What a crypto custodian does and when you need one

When a crypto exchange collapses, the same question surfaces every time: where were the coins? Not the price of them, the actual coins. In more than one high-profile failure the answer was that customer assets and company money had been sitting in the same pot, and once the pot ran dry there was nothing left to return. Who was holding the assets, and how, is the question a custodian exists to answer.

What is a crypto custodian?

A custodian is a service that holds crypto assets on your behalf and safeguards the private keys that control them. In crypto, whoever controls the private keys controls the coins: the key is effectively the asset, since anyone who holds it can move the funds. A custodian takes on the job of keeping those keys safe, restricting who can authorise a transfer, and standing behind the assets so you do not manage the security yourself. When you leave coins on an exchange, that exchange is acting as your custodian, whether it is framed that way or not.

Where do the keys actually sit: hot wallets and cold storage?

They sit in one of two places, and the split between them is the core of how custody security works. A hot wallet is connected to the internet, which makes assets quick to move but also reachable by an attacker. A cold wallet keeps the private keys offline on isolated hardware, slower to transact from but much harder to steal remotely. Most custodians keep the large majority of holdings in cold storage and only a working float in hot wallets, the way a shop keeps most of its cash in a safe and a little in the till.

Custodial or self-custody: who holds the keys?

The dividing line is simple: in a custodial arrangement someone else holds your keys, and in self-custody you hold them yourself. The shorthand 'not your keys, not your coins' captures the trade-off. Self-custody, through a hardware or self-hosted wallet, means no third party can freeze, lose or misuse your assets. It also means backups, security and recovery are entirely your responsibility, and a lost seed phrase is usually a permanent loss. A custodian reverses both sides: you give up sole control in exchange for someone else carrying the operational burden, and often insurance and recovery processes. Neither is safer in the abstract; they move the risk to different places.

What does asset segregation mean, and why did regulators make it a rule?

Segregation means keeping customer assets separate from the custodian's own, so the company's money and yours never share a pot. This is the specific failure regulators moved to close after several exchange collapses. In Singapore, the Monetary Authority of Singapore announced in July 2023 that digital payment token service providers must safekeep customer assets under a statutory trust, segregate them from the provider's own assets, and not commingle them, to protect customers and ease recovery if a provider becomes insolvent. MAS adopted the consumer-protection guidelines carrying these custody rules in September 2024. The principle is not unique to Singapore: ring-fencing client assets from company assets is a long-standing idea in traditional finance that crypto rules have been catching up to.

When do you actually need a custodian?

You need one when the cost of getting self-custody wrong outweighs the cost of trusting a third party, and that balance shifts with how much you hold. For a small amount you are actively trading, leaving it with a reputable exchange-custodian is a common and reasonable choice for convenience. As holdings grow, or shift from trading money to long-term savings, the appeal of self-custody or a dedicated qualified custodian tends to rise, because a single point of failure now costs more. There is no universal threshold. The more useful question is less 'do I need a custodian' than 'which failure would hurt me least: losing my own keys, or trusting the wrong company with them?'

How can you sanity-check a custodian before trusting it?

Look for evidence that the assets exist and are kept separate, not just a promise that they are. A few checkable signals help. First, whether the custodian is licensed or regulated in a recognised jurisdiction, which usually brings segregation and audit requirements with it. Second, whether it publishes a proof-of-reserves attestation, an independent check that the assets it claims to hold exist on-chain, though a reserves figure alone says little about liabilities. Third, how it splits hot and cold storage, and whether it carries insurance against loss or theft. None of these is a guarantee, but together they move you from taking a company's word to reading its structure.

FAQs

What is a crypto custodian in simple terms? A service that holds your crypto and safeguards the private keys that control it, so you do not have to secure them yourself. When you keep coins on an exchange, that exchange is effectively acting as your custodian.

Is self-custody safer than using a custodian? Neither is safer in the abstract; they carry different risks. Self-custody removes third-party risk but puts backups and recovery on you, where a lost seed phrase can mean permanent loss. A custodian carries that burden but asks you to trust a company.

What does it mean for a custodian to segregate assets? It means keeping customer assets separate from the company's own, so the two never share a pot. In Singapore, MAS requires digital payment token providers to hold customer assets on a statutory trust and not commingle them, to protect customers if the provider fails.

What is proof of reserves? An independent attestation that a custodian holds the assets it claims to, usually verified on-chain. It is a useful signal, though it shows assets without necessarily showing liabilities, so treat it as partial evidence rather than a full guarantee.

None of this is investment or legal advice. It explains what a custodian does and how to think about custody, not a recommendation to use any particular provider or to hold assets in any particular way. Custody rules differ by country and change over time, so treat the regulatory detail here as general context to verify locally rather than a settled statement about your own situation.