What custody at a centralized exchange really means

A balance shown on a centralized exchange is a row in that company's database. The coins standing behind it, in whatever quantity actually exists, sit in wallets whose private keys the exchange controls, normally pooled with every other customer's holdings. What the customer owns is a claim on a business, and the strength of that claim depends on contract law and the exchange's internal controls rather than on cryptography.

The ledger inside the ledger

Most trades on a centralized exchange never touch a blockchain. When one customer buys from another, the venue debits one internal balance and credits another; nothing is broadcast, nothing is mined, no fee is paid to a network. On-chain settlement happens only at the edges, on deposit and on withdrawal. That is why a venue can match orders in microseconds for an asset whose network needs minutes to reach finality, and it is also why exchange trading volume and on-chain settled volume are measurements of two different things that happen to share a unit.

Customer coins are usually held in omnibus wallets, meaning one address holds the assets of many customers with the allocation tracked internally. An exchange serving a large customer base only needs to move coins on-chain when net flows demand it, so the observable on-chain footprint of a venue is far smaller than its reported activity. Aggregate deposits and withdrawals show up as exchange netflow, a figure that is frequently over-interpreted: it is a net number that hides internal rebalancing between an exchange's own addresses, and address attribution is an inference made by analytics firms rather than a fact published by the venue.

Hot wallets, cold storage and the withdrawal queue

Key management inside a venue is a spectrum. A hot wallet is connected to systems that can sign automatically, which is what makes instant withdrawals possible and what makes theft possible in the same motion. Cold storage keeps keys offline, often split across a multisignature wallet or an MPC wallet so that no single person or machine can move funds, at the cost of a human process measured in hours or days. A well-run venue keeps a small hot float and sweeps the rest cold, which means a large or sudden wave of withdrawals must be serviced manually.

The awkward consequence is that a slow withdrawal is ambiguous from outside. It is consistent with a prudent cold-storage policy, with an upgrade to node software, with a congested network, and with a venue that no longer holds what it says it holds. Nothing visible from the outside distinguishes them in the moment, which is why custody risk is usually recognized late.

What the claim is worth when the company fails

If a venue becomes insolvent, the question stops being technical and becomes legal. The governing documents determine whether customer assets were held on trust, segregated and bankruptcy-remote, or whether they were property of the estate and the customer is an unsecured creditor holding a bankruptcy claim. Commingling of client funds and rehypothecation are the mechanisms by which assets a customer believed were set aside end up financing the firm. The 2022 failures of Celsius, Three Arrows Capital and FTX ran through exactly these mechanisms, and the resulting claims were valued in dollars as of the petition date rather than returned as coins, which severs the claim from later price movement in either direction.

Some jurisdictions require a qualified custodian and impose segregation rules, and MiCA introduced a licensing framework in the European Union that entered application in 2024. Regulatory status changes who is supervising the controls; it does not change the fact that counterparty risk exists whenever someone else holds the keys.

One company performing four jobs

In a mature securities market, distinct entities act as broker, exchange, clearing house and custodian, and the separation exists because each function can be used against the others. A large digital-asset venue commonly performs all four at once, and frequently operates a proprietary trading desk, issues a token, runs a lending business and lists the assets it holds. None of that is inherently improper, and much of it is disclosed. It does mean that the checks a reader takes for granted elsewhere, such as an independent clearer that would notice a shortfall, may simply not exist. Where a jurisdiction has adopted market structure regulation, the usual remedies are segregation requirements, capital requirements, conflict disclosure and know your customer obligations, and the presence or absence of those rules is a more concrete distinction between venues than reputation is.

Proof of reserves and the half of the balance sheet it usually omits

A proof of reserves exercise typically publishes a Merkle tree of customer balances plus signed messages or addresses demonstrating control of coins. Done properly it lets an individual customer verify that their balance was included in the total that was matched against on-chain assets. Its limits are structural rather than incidental. It is a snapshot at one instant, so assets borrowed for the occasion satisfy it. It usually covers assets and not liabilities, so obligations owed off the reported ledger are invisible. It says nothing about whether the entity that signed also owes those coins to someone else. A reserve attestation from an accounting firm is scoped work, not an audit of the enterprise, and the scope is the part worth reading.

The trade the holder is actually making

Self-custody removes the company from the picture and replaces one failure mode with another. There is no counterparty to become insolvent and no withdrawal queue, and there is also no password reset, no fraud department and no reversal. Key loss, a mistyped address, a compromised seed phrase and a signature approved without reading it are permanent in a way that no consumer financial product is. Neither arrangement is safe in general; they fail differently, and the failures are not correlated.

A useful discipline when reading any venue-level figure is to ask which ledger produced it. Exchange volume comes from an internal matching engine, 24-hour volume aggregates across venues that each define a trade differently, and only settlement figures come from a chain. The risk pages set out custody and counterparty exposures asset by asset, incidents records what has actually failed and how, and exchange-traded products covers the regulated wrapper where custody is delegated to a named institution.