Custody and self-custody, weighed honestly
Holding keys directly removes one category of risk and adds another, and the tradeoff is operational rather than ideological.
Custody is the question of who can move an asset, and it has exactly two answers with a range of arrangements in between. Under self-custody, control of a private key is control of the asset, and no institution can freeze, lend or lose it. Under custodial holding, the asset sits in someone else's control and what is held is a claim on that institution. Each removes a class of risk that the other creates, and neither is safer in general.
How self-custody fails
Self-custody eliminates counterparty exposure and replaces it with operational exposure that falls entirely on the holder. The dominant failure is key loss: a seed phrase written once and stored in a place that floods, burns, is discarded during a move, or is simply forgotten. There is no reset process, because the absence of one is the design. The second failure is exposure of the backup, since anyone who reads the phrase has the asset, which makes photographs, cloud notes and password managers with weak recovery into single points of failure. The third is authorization error, where a valid signature is given to a malicious contract or a transaction is sent to a wrong or substituted address; the personal security article at the end of this track covers that pattern in detail. The fourth is succession: keys held by one person and documented nowhere are unrecoverable by heirs. These are human and procedural risks, and they are common.
How custodial holding fails
A custodian removes the key management problem and introduces the risk that the institution itself fails. Deposits at a trading venue are typically a general liability of the firm rather than segregated property, which is why commingling of client funds and rehypothecation, the reuse of client assets as collateral for the firm's own borrowing, are the two terms that matter most when reading terms of service. If the firm becomes insolvent, the customer usually becomes an unsecured creditor holding a bankruptcy claim, and recovery is partial, denominated by a court, and measured in years. Operational failures are also possible without insolvency: an internal compromise, a hot wallet breach, an outage during volatile conditions, or an account restriction imposed for compliance reasons. Regulated custodians reduce several of these through segregation requirements, capital rules and independent examination, but the protections vary substantially by jurisdiction and by the specific license held.
| Arrangement | Removes | Adds | Main open question |
|---|---|---|---|
| Single-key self-custody | Counterparty and insolvency risk | Key loss, backup exposure, no recovery | Where the backup lives and who else can reach it |
| Multisignature or MPC | Single points of failure in keys | Setup complexity, coordination, signer availability | Whether signers and their backups are truly independent |
| Trading venue account | Key management entirely | Insolvency, commingling, restriction risk | Whether assets are segregated and what the terms actually say |
| Qualified custodian | Key management, with segregation duties | Fees, access limits, jurisdictional dependence | Which regime applies and what it requires in a failure |
| Exchange-traded product | Keys, and integration with existing accounts | Fees, market hours, no on-chain use, tracking effects | What the fund holds and who its custodian is |
The arrangements in between
Most of the practical progress is in configurations that avoid both extremes. A multisignature setup requires several keys held in different places to approve a transfer, so one lost or stolen key is survivable, at the cost of a more complex recovery and the need for signers to be reachable. Multi-party computation splits a single signing key into shares that never combine on one device, achieving something similar with different operational properties. Distributed backups, geographic separation and a documented recovery procedure address succession. On the custodial side, segregated accounts at a regulated custodian differ meaningfully from an omnibus balance at a trading venue, and the difference is contractual and legal rather than technical.
Underneath every one of these arrangements is a single tension that cannot be designed away. The secret must be reliably reachable by its owner and reliably unreachable by everyone else, and almost every measure that improves one side degrades the other. Additional backup copies reduce the chance of loss and increase the number of places a thief can look. Splitting a key across several holders removes single points of failure and creates the possibility that a genuine owner cannot assemble a quorum after a move, a death or a falling-out. Handing the problem to an institution removes it entirely and substitutes that institution's solvency. Choosing between these is an assessment of which failure is more likely in a specific set of circumstances, not a question with a general answer.
Products that hold on a holder's behalf
An exchange-traded product converts the question into a securities relationship. United States spot bitcoin exchange-traded funds began trading in January 2024, joining a range of similar products elsewhere. These remove key management and the venue insolvency question, and add a management fee, trading only during market hours, no ability to use the asset on-chain, and dependence on the fund's own custodian. On this site, the share of supply held by exchange-traded products shows how much of an asset has moved into that structure.
What the available evidence proves
Proof of reserves is often presented as settling the custodial question and does not. A reserve statement typically demonstrates control of assets at a moment in time. It does not show liabilities, so it cannot show solvency; it does not prevent assets being borrowed for the snapshot; and it says nothing about obligations recorded off-chain. An attestation performed by an accounting firm against agreed procedures is a narrower exercise than a full audit, and the distinction is stated in the report itself. The honest position is that custodial solvency is not directly verifiable from outside, which is precisely why the 2022 failures examined next were not caught in advance.
Counterparty risk, covered next, follows this thread into what actually happened when several large custodial businesses failed in the same year. The glossary defines each arrangement above, and the ETF pages cover product structures in more depth.