Crypto custody is often described as a security problem. In practice, it is also a legal, operational and governance problem.
The issue isn’t simply where digital assets are stored. Institutions also need clarity on who controls private keys, which legal entity holds the assets, whether client funds are segregated, what happens in insolvency, and how withdrawals are approved.
Recent developments in the U.S. and Europe show custody moving into a more regulated phase. At the same time, a reported hardware-wallet supply-chain attack has reminded the market that even self-custody carries risks beyond the blockchain itself.
The SEC Is Reworking the Custody Framework
On October 1, 2026, the U.S. Securities and Exchange Commission proposed a framework for how registered investment advisers and regulated funds may custody crypto assets under federal securities laws.
The proposal is important because traditional custody rules were not designed around assets controlled by private keys. The SEC is now trying to address issues that are specific to digital assets, including the way assets are held, transferred and protected.
The proposal does not mean that every crypto custodian will automatically become acceptable to every fund or adviser. Eligibility, legal structure and client type will still matter. It also remains a proposal rather than a final rule.
For institutions, the practical impact is that custody decisions may become easier to document, but not necessarily easier to make. A provider still needs to show how its controls work and which entity is responsible for the assets.
Banks Are Expanding Into Digital Asset Custody
Traditional financial institutions are also becoming more active in this market. BNY recently announced the expansion of its digital asset custody platform for selected European institutions under the MiCA framework.
The move gives BNY a position among the first global systemically important banks to provide regulated digital asset custody services in the European Union. Its announcement highlights growing institutional interest in crypto assets, stablecoins and tokenized securities.
The arrival of a major bank may improve confidence in the custody sector, but it does not remove the need for due diligence. Clients still need to confirm which BNY entity provides the service, what assets are supported and how the custody arrangement works under local law.
A familiar bank name is useful. It is not a substitute for reading the contract.
“Cold Storage” Does Not Explain the Whole Risk
Cold storage is one of the most widely used terms in crypto security. It generally means that private keys are kept offline, away from routine internet-connected systems.
That can reduce exposure to certain online attacks, but it does not answer every security question. Key generation, employee access, withdrawal approvals, disaster recovery and internal controls all affect the final risk profile.
The same is true for MPC and multisignature systems. These technologies can distribute signing authority and reduce reliance on a single key, but the technology does not automatically determine who can approve a transaction or how emergency access is handled.
A provider that advertises MPC should explain its approval policies, recovery process and separation of duties. A provider that claims to use cold storage should explain how assets move between cold, warm and hot environments.
A Hardware Wallet Attack Shows Why Supply Chains Matter
A reported hardware-wallet supply-chain attack has added another layer to the custody debate. According to Tom’s Hardware, an incident involving physical tampering allegedly resulted in approximately $93 million in cryptocurrency losses. Ledger said it would review its sales process and anti-tampering measures.
The broader lesson is not that hardware wallets are useless. It is that self-custody does not remove every operational risk. A device can be compromised before it reaches the customer, during setup or through unsafe recovery procedures.
Institutional self-custody can face similar challenges. An organization may control its own keys, but it must also manage staff permissions, device security, backups, transaction approvals and incident response.
Legal Custody and Wallet Technology Are Different
One of the easiest mistakes in crypto custody is confusing a technology provider with a legal custodian.
A company may supply MPC wallets, APIs or settlement infrastructure without being the entity that legally holds customer assets. Another firm may provide qualified custody but offer limited support for certain networks or trading workflows.
This distinction matters if a client becomes insolvent or if a regulator asks who controls the assets. The answer should be clear from the agreement, not inferred from a marketing page.
The same issue affects exchanges and fintech companies. They need more than a secure wallet. They also need deposit monitoring, withdrawal policies, address management, reporting, reconciliation and clear procedures for freezing or reviewing unusual transactions.
The Industry Is Moving Toward Proof, Not Slogans
Crypto custody providers increasingly use terms such as “institutional-grade,” “bank-level security” and “insured assets.” These phrases may describe real capabilities, but they need evidence.
An audit report should identify its scope. An insurance policy should explain exclusions. A qualified-custodian claim should identify the legal entity and regulator. A fast-withdrawal promise should be tested against approval limits and emergency controls.
The most credible custody providers will be the ones that can answer detailed questions without relying on vague assurances.
What This Means for Crypto Users
The current custody debate is relevant beyond hedge funds and banks. Retail users also make custody decisions whenever they leave funds on an exchange, use a hardware wallet or transfer assets through a third-party platform.
No custody model removes all risk. Third-party custody introduces counterparty and platform risk. Self-custody introduces key-management and operational risk. Institutional infrastructure can reduce some risks while adding complexity, fees and legal dependencies.
The right choice depends on the user’s goals, technical ability, liquidity needs and tolerance for responsibility.
For users following the infrastructure behind digital assets, Tapbit provides access to crypto markets and trading tools. Existing users can log in, while new users can create a Tapbit account.
Frequently Asked Questions
What is crypto custody?
Crypto custody refers to the storage and control of the private keys that authorize digital-asset transactions. It may be provided by a regulated custodian, an exchange, a wallet infrastructure company or the asset owner directly.
Is a crypto custodian the same as a wallet provider?
Not always. A wallet provider may offer software, MPC technology, APIs or transaction controls without being the legal entity that holds client assets.
What is the SEC’s new crypto custody proposal?
The SEC’s October 2026 proposal seeks to address how registered investment advisers and regulated funds may custody crypto assets under U.S. securities laws. It remains a proposal and may change before becoming final.
