Crypto Custody Explained: How Institutions Store Digital Assets Safely

Coinbase and Kraken don’t actually hold your Bitcoin the way a high street bank holds cash in a physical vault behind the counter. Institutional investors moving nine-figure sums into crypto need something closer to that — audited, insured, legally accountable custody. That entire industry, mostly invisible to retail users, is what makes pension funds and asset managers comfortable touching digital assets at all. When I looked into how it actually works, the gap between “your keys, your coins” and institutional reality turned out to be bigger than most guides admit.

What Crypto Custody Actually Means

Custody is simple in concept: someone else holds your private keys, under a legal and technical framework designed to stop them losing or stealing your assets.

For retail users, this is what happens every time you leave coins on an exchange rather than moving them to your own wallet. For institutions, custody means something far more rigorous — segregated accounts, insurance, regular audits, and regulatory licensing specific to digital asset safekeeping.

The Financial Conduct Authority doesn’t yet license crypto custodians the way it licenses banks, but firms serving UK institutional clients increasingly hold overseas licences from regulators like the New York DFS or Swiss FINMA to reassure buyers.

Hot Wallets, Cold Storage, and Everything Between

Custodians balance two competing needs: keeping assets accessible enough to trade, and keeping them secure enough to survive a hack attempt.

Hot wallets stay connected to the internet, enabling fast withdrawals but carrying constant exposure risk. Cold storage keeps keys entirely offline, dramatically safer but slower to access. Most institutional custodians run a hybrid model — a small hot wallet for daily liquidity, with the vast majority of assets in cold or deep-cold storage.

Coinbase Custody, one of the largest players, reportedly keeps over 95% of client assets in cold storage, according to its own published security practices as of 2026.

Multi-Signature and MPC: The Technical Backbone

A single private key is a single point of failure. Institutional custody spreads that risk across multiple keys or key shares.

Multi-signature setups require several separate keys to authorise any transaction — typically held by different people or systems, so no one person can move funds alone. Multi-party computation, a newer approach, splits a single key mathematically across parties so the full key never exists in one place, even momentarily.

• Single-key wallets: fast but a single point of failure
• Multi-signature: requires multiple approvals, slower but resilient
• MPC: key never fully assembled, strong against theft
• Hardware security modules: tamper-resistant physical devices holding key material

Most serious custodians now combine MPC with hardware security modules for an extra physical layer of protection.

Who Actually Provides Institutional Custody

The custody market has consolidated around a handful of specialists rather than the exchanges themselves.

Fireblocks, Copper, and Anchorage Digital dominate institutional custody, alongside bank-affiliated entrants like BNY Mellon’s digital asset division. Anchorage became the first federally chartered digital asset bank in the US in 2021, a milestone still cited constantly in institutional sales pitches five years later.

UK-based institutions often route through these US or Swiss providers rather than domestic ones, since the FCA framework for custody-specific licensing remains under development in 2026.

Insurance: The Part Everyone Asks About First

Ask any pension fund manager about crypto and insurance comes up within the first minute. Fair enough — Mt. Gox and FTX are still fresh memories.

Custodial insurance typically covers theft and some operational failures, but rarely covers market losses or so-called “protocol risk” — a smart contract bug, for instance. Coverage limits also matter enormously; a custodian insuring $500 million in assets for only $100 million in coverage leaves a real gap.

Lloyd’s of London remains the largest underwriter of crypto custody insurance globally, a detail that surprises people expecting a purely American or Asian insurance market to dominate here.

Proof of Reserves: Checking the Custodian Isn’t Lying

FTX collapsed partly because nobody could verify it actually held what it claimed. Proof of reserves emerged directly from that failure.

A proper proof-of-reserves audit uses cryptographic methods — usually a Merkle tree — to let a custodian prove it holds sufficient assets without revealing every client’s individual balance. Weaker versions just publish a wallet address and a snapshot balance, which proves far less than it appears to.

UK investors keep asking about this because the difference between a real audit and a marketing snapshot isn’t obvious without technical knowledge — and several 2024 collapses hid behind exactly that confusion.

Self-Custody vs Institutional Custody for UK Investors

Retail UK investors don’t need Fireblocks-grade infrastructure. But the underlying trade-off — convenience versus control — applies at every scale.

Self-custody through a hardware wallet like Ledger or Trezor means nobody but you controls the keys, with no counterparty risk if an exchange fails. It also means no customer support if you lose your recovery phrase — the loss is permanent. HMRC still treats self-custodied and exchange-held crypto identically for capital gains purposes, so the tax picture doesn’t change either way.

The sensible middle ground most UK holders land on: self-custody for long-term holdings, exchange custody only for what you’re actively trading.

Regulatory Direction: MiCA, the FCA, and What’s Coming

The EU’s Markets in Crypto-Assets regulation, fully in force since 2024, already sets specific custody requirements for firms serving European clients — segregation of client assets, minimum capital reserves, and mandatory reporting.

The UK has taken a slower, more piecemeal path. The FCA currently regulates crypto custody indirectly, through existing safeguarding rules rather than a bespoke regime, but a dedicated custody framework is expected as part of the broader UK crypto regulatory rollout the FCA has flagged for 2026 and 2027.

Firms operating across both UK and EU markets increasingly build to the stricter MiCA standard everywhere, simply to avoid running two separate compliance systems side by side.

Choosing a Custodian: Questions Worth Asking

Not every custodian offers the same level of protection, even among well-known names.

• Does it publish cryptographic proof-of-reserves, not just a balance snapshot?
• What percentage of assets sit in cold storage versus hot wallets?
• What exactly does the insurance policy exclude?
• Is client custody legally segregated from the company’s own balance sheet?
• Which jurisdiction licenses the custodian, and what does that licence actually require?
• What happens to your assets if the custodian itself goes insolvent?

That last question matters most. Segregated, bankruptcy-remote custody structures mean your assets aren’t available to creditors if the custodian fails. Several 2024 collapses showed exactly what happens when that segregation exists only on paper.

How We Got Here: From Exchange Hacks to Institutional Vaults

Institutional-grade custody didn’t emerge out of caution — it emerged out of catastrophe.

Mt. Gox lost 850,000 Bitcoin in 2014, largely because a single exchange held everything in poorly secured hot wallets with no meaningful audit trail. That collapse pushed the earliest custody specialists into existence, building cold storage and multi-signature systems specifically to make a repeat impossible. FTX in 2022 proved the lesson hadn’t fully landed — commingled client funds and no real proof-of-reserves led to another multi-billion-dollar loss, this time with institutional money involved.

Each failure produced a wave of stricter standards. Post-Mt. Gox, cold storage became the norm. Post-FTX, proof-of-reserves and asset segregation became the industry’s loudest selling points. UK investors keep asking about this history because it explains why today’s custodians over-communicate about security — they’re selling reassurance built on other firms’ very public failures.

Custody Fees: What Institutions Actually Pay

Institutional custody isn’t free, and the fee structure looks nothing like a retail exchange’s zero-cost wallet.

Most custodians charge a basis-point fee on assets under custody — often somewhere between 10 and 50 basis points annually, depending on volume and asset type. A pension fund custodying £100 million in digital assets might pay anywhere from £100,000 to £500,000 a year just for safekeeping, before trading fees or withdrawal costs enter the picture.

That cost buys insurance coverage, audit trails, dedicated support, and legal accountability that a self-custody setup simply can’t offer at institutional scale. For a fund with fiduciary duties to its members, that’s usually an easy trade to justify, even at those fee levels. Retail platforms bury an equivalent cost inside spreads and withdrawal fees instead of a visible line item, which is partly why custody looks free until you actually compare what you’re getting for it.

What This Means for You

Custody sits underneath every crypto product you use, whether you notice it or not. If you’re leaving meaningful sums on an exchange, check whether it publishes real proof-of-reserves audits and what insurance actually covers — not just that insurance exists. For larger holdings, moving to self-custody removes counterparty risk entirely, at the cost of taking full responsibility for your own keys. Neither option is free of risk; they’re just different risks — and understanding which one you’re actually taking on is worth more than any single custodian’s marketing page.

This article is for educational purposes only and does not constitute financial advice. Cryptocurrency investments involve significant risk. Always do your own research.