Custody models

Definition

Holding crypto means choosing who controls the private keys (crypto-wallets-keys): EXCHANGE CUSTODY (the venue holds keys; the customer holds a ledger claim against the venue), SELF-CUSTODY (the holder controls keys directly and bears operational security personally), or QUALIFIED-CUSTODIAN arrangements (regulated trust companies holding keys for institutions and ETPs). The choice allocates a risk that equity investors rarely price: in crypto, custody failure — insolvency, misappropriation, key loss — is a first-order, repeatedly realized loss mode, and the protections wrapped around securities accounts largely do not apply.

How it works / structure

• Exchange custody: assets pool in venue-controlled wallets; customers hold IOU-shaped claims on the venue’s internal ledger. Whether those claims survive insolvency depends on the venue’s legal structure and jurisdiction — the NYDFS custody guidance (2023) exists precisely because commingling and rehypothecation made customers unsecured creditors in past failures. FTX (CFTC complaint, 2022) is the canonical exhibit: customer assets diverted at scale by the operator.
• No SIPC/FDIC backstop: SIPC protects securities customers of failed broker-dealers; crypto held at an exchange is outside that perimeter (SIPC’s own scope statement), and deposit insurance does not attach to crypto balances.
• Self-custody: keys in holder-controlled wallets — hot (online) or cold (offline hardware) — remove venue counterparty risk and take on irreversible-loss risk: key loss, theft, and operator error have no recovery desk (crypto-loss-modes).
• Qualified custodians: state-chartered trust companies and similar entities holding segregated keys under regulatory examination — the model spot ETPs use (crypto-etps), with cold-storage, key-sharding, and insurance arrangements disclosed in filings.
• Proof-of-reserves: post-FTX venue attestations of asset holdings; useful but partial (assets without liabilities is half a balance sheet) — labeled industry practice, not audit equivalence.

When it applies

Position structure decisions (venue balance vs withdrawal cadence vs wrapper — the custody choice is part of the trade), venue risk monitoring for any strategy leaving working capital on exchanges, and system-level stress analysis: custody failures are crypto’s recurring systemic event class (crypto-loss-modes catalogs the record).

Risk profile & failure modes

• Unsecured-creditor surprise: exchange failure converts “my coins” into a bankruptcy claim — realized repeatedly (Mt. Gox 2014, FTX 2022); recovery takes years and settles in fiat at petition-date values in some proceedings.
• Withdrawal suspensions precede failures: venues in stress suspend withdrawals first — the exit narrows exactly when the signal fires (crypto-spot-market-structure).
• Self-custody irreversibility: lost keys and mistaken transfers are permanent; a documented fraction of total bitcoin supply is presumed stranded in inaccessible wallets (estimates are industry analyses — labeled, imprecise).
• Custodian concentration: ETP-era custody concentrates in few entities; an incident there is market-wide, not idiosyncratic.

Evidence & limits

Custody-failure mechanics and the regulatory response are public record (CFTC/FTX complaint; NYDFS guidance; SIPC scope). Venue solvency at any moment is unobservable from outside — no attestation regime yet gives real-time assurance, so custody risk is managed structurally (limits, withdrawal cadence, wrappers), not assessed away.

Falsifiable-thesis examples

Illustrations only, not signals:

• “No top-ten venue by volume suspends customer withdrawals this year (custody-integrity thesis)” — falsified by any suspension event.
• “The share of total spot ETP assets held by the single largest custodian declines below 70% within a year (custody-concentration thesis)” — falsified by filings data.

Cross-references

• The keys underneath: crypto-wallets-keys; the failure catalog: crypto-loss-modes
• Venue structure: crypto-spot-market-structure; the outsourced-custody wrapper: crypto-etps
• Asset-class frame: ext-crypto