The big idea: Owning an asset, controlling its private keys, and having a legally enforceable claim to it are three different things.
A crypto wallet does not hold coins inside a phone or hardware device. The blockchain records balances and transfers; a wallet manages the keys and signing process used to authorise transactions. The US Securities and Exchange Commission’s Investor.gov (opens in a new tab) explains this distinction and outlines the trade-offs between self-custody and third-party custody.
That creates a deceptively simple question: who can move the asset, who can change the rules, and who can restore access when something goes wrong?
At a glance: five layers of control
(opens in a new tab)
| Layer | The question to ask | Example failure |
|---|---|---|
| Legal rights | Who is entitled to the asset, and under which agreement? | The customer’s claim is unclear during insolvency |
| Governance | Who can change limits, add signers or approve exceptions? | One administrator changes withdrawal policy |
| Signing | Who can produce a valid transaction signature? | A key or enough signing shares are compromised |
| Operations | Who initiates, monitors and pauses transfers? | A suspicious transfer is not stopped in time |
| Recovery | Who restores access after a loss or outage? | Recovery depends on one unavailable person |
The layers overlap, but they are not interchangeable. A person can hold a private key without necessarily owning the underlying asset represented by a token. A customer may have a contractual claim against a platform while the platform controls the keys. A business can distribute signing power yet concentrate policy changes and recovery in one administrator.
1. Hot wallet, cold wallet, or third-party custody?
“Hot versus cold” describes connectivity. “Self-custody versus third-party custody” describes who manages access. They are separate choices: either custody model can use hot and cold arrangements. Source: Investor.gov, 12 December 2025 (opens in a new tab).
(opens in a new tab)
| Model | Typical control | What it helps with | Risk that remains |
|---|---|---|---|
| Self-custody | Owner manages the keys | Reduces dependence on a custodian | Lost keys, unsafe backups, phishing, mistaken transfers |
| Exchange custody | Exchange manages access | Convenient trading and account operations | Provider outage, account restrictions, insolvency, contractual risk |
| Independent institutional custodian | Specialist manages access under contract | Dedicated governance and operational processes may be available | Provider dependence, outsourcing, fees, legal and jurisdictional risk |
| Shared / co-managed | Multiple parties share defined responsibilities | Can separate initiation, approval and recovery | Confusing responsibilities, coordination failures, weak recovery design |
A hot wallet is connected to an online environment and is convenient for frequent transactions, but that connectivity creates additional exposure to cyberthreats. A cold wallet isolates key material from ordinary online systems and can reduce some remote attack paths, but the device or backup can still be lost, stolen, damaged or mismanaged. Neither label proves that the full system is secure. Source: Investor.gov, 12 December 2025 (opens in a new tab); Source: NIST, May 2020 (opens in a new tab).
The key distinction: wallet type describes a technical arrangement; custody describes who has control and responsibility; legal documentation describes rights and remedies.
2. Multisig vs MPC: two ways to reduce single-key dependence
(opens in a new tab)
Multisignature (multisig)
A multisignature wallet requires multiple valid signatures under the rules of the blockchain, wallet script or smart contract. In a simple 2-of-3 setup, three authorised keys exist and any two are required to approve a transaction. This can reduce the chance that one compromised key is enough to move funds.
Implementation varies by blockchain. The way signers are represented, what is visible on-chain, transaction fees and recovery options all depend on the particular design.
Multi-party computation (MPC)
MPC is a family of cryptographic techniques that lets multiple participants cooperate in producing a signature without any one participant necessarily holding the complete private key in the usual form. Threshold-signature schemes are commonly used in digital-asset wallets.
MPC can allow the blockchain to see a conventional signature even though the signing process was distributed among participants. But its security still depends on the protocol, implementation, device security, independence of participants, access policy and recovery plan.
Quick comparison
| Question | Multisig | MPC / threshold signing |
|---|---|---|
| How is a transfer authorised? | Multiple signatures satisfy wallet or chain rules | Participants cooperate in a threshold-signing protocol |
| Is the internal process visible on-chain? | Depends on chain and implementation; multiple signers may be apparent | The chain may see a conventional signature, not the internal process |
| Does it eliminate insider risk? | No | No |
| Can it reduce single-key dependence? | Yes, if keys and signers are genuinely separated | Yes, if shares and participants are genuinely separated |
| What must be tested? | Threshold, signer independence, availability, scripts and recovery | Protocol security, share distribution, implementation, participant independence and recovery |
Neither technology is automatically superior. A poorly governed MPC deployment can be weaker than a well-designed multisig arrangement, and vice versa. Vendor documentation can explain a particular implementation, but it is not independent proof that the system is secure. For example, BitGo’s developer documentation (opens in a new tab) describes wallet types and implementation choices across supported networks.
Look beyond the acronym. Ask who controls the policy, how approvals are separated, whether a single administrator can bypass controls, and whether recovery has been tested under realistic failure conditions.
3. The hidden concentration of power
Distributing keys does not necessarily distribute control. Watch for these less visible single points of failure:
- One administrator can add or remove signers.
- One cloud or identity account can disable the signing service.
- One employee can change withdrawal allowlists or transaction limits.
- Multiple approvals rely on the same device fleet or identity provider.
- A recovery process lets one party reconstruct access without independent oversight.
- Monitoring detects a suspicious transfer, but nobody can pause it quickly.
(opens in a new tab)
A robust system separates transaction initiation, transaction approval, policy changes, infrastructure administration and recovery. The separation should be real, not just multiple usernames controlled by the same person. Key management is a lifecycle problem: generation, storage, use, backup, rotation, recovery and retirement all matter. NIST’s key-management guidance (opens in a new tab) covers protection of cryptographic key material and associated management controls.
4. What happens if a custodian fails?
A wallet architecture cannot, by itself, settle legal or insolvency questions. If a custodian is hacked, suspends withdrawals, loses access to its signing infrastructure or enters insolvency, the customer’s outcome may depend on asset segregation, records, contracts, applicable law, the custodian’s location and how the service is structured.
A balance displayed in an app is not, by itself, proof that the customer directly controls specific on-chain assets. Ask whether you own the assets directly or have a contractual claim against the provider. Ask whether assets may be lent, pledged, reused or commingled, and whether your consent is required. Source: Investor.gov, 12 December 2025 (opens in a new tab).
In January 2026, Switzerland’s financial regulator FINMA (opens in a new tab) highlighted the technical, operational and counterparty risks of crypto-asset custody, noting that cross-border custody can add legal complexity if a custodian becomes insolvent. It emphasised the importance of robust infrastructure, appropriate oversight and clear protection for customer assets.
In Malaysia, the Securities Commission’s Guidelines on Digital Assets (opens in a new tab) include a framework for digital asset custodians. The SC describes digital asset custody as a regulated category (opens in a new tab) and provides the applicable guidelines and registration information. The legal treatment of a particular activity depends on the facts and current rules, so businesses should check the latest official materials and seek qualified legal advice.
5. A due-diligence checklist you can actually use
(opens in a new tab)
Before choosing a wallet architecture or provider, get clear answers to these questions:
- Key generation: How are keys or shares created, stored, backed up and retired?
- Signing threshold: How many independent approvals are required? Who can change that threshold?
- Separation of duties: Are initiation, approval, policy changes and recovery assigned to different people?
- Transaction controls: Are there allowlists, limits, delays, out-of-band checks and escalation paths?
- Recovery: What if a key share, device, employee or provider is unavailable? Has recovery been tested?
- Asset segregation: Are client assets separated from the provider’s own assets in records and legal arrangements?
- Reuse of assets: Can assets be lent, pledged, rehypothecated or otherwise reused? Is consent required?
- Independent assurance: Are recent security assessments, penetration tests, audits and remediation records available?
- Incident response: Who can pause transfers, contact customers, preserve evidence and coordinate with authorities?
- Subcontractors and jurisdiction: Which third parties are involved, where are they located, and which law governs?
- Insurance: What is covered, what is excluded, and who is insured? A headline limit is not a guarantee of reimbursement.
- Exit and portability: Can assets be moved to another provider or self-custody? What happens during a dispute or outage?
If the provider cannot explain its controls in plain language, document responsibilities, and walk you through failure scenarios, treat that as a governance warning.
6. Is self-custody always safer?
No. Self-custody reduces dependence on a third-party custodian, but places backup security, device protection, inheritance planning and transaction hygiene on the owner. Third-party custody may offer specialist operations and structured controls, but adds provider, contract, access and jurisdictional risks. Shared arrangements can distribute responsibility, while also introducing coordination and recovery complexity.
The appropriate model depends on technical capability, asset purpose, transaction frequency, governance needs, legal environment and tolerance for operational responsibility. For an organisation, a wallet should be managed like a controlled financial system, not treated as a simple app installation.
Conclusion: follow the power, not the label
“Cold storage,” “institutional custody,” “multisig” and “MPC” can describe useful components, but none is a complete security guarantee. The decisive questions are who can move assets, who can change the rules, who can recover access, whether customer assets are segregated, and what recourse exists if a provider fails.
Map the full chain: transaction initiation, approval, signing, broadcast, monitoring and recovery. Then test it against key compromise, insider abuse, staff absence, service disruption and insolvency.
You do not fully understand custody until you know who can sign, who can change the signing rules, and who can recover the assets when the system breaks.
Sources and Further Reading
U.S. Securities and Exchange Commission, Investor.gov, "Crypto Asset Custody Basics for Retail Investors – Investor Bulletin", 12 December 2025. Wallets and keys, hot and cold wallets, self-custody and third-party custody, and questions to ask a provider. Read the bulletin (opens in a new tab).
National Institute of Standards and Technology, "Recommendation for Key Management: Part 1 – General", SP 800-57 Part 1 Rev. 5, May 2020. Protection of key material and key-management controls. NIST also posted a public draft of Revision 6 for comment in December 2025. Read the publication (opens in a new tab); read NIST's key-management page (opens in a new tab).
BitGo Developer Portal, "Wallet Types" and "Wallets Overview". Vendor documentation, used only as an implementation example and not as independent security validation. Read Wallet Types (opens in a new tab); read Wallets Overview (opens in a new tab).
Swiss Financial Market Supervisory Authority (FINMA), "FINMA publishes guidance on risks associated with the custody of cryptobased assets", 12 January 2026. The risks of crypto custody and the legal complexity of custody abroad. Read the release (opens in a new tab).
Securities Commission Malaysia, "Digital Assets" and "Guidelines on Digital Assets", revised 19 August 2024. The digital asset custodian category, registration information and the applicable guidelines. Read the page (opens in a new tab); read the guidelines (opens in a new tab).
Editorial note
This article is for general educational purposes and is not legal, investment, tax or cybersecurity advice. Laws, regulatory requirements and legal outcomes vary by jurisdiction, asset type, contract and facts. Consult qualified professionals before making custody or business decisions.
