TL;DR

  • It converts "who knows the secret" into "what does the policy allow", because organisations cannot safely run on secrets: people leave, collude, die, err and get coerced. The technology exists to make policy, never memory, the thing that moves money.
  • Three layers stacked: certified hardware that generates and uses keys without ever exposing them, distributed signing (MPC or multisig) so authorisation requires a quorum, and storage tiers that match value at risk to operational friction. Each layer answers a different failure class, and serious custodians run all three.
  • By making the transaction pipeline itself check the org chart: amount thresholds, destination allowlists, velocity limits, role separation, time delays and quorum approvals evaluated in code, inside the trusted boundary, before any signature exists. Policy that lives in a handbook is advice; policy that lives in the signing path is physics.
  • It proved that a quorum which cannot see what it is signing is a quorum of one attacker: 1.5 billion dollars moved through valid signatures from legitimate approvers who believed they were approving a routine transfer. The frontier moved from protecting keys to verifying intent.
In one block

Institutional crypto custody is a security and governance system that safeguards digital asset keys for organisations. It combines hardware isolation, distributed signing through MPC or multisignature, tiered storage, policy engines enforcing approvals and limits, independent audits and insurance, designed so that no single person, device or event should be able to lose or mov…

What problem does institutional custody actually solve?

Quick answer

It converts "who knows the secret" into "what does the policy allow", because organisations cannot safely run on secrets: people leave, collude, die, err and get coerced. The technology exists to make policy, never memory, the thing that moves money.

Consider what an organisation needs that a secret cannot give. Dual control: no individual, however senior, able to move client assets alone. Succession: access that survives any person's departure or death without a dangerous handover ritual. Auditability: a complete, tamper-evident record of who authorised what, when, under which policy. Compartmentalisation: a trading desk that can pay counterparties without being able to empty the treasury. Recovery: loss of any device, site or person leaving the assets reachable. Accountability to outsiders: regulators, auditors and clients able to verify the controls exist without being handed the keys.

A seed phrase in a safe fails every requirement at once. Whoever opens the safe has everything; the audit trail is the safe's hinges; succession is a note in a will; compartmentalisation does not exist. Scaling that up by adding more safes multiplies the failure modes instead of dividing them, and the industry's early history, exchange founders as single points of failure, keys on laptops, is a casualty list of exactly this approach. The canonical case remains QuadrigaCX, where a founder's death exposed the absence of every control at once; the regulator's post-mortem found that the platform held almost no assets by then, the client losses having been caused by the founder's own fraud and unauthorised trading while he lived. Governance had failed long before his death, which merely made the failure visible.

So the institutional frame inverts the amateur one. The amateur asks: where do I hide the key? The institution asks: what is the complete set of conditions under which value may move, and how do we make meeting those conditions the only physical possibility? Everything in the next sections, hardware, MPC, tiers, policy engines, is machinery for enforcing that inversion.

What are the technical building blocks?

Quick answer

Three layers stacked: certified hardware that generates and uses keys without ever exposing them, distributed signing (MPC or multisig) so authorisation requires a quorum, and storage tiers that match value at risk to operational friction. Each layer answers a different failure class, and serious custodians run all three.

Hardware isolation is the floor. Keys are generated inside hardware security modules, tamper-resistant devices certified against standards such as FIPS 140, or within secure enclaves, and signing happens inside the boundary: the key is designed never to exist in ordinary memory, on disk, or in transit. On many certified devices, physical tampering triggers zeroisation. Generation ceremonies are formal events, multiple witnesses, documented entropy, sealed backups distributed across sites, because a key born compromised stays compromised forever.

Distributed authorisation is the load-bearing wall. On-chain multisignature requires m-of-n independent signatures and puts the quorum policy on the chain itself, transparent and chain-enforced. Threshold cryptography and MPC, covered from first principles elsewhere in this academy, achieve the same quorum property with a crucial operational difference: signing produces one ordinary signature through a joint computation without reconstructing a whole key, and where the setup ceremony uses distributed key generation rather than a trusted dealer the shares never combine into a complete key at any point; shares can be proactively refreshed without touching the funds. The setup type, trusted-dealer or distributed key generation, is part of the diligence, since it decides whether a complete key ever existed, which is why institutions audit the ceremony rather than assume it. Institutions increasingly favour MPC for broad chain support where signature schemes are compatible, and for privacy of policy, use multisig where on-chain transparency is itself the point, and in either case distribute shares across geographies, organisations and hardware vendors so that no single site, employer or supply chain covers a quorum.

Tiered storage matches exposure to need. Cold tiers hold the majority of assets with keys in air-gapped hardware, quorum approvals, and deliberately slow, sometimes physically ceremonial, release procedures. Warm tiers hold operational float behind automated policy checks and shorter delays. Hot tiers hold the minimum for daily flow, the only layer an online compromise can reach quickly, and are sized so that their total loss is an accepted, insured cost of doing business rather than an existential event. The proportioning is a live risk decision: too much heat is an invitation, too much cold is an operational failure during a redemption wave.

Around the three layers sit the unglamorous essentials: real-time monitoring of every address, alerting on any unexpected movement, segregation of client assets from house assets at the ledger level, and rehearsed disaster recovery, because a backup that has never been restored is a hypothesis, never a backup.

Figure from Key Management at Scale: How Institutions Custody Crypto
Figure 1. The institutional custody stack: policy, distributed authorisation, hardware isolation and tiered storage.

How do policy engines turn governance into enforcement?

Quick answer

By making the transaction pipeline itself check the org chart: amount thresholds, destination allowlists, velocity limits, role separation, time delays and quorum approvals evaluated in code, inside the trusted boundary, before any signature exists. Policy that lives in a handbook is advice; policy that lives in the signing path is physics.

A mature custody stack wraps every proposed transaction in an evaluation. Who initiated it, in which role, from which authenticated context? Is the destination on the allowlist, and how long ago was it added, since freshly added addresses are what attackers add? Does the amount cross a threshold that escalates the approval quorum from two officers to three plus a compliance sign-off? Has this account moved more value this day or week than its velocity ceiling permits? Is a mandatory delay attached, during which an alert reaches people whose only job is to object?

Two properties separate serious implementations from theatre. First, the policy engine must live inside the trusted boundary, enforced by the same hardware or MPC quorum that signs, so that compromising an operator's laptop does not let anyone bypass it. A policy checked in a web dashboard and signed by an HSM that signs whatever arrives is a dashboard, never a control. Second, policy changes must themselves be governed transactions: adding an allowlist entry, raising a limit or replacing an approver goes through quorum and delay like a payment, because the attacker's favourite transaction is the one that edits the rules.

Role separation completes the design. Initiators cannot approve; approvers cannot deploy code; security officers who define policy cannot execute payments; auditors read everything and touch nothing. Combined with distributed shares, the practical outcome is that stealing from a well-run custodian requires simultaneous, coordinated compromise of several people in several roles in several places within one policy window, an operation whose cost and noise exceed most conceivable prizes. That sentence is the entire product.

The Bybit theft is the standing counterexample that keeps the industry honest, and the next section takes it in full.

What did the Bybit theft change about custody thinking?

Quick answer

It proved that a quorum which cannot see what it is signing is a quorum of one attacker: 1.5 billion dollars moved through valid signatures from legitimate approvers who believed they were approving a routine transfer. The frontier moved from protecting keys to verifying intent.

The February 2025 facts, as attributed by the FBI to North Korean actors, are compact. Bybit operated a multisignature cold wallet arrangement through a widely used signing interface. Attackers compromised the workflow upstream, at the interface layer, so that approvers were shown a routine transfer while the payload they signed altered the wallet's controlling logic. Each approver checked what their screen showed and signed. The signatures were genuine, the quorum was satisfied, the policy was followed as displayed, and roughly 1.5 billion dollars left through the front door. No key was extracted at any point; this cluster's pillar places the case in the wider 2025 loss picture, where operational compromise dwarfed contract exploits.

The lesson generalises far beyond one venue. Any approval system inherits the integrity of whatever renders the thing approved. If ten officers in five countries all read the same lying screen, the quorum measures the lie's distribution, never the truth. Every layer of the architecture above, HSMs, MPC, policy engines, sits downstream of the question: what exactly is being signed, and who verified it against what?

Post-Bybit practice therefore hardened the rendering path. Independent verification: approvers confirm the decoded transaction, destination, amount, and above all any change to contract logic or delegation, on a second device and channel with no shared infrastructure with the proposing system. Clear signing over blind signing: hardware that decodes and displays the true payload rather than an opaque hash, with policies that refuse what cannot be decoded. Payload-level policy: engines that parse the actual contract interaction, so "routine transfer" and "rewrite the wallet's brain" cannot wear the same clothes. Out-of-band reconciliation: a monitoring function, organisationally separate from operations, that reconstructs what a pending transaction really does from raw chain data before release. And humility in procurement: the signing interface, the browser extension, the internal dashboard, every pane of glass, is now understood as part of the vault.

The compressed form suits a checklist: protect the keys, distribute the quorum, and then assume the screen lies until independently proven otherwise.

Figure from Key Management at Scale: How Institutions Custody Crypto
Figure 2. Where the Bybit attack entered: the signing workflow, upstream of keys and quorum.

Who is allowed to custody assets, and what do the rules require?

Quick answer

A patchwork of regimes rather than one perimeter: state and federal charters plus adviser custody rules in the US, authorised CASPs under MiCA in the EU, and parallel frameworks elsewhere, sharing themes of segregation, governance and audit without sharing a rulebook. Compliance does not equal security, and every statement in this section is jurisdiction- and entity-specific.

In the United States, the picture is a patchwork rather than a framework. Much serious custody runs through regulated entities: NYDFS-chartered limited purpose trust companies operating under New York's virtual currency rules and the department's updated 2025 custody guidance, national trust banks, and state trust charters. For registered investment advisers specifically, the Advisers Act custody rule requires qualified custodians for client funds and securities it covers; how digital assets fit that rule remains contested, and the SEC's 2023 Safeguarding proposal, which would have swept in all client assets, was formally withdrawn in June 2025, so it is no longer pending authority. The themes regulators keep pressing are nonetheless consistent where they apply: segregation of client assets from house assets, no rehypothecation without consent, and structures aimed at keeping client coins out of a failed custodian's estate, a lesson written by the exchange failures of 2022.

In the European Union, MiCA brought custody under a single passportable regime: crypto-asset service providers offering custody must be authorised, must segregate client holdings, must maintain custody policies specifying key management and liability, and answer for losses of custodied assets subject to the regulation's terms. Other centres, Switzerland, Singapore, the UAE, run parallel regimes with similar themes and their own definitions; none of this transfers across borders automatically, and custody diligence is jurisdiction-by-jurisdiction work.

The verification layer around the rules matters as much as the rules. SOC 1 and SOC 2 reports give clients an independent auditor's opinion on the control environment; proof-of-reserves attestations, strongest when paired with proof of liabilities, address solvency rather than security; insurance, specie policies for cold storage, crime policies for hot wallets, prices the residual risk, and its exclusions are the honest map of what insurers think can still go wrong. A diligence file without SOC reports, insurance certificates and a regulator's charter is a brochure.

One boundary keeps the analysis honest: regulation governs conduct and structure, and cannot itself stop a quorum from signing a lie. Compliance and security are different disciplines that meet in governance, and the strongest custodians are the ones who treat the audit as a floor rather than the ceiling.

What can individuals borrow from the institutional playbook?

Quick answer

The architecture, generously: quorums instead of single secrets, tiers instead of one wallet, allowlists and delays instead of trust in your own infallibility, and rehearsed recovery instead of hope. What does not scale down is the compliance department; what scales down best is the mindset.

Translate layer by layer. Tiering: a hot wallet holding spending money whose total loss would annoy rather than wound; a distributed cold arrangement, multisig or MPC-based, holding the majority behind quorum and delay. The custody spectrum article in this academy walks the options; the institutional principle is the proportioning, and the ruthless honesty about which tier a given balance belongs in.

Quorums: retail MPC wallets and collaborative custody services now deliver institutional signing properties, no seed phrase to recite, shares across devices and guardians, refresh without moving funds, to individuals. The physical security article in this cluster explains the coercion dividend: a design where no present person can unlock the majority changes what force can extract. Inheritance planning drops out of the same structure, guardian quorums replacing the fragile note-in-a-will, exactly as institutional succession replaced the founder's memory.

Policy: allowlist your own frequent destinations where your tools support it; impose your own delay on large transfers; separate roles even as one person, the device that browses is never the device that approves, which is the individual's version of the Bybit lesson. Verify payloads on an independent screen, clear signing over blind signing, always, a discipline the wallet-drainer article in this academy grounds in the attack record.

Recovery: institutions rehearse; individuals should too. Restore from backup with a trivial amount before trusting it with a fortune; test that heirs or guardians can actually execute their part; assume any single site, the flood, the fire, the burglary, and check the design survives it.

And borrow the inversion itself. The institutional question, what is the complete set of conditions under which my assets can move, and does anything I own bypass them, is jurisdiction-free and price-free. Most personal custody failures in the loss record, seed phrases photographed, single devices, coerced owners, blind approvals, are failures to ask it. Asking it is the playbook.

Frequently asked questions

What is the difference between a custodian and a wallet provider?

A custodian takes possession-like control of client assets under a regulatory framework, with segregation, audits and liability; the client holds a claim on the custodian. A wallet provider supplies software or infrastructure, including MPC tooling, and the label settles nothing by itself: under MiCA, for instance, controlling crypto-assets or the means of access to them on a client's behalf can constitute custody regardless of branding. The boundary genuinely blurs in co-signing and share-holding arrangements, so the diligence questions are precise: who, alone or in combination, can move or block the assets, what happens if the provider fails, and how does each relevant jurisdiction classify that arrangement?

Is MPC custody better than multisig for institutions?

They deliver the same core property, quorum authorisation, with different trade-offs. MPC offers one standard signature across supported chains, policy privacy, and share refresh without on-chain movement; multisig offers transparent, chain-enforced policy at the cost of chain-specific mechanics and a public governance footprint. Many institutions run both, MPC operationally with multisig or timelocked contracts for deepest cold reserves. The failure mode they share: threshold-many compromises, or a lying signing path, defeat either.

Did the Bybit attackers break the multisig?

No signature or key was broken. The signing workflow was compromised so approvers authorised a payload different from what their screens displayed; the quorum then produced genuine signatures on a malicious transaction. That distinction is the case's entire lesson: authorisation integrity depends on what approvers can verify, which is why clear signing and independent payload verification became post-2025 baseline practice.

Does proof of reserves mean a custodian is safe?

It addresses one question, do the on-chain assets exist at attestation time, and is strongest paired with proof of liabilities showing they cover client claims. It says nothing about key governance, signing integrity, insider controls or what happens tomorrow. Read it as one panel in a diligence file alongside SOC reports, regulatory status, insurance and architecture, never as a safety certificate.

At what point should an individual adopt institutional-style custody?

A defensible trigger is the point where loss would materially change your life, because every element, distributed shares, delays, allowlists, guardian recovery, now exists in consumer form at consumer cost. The sequence in this academy's custody articles applies: understand the spectrum, distribute authority before accumulating further, and rehearse recovery before you need it. The compliance apparatus is institutional; the architecture is simply good engineering, and it scales down.

Sources and further reading

Key references for this article, current as of July 2026. Volatile figures are re-checked at each quarterly review.

Quick quiz: did it stick?

A few questions to check the fundamentals landed. Answers with explanations follow, and nobody is grading you except your future portfolio.

1/5 question
What is the fundamental design object of institutional custody?

Was this helpful?