Custody Risk
The risk of losing access to digital assets because of how they are stored, whether by you or by a custodian.
Custody risk splits into two families with almost opposite mitigations. Self-custody risks are losing the key material, destroying or misplacing a backup, malware on a signing device, physical theft or coercion, and dying without a workable inheritance plan. Third-party custody risks are the custodian's insolvency, commingling of your assets with others, insider theft, hot-wallet compromise, and legal processes that freeze the account. Institutional practice reduces both with multi-signature or threshold signing, geographically separated key shares, dual control and audited procedures, withdrawal address allowlists with delays, and insurance policies whose limits and exclusions matter more than their existence. The unifying fact is that a public blockchain has no chargeback, no password reset, and no administrator who can reverse a settled transfer.
In practice
Custodians typically keep the large majority of assets in offline storage and only a small operating balance in internet-connected wallets, which limits the size of any single hot-wallet compromise.
The common misunderstanding
That custody risk is mainly about hackers, when a large share of permanent loss comes from lost keys, unusable backups, and entrusting assets to a firm that later fails.