Crypto custody explained: how exchanges and custodians hold your coins

Crypto custody is the question of who controls the private keys to your coins and on what legal terms. If you keep the keys yourself, you hold the coins directly; if an exchange or custodian holds them, you depend on how it stores them, whether it keeps them apart from its own assets, and whether it may lend or reuse them. Those last two points decide what you get back if the firm fails.

This guide covers keys and wallets, segregation, the EU and New York rules, and the lessons of FTX and Celsius. It does not recommend any exchange, custodian or wallet.

Keys, wallets and what “holding” a coin means

The SEC’s investor education office explains that a crypto wallet stores the private keys, the passcodes that authorise transactions, rather than the assets themselves. Whoever has the private key can move the coins at that address.

Each wallet comes with a pair of keys. The public key lets others send you coins and verify transactions, a little like an email address. The private key works like the password: it cannot be changed or replaced once created, and if it is lost, access to the coins is lost for good. Many wallets also generate a seed phrase, a sequence of words that can restore the wallet, which the SEC bulletin says should be stored securely and never shared.

Wallets come in two broad kinds:

• Hot wallets are connected to the internet, as desktop, mobile or web applications. They are convenient for trading but exposed to cyber threats.
• Cold wallets are kept offline, for example on a hardware device or even paper. They are generally more secure from hacking but can be lost, damaged or stolen.

Self-custody versus third-party custody

With self-custody you hold the private keys yourself. Nobody else can freeze, lend or lose your coins, but nobody else can recover them either. If the keys or the seed phrase are lost, stolen or hacked, the SEC warns, you may permanently lose access.

With third-party custody an exchange or a dedicated custodian holds the keys for you. When you buy coins on a typical exchange and leave them there, what you have is the exchange’s record that it owes you those coins, while the exchange controls the wallets. The SEC bulletin notes that if a custodian is hacked, shuts down or goes bankrupt, you may lose access to your assets.

Segregation: on-chain, on the books and in law

Segregation means keeping customers’ coins apart from the firm’s own. It has three layers, and a custodian can have one without the others:

• On-chain segregation: customer coins sit in wallets that hold only customer assets, either one wallet per customer or pooled “omnibus” wallets that contain nothing but customer coins.
• Books and records: an internal ledger shows exactly how many coins each customer owns, and that ledger reconciles with what is actually in the wallets.
• Legal segregation: the law and the customer agreement make clear that the coins belong to customers, so the firm’s creditors cannot claim them if it goes bust.

The last layer is the one that matters in a failure. If the agreement makes you an owner, your coins should be returned to you. If it makes you a lender or an unsecured creditor, your coins may become part of the firm’s estate, shared with everyone else it owes money to.

The SEC bulletin also flags two practices to ask about. Some custodians use deposited coins as collateral or lend them out, sometimes called rehypothecation. Some commingle customer coins rather than holding them individually.

Example, with hypothetical numbers: an exchange’s ledger shows that its customers own 1,000 coins in total. If it keeps all 1,000 in customer-only wallets, every balance is fully backed. If it has lent 300 of them to a trading firm that cannot repay, only 700 remain. Should the exchange fail and those 700 be shared out in proportion, a customer with a balance of 10 coins would receive 7, and would have to claim the other 3 alongside the exchange’s other creditors. The real outcome would depend on the customer agreement, the law and the insolvency court.

What the rules require: the EU and New York

European Union. The Markets in Crypto-Assets Regulation (MiCA) applies from 30 December 2024. Firms that were already providing services under national law could continue during a transitional period that ended on 1 July 2026 at the latest, or sooner where a country chose a shorter period.

Under Article 70, crypto-asset service providers that hold clients’ coins, or the means of access to them, must make adequate arrangements to protect clients’ ownership rights, especially if the provider becomes insolvent, and must not use clients’ coins for their own account. Client money other than e-money tokens must be placed with a credit institution or a central bank by the end of the next business day, in a separately identifiable account.

Article 75 sets out the custody service itself. A provider must:

• sign an agreement with each client covering its duties, its custody policy, its security systems and its fees;
• keep a register of positions in each client’s name;
• have a custody policy designed to minimise losses from fraud, cyber threats or negligence, and give clients a summary on request;
• send each client a statement of positions at least once every three months;
• keep client coins separate from its own on the distributed ledger, and legally segregated so that its creditors have no recourse to them, in particular in insolvency;
• return coins, or the means of access, to clients as soon as possible.

The provider is liable for coins lost through an incident attributable to it, capped at the market value of the asset when the loss occurred. If it uses another custodian, that firm must also be authorised under MiCA, and clients must be told.

New York. The New York State Department of Financial Services (DFS) licenses crypto firms under its virtual currency regulation, 23 NYCRR Part 200, known as the BitLicense, and also charters limited purpose trust companies. Its guidance of 30 September 2025, which replaced earlier guidance from January 2023, expects custodians to segregate customer coins from corporate assets both on-chain and on internal ledgers, in individual or customer-only omnibus wallets. A custodian should take possession only to provide custody, not to create a debtor-creditor relationship, and should not use customer coins to secure or guarantee its own obligations. Any new sub-custody arrangement needs the department’s prior approval, and customers must be told in writing how their coins are held.

Federal US rules are still developing. On 1 October 2026 the SEC proposed custody rules for investment advisers and regulated funds that hold crypto assets for clients, which we covered in our news report. That proposal concerns advisers and funds, not retail accounts at exchanges.

Rules elsewhere differ, so check the regulator in the country where the firm is authorised; our guide to checking a broker’s licence shows how to use official registers.

What the FTX and Celsius failures showed

FTX. In its complaint, the CFTC alleged that FTX told customers their assets were held in custody and segregated from its own, while in fact customer assets were routinely accepted and held by Alameda Research, a trading firm under the same control, and commingled with Alameda’s funds. The CFTC also alleged that code features let Alameda withdraw billions of dollars in customer assets, and that the defendants’ actions caused the loss of over $8 billion in customer deposits.

Celsius. Celsius was a lending platform, not a custodian. According to the CFTC, it promised customers safety and high interest, and deposits of approximately $20 billion were pooled and deployed as loans and in other activities, including futures trading. It froze withdrawals on 12 June 2022 and filed for bankruptcy on 13 July 2022, with liabilities exceeding assets by more than one billion dollars. Customers who had handed over coins to earn yield were in the position of lenders to the platform, not owners of coins in safekeeping.

Both cases are the subject of enforcement actions; you can follow regulators’ crypto cases in our enforcement tracker.

What to check before leaving coins with a firm

Drawing on the SEC bulletin and the rules above, these are the questions to ask:

• Who regulates it, and for custody specifically? A licence for trading may not cover safekeeping.
• Does the agreement say you own the coins? Look for custody, segregation and insolvency language, not just terms of use.
• Are customer coins held separately on-chain? Per-customer or customer-only omnibus wallets, reconciled to the ledger.
• Can the firm lend, stake or pledge your coins? If so, is it optional and does it need your consent?
• Does it use a sub-custodian? Who, where, and under what supervision?
• What insurance exists, and what does it actually cover? Read the terms; theft cover is not the same as insolvency protection.
• What are the fees for holding, trading and withdrawing coins?

Frequently asked questions

Is crypto on an exchange protected like money in a bank or a broker? Not automatically. SIPC protects cash and securities at failed member brokers up to $500,000, including a $250,000 limit for cash, but it does not protect crypto that is not a registered security, even at a member firm. Any protection depends on the firm’s own regulation and terms.

What does “not your keys, not your coins” mean? It is a shorthand for the point the SEC makes: whoever controls the private key controls the coins. If an exchange holds the keys, you rely on its promise and its legal structure to get them back.

Is self-custody safer? It removes the risk of a custodian failing or misusing your coins, but it moves all the security risk to you. Lose the keys or the seed phrase, or fall for a phishing scam, and the coins may be gone permanently.

What happens to my coins if a MiCA-authorised custodian goes bust? MiCA requires custodians to keep client coins legally segregated so that their creditors have no recourse to them, in particular in insolvency. How that works in practice depends on the insolvency law of the member state concerned.

Are staking and lending part of custody? No. When a platform lends or stakes your coins, it is using them, which is exactly what custody rules aim to limit. The New York guidance says it does not address activities such as staking in detail, so read those terms separately.