well-executed self-custody eliminates counterparty risk («not your keys, not your coins»), in exchange for total responsibility — including planning the inheritance of the keys.
For the detail on the providers, solutions and services that listed companies, ETFs and treasuries use, see our guide to institutional crypto custody.
In Context
Coinbase Custody holds the underlying Bitcoin of IBIT, FBTC and most spot ETFs approved by the SEC.
Frequently Asked Questions
What is crypto custody?
The management and safeguarding of the private keys that control crypto assets. It can be done by the user themselves (self-custody) or by a professional provider (exchange or institutional custodian) that is accountable for the security of the funds.
What is the difference between custody and self-custody?
In delegated custody, a third party holds the keys and the user depends on its solvency and security; in self-custody, the user controls their keys directly and eliminates counterparty risk, but assumes all operational risk (loss, theft, inheritance).
Who custodies the Bitcoin held by ETFs?
Qualified institutional custodians. Coinbase Custody concentrates most of the BTC held by US spot ETFs (including IBIT and FBTC); other issuers use or combine providers such as Fidelity Digital Assets, BitGo or Anchorage to diversify.
Is it safe to leave cryptocurrencies on an exchange?
It depends on the exchange and the amount. The user does not hold the keys: they hold a claim against the platform, with counterparty risk (hacks, insolvency). For significant or long-term balances, self-custody or a regulated custodian with segregated funds is usually recommended.
What does MiCA require of crypto custodians in Europe?
Authorization as a crypto-asset service provider (CASP), capital requirements, segregation of client assets from the provider's own balance sheet, and liability to the client in the event of loss of the custodied crypto assets.
Related Terms
Read this term in Spanish: versión en español →