What Is Crypto Custody? Types, Risks & How It Works

In a single 24-hour window, hackers drained $1.5 billion from the Dubai-based Bybit exchange, marking the largest single heist in cryptocurrency history. 

It was the centerpiece of a broader $3.4 billion in digital assets stolen throughout 2025, according to Chainalysis.

Every crypto holder eventually runs into the same question: if something goes wrong, a hack, a lost password, an exchange collapse, who’s responsible for getting your money back? 

In most cases, nobody is. There’s no central authority to reverse a transaction or recover stolen funds if the key is lost, the assets are gone forever.  

That single fact makes custody the most important decision most crypto holders never think carefully about. Whether the Bybit-style risk lands on you personally depends almost entirely on how your crypto is custodied.

There's no Call To Action with the ID #0.

Key Takeaway

• Custody means control, not ownership on paper. Whoever holds the private key controls the funds, there’s no way to reverse or recover a lost transaction.
• Every model trades control for convenience. Self-custody gives full control with no safety net; third-party custody offers support but adds counterparty risk.
• U.S. regulation is still catching up. Regulators missed the GENIUS Act’s July 18, 2026 deadline for final stablecoin rules. 
• Hacks are getting more frequent, not less risky. H1 2026 saw a record 207 incidents, even as total losses fell below 2025’s pace. 
• There’s no single “best” option. The right custody choice depends on your portfolio size, risk tolerance, and how much control you want

What is Crypto custody 

Crypto custody is the practice of securely storing and managing the private keys that control access to cryptocurrency essentially, who holds the keys and how well they’re protected.

Public Keys vs. Private Keys

To understand custody, you need to understand the two-key system that makes crypto ownership work.

A public key is a cryptographic address derived from the private key. It’s visible on the blockchain and used to receive funds.

Anyone can see it, and anyone can send crypto to it. There’s no risk in sharing it, it’s the equivalent of giving someone your bank account number.

The private key is a cryptographically generated string of characters that authorizes transactions and proves ownership of the assets. 

It functions as the sole signing authority for the wallet. Whoever has this key can move the funds, no ID check, no second opinion needed. And unlike a bank password, there’s no “forgot password” link.

Types of Crypto Custody

Not all custody looks the same, and this changes who can move your money, what happens if something goes wrong, and whether you have any recourse at all. Here’s how the main models actually work.

Self-Custody

Self-custody is what most people picture when they think of “owning crypto” in the purest sense. The owner of the wallet manages their own private keys using proprietary infrastructure or hardware wallets like Ledger, with full control but also full operational burden and key-person risk.

Nobody can freeze your funds, ask for ID, or lock you out, but nobody’s coming to save you if something goes wrong, either.

• Hardware wallets (e.g., Ledger, Trezor): Physical devices that store private keys offline, signing transactions without exposing keys to the internet.
• Software/mobile wallets: Apps that hold keys on a connected device are convenient, but more exposed to malware and hacks.
• Seed phrases and recovery risk: The recovery phrase is the only backup; lose it and the funds are gone, with no reset option.

Pros:

• No exchange or custodian can freeze, lose, or mismanage your funds
• No counterparty risk, nothing to fail except your own setup
• Full, direct control over when and how funds move

Cons:

• No recovery mechanism if the seed phrase is lost or destroyed
• Full responsibility for security falls on you alone
• Mistakes (wrong address, malicious approval, phishing) can’t be reversed or refunded

Third-Party (Custodial) Custody

Third-party custody flips the trade-off. A regulated provider stores and manages private keys on the owner’s behalf, which means you’re trading direct control for convenience and, ideally, professional-grade security. 

Not all third-party custody is the same, though it spans a wide range, from a basic exchange account to custody infrastructure purpose-built for institutions.

• Centralized exchange custody: The simplest onboarding path to buy, hold, and trade in one account, no wallet setup required. The catch is that your crypto sits in the exchange’s wallets, not yours, so you’re exposed if the exchange is hacked, mismanaged, or insolvent.

• Dedicated institutional custodians (Fireblocks, Anchorage, BitGo, Copper, Cobo, ChainUp): These providers exist purely for custody, not trading, and are built around segregated accounts, multi-signature approval, and audit trails aimed at businesses and funds rather than retail traders.

• Bank-offered custody (BNY Mellon, Standard Chartered, Citi’s 2026 entry): Traditional banks entering custody bring existing regulatory relationships and balance sheets, which appeals to institutional clients who want crypto exposure inside a familiar banking relationship rather than a crypto-native platform.

There's no Call To Action with the ID #0.

Hybrid Custody Models

Hybrid custody exists because self-custody and  third-party custody each solve one problem while creating another. A business, for example, wants the security infrastructure of an institutional custodian without a single employee or a single hacked device being able to move all the funds. Hybrid models split control instead of concentrating it.

Pros:

• Professional-grade security infrastructure, often with insurance coverage
• No need to manage seed phrases or private keys yourself
• Easier onboarding, account recovery, and customer support if something goes wrong

Cons:

• You don’t control the private keys, the provider does
• Exposure to counterparty risk if the provider is hacked, mismanaged, or becomes insolvent
• Withdrawals can be delayed or frozen by the provider’s own policies. The Collapse of Mt. Gox and FTX remain powerful reminders that convenience comes with counterparty risk.

Read Also: Custodial vs Non-Custodial Wallets in Crypto: What’s the Difference?

U.S. Regulatory Landscape for Crypto Custody in 2026

Custody rules aren’t set in stone, new legislation and regulatory frameworks are actively reshaping who can hold digital assets and how. Here’s where U.S. regulation currently stands, and what’s still unsettled.

The GENIUS Act

The Guiding and Establishing National Innovation for US Stablecoins Act is the framework governing who can issue payment stablecoins in the United States, under what conditions, and at what cost.  

It assigns rulemaking to six federal agencies: the OCC, Federal Reserve, FDIC, NCUA, Treasury, and FinCEN, covering reserve composition, capital requirements, AML compliance, redemption obligations, and licensing standards.

July 18, 2026 compliance deadline and implementation risk

The GENIUS Act’s July 18, 2026 deadline for finalizing stablecoin rules has passed without action. Regulators proposed ten rules across Treasury, the OCC, FDIC, and NCUA, but none were finalized, and the statute has no fallback for a missed deadline. 

This leaves issuers and custodians operating on drafts rather than settled rules. The framework still takes effect by January 18, 2027 or 120 days after final rules land, but uncertainty continues until then.

Risks and Failure Points in Crypto Custody

Every custody model has a weak point, the question is never “is this safe?” but “what specifically can go wrong, and who bears the loss when it does?”

Self-Custody Risks

• Lost or destroyed recovery material

The seed phrase is the only backup a self-custody wallet has. If the key is lost, the assets are gone forever  (BitMEX) — there’s no support line to call and no way to reset access.

• Phishing and malicious smart contract approvals

A fake site or a spoofed “approve” prompt can trick someone into signing away access voluntarily. The key is never technically stolen; it’s handed over.

• Single point of failure (no recovery mechanism)

One mistake, a lost phrase, a coerced signature, a wrong click can be final. There’s no second signer and no fraud department to reverse it.

Third-Party Custody Risks

• Counterparty risk

The collapses of Mt. Gox and FTX remain powerful reminders that convenience comes with counterparty risk your funds are only as safe as the provider’s solvency and integrity.

• Withdrawal delays and platform freezes

Access delays in exchange custody can happen during volatility or security incidents, and users have no control over when access returns.

• No direct control over keys

You’re fully dependent on the provider’s security practices and internal controls, a breach or mismanagement on their end becomes your loss too.

Hybrid Custody Risks

• Added operational complexity

Splitting holdings across self-custody and a third party means more moving parts to manage, more logins, more devices, more chances for a setup mistake.

• Coordination failure in co-signing arrangements

If a delegated or multi-party approval process isn’t set up correctly, it can create delays or deadlock when funds actually need to move.

• Partial exposure to both models’ weaknesses

Hybrid setups reduce risk concentration, but they don’t eliminate it, the self-custodied portion still carries key-loss risk, and the custodied portion still carries counterparty risk.

2025–2026 Theft Data and Trends

Chainalysis recorded $3.4 billion stolen from January through early December 2025, with the Bybit attack on February 21, 2025 accounting for nearly $1.5 billion of that total in a single day.

North Korean state-aligned hackers were responsible for $2.02 billion of the 2025 figure, a 51% year-over-year increase. Looking at the top incidents, the three largest hacks combined drove 69% of all 2025 service-side losses. 

Other trackers with wider scope, including scams, put the number higher, PeckShield’s analysis put total crypto losses at $4.04 billion for 2025, with hacks accounting for $2.67 billion and scams rising 64% over 2024.

Choosing the Right Crypto Custody Solution

Every custody option trades off control, convenience, and risk differently, so the “right” choice isn’t universal, it depends on what you’re actually optimizing for. Here’s how to ask the right questions and match a solution to your specific situation.

Who controls the keys?

This is the single most important question — it determines whether you have direct control or you’re trusting someone else. Everything else about a custody decision follows from the answer.

What are the recovery options?

Ask what happens if a device is lost, a password is forgotten, or an employee with access leaves. Self-custody usually has none; third-party providers vary widely in what they offer.

Is the provider regulated/insured?

Regulation and insurance don’t guarantee safety, but they signal accountability and give you recourse if something goes wrong. Ask specifically what’s covered and under what conditions.

What’s the withdrawal process and any delay windows?

Some providers process withdrawals instantly; others build in review periods or multi-day holds. Know this before you need to move funds urgently, not after.

Red Flags to Watch For in a Custody Provider

Some warning signs are worth treating as disqualifying rather than just cautionary. Watch for vague answers about where and how keys are actually stored, reluctance to explain audit or insurance coverage in specific terms, unusually high yields on custodied assets, and any provider unwilling to detail their withdrawal process and typical delay windows in writing.

There's no Call To Action with the ID #0.

Conclusion 

Every custody model ultimately answers the same question: who holds the private key, and what happens when something goes wrong. There’s no central authority in crypto to reverse a transaction or recover stolen funds, the key is the only thing that matters. 

No single option is “correct.” Self-custody gives full control but no safety net. Third-party and institutional custody offer support and compliance, but the collapses of Mt. Gox and FTX are reminders that convenience comes with counterparty risk.

Hybrid models exist because most serious holders eventually avoid putting all their risk in one place. The safest move is matching your custody choice to your own risk tolerance and portfolio size, not defaulting to whatever’s easiest.

FAQs