Custody Models: Reference Comparison

Entry last verified July 2026.

The models

Model	Keys held by	Recovery route	Primary failure
Exchange account	The venue	Identity verification	Venue insolvency or freeze
Qualified custodian	A licensed third party	Contractual process	Custodian failure, insurance gaps
Single-signature self-custody	You	Recovery phrase	Losing the phrase
Multi-signature	Several parties, threshold required	Any valid combination of keys	Losing too many keys, complexity errors
Social recovery	You, with designated guardians	Guardian consensus	Guardians unreachable or colluding

What each protects against

Exchange account. Protects against your own key loss. Exposes you to the company.

Qualified custodian. Protects against your own errors and against unsegregated holding. Exposes you to the custodian and to insurance limits.

Single-signature self-custody. Protects against every counterparty. Exposes you entirely to your own procedures.

Multi-signature. Removes the single point of failure in both directions: no single key loss is fatal and no single key compromise is either. Costs operational complexity and makes inheritance harder.

Social recovery. Removes the single artefact whose loss is fatal. Introduces a dependency on people remaining reachable for years.

The insurance question

Custody insurance typically covers theft from cold storage and excludes losses involving an employee with legitimate access. Limits are frequently well below assets held, and the policy covers the custodian rather than the customer directly.

A platform describing itself as insured is making a claim that requires three follow-up questions: against what, to what limit, and does a recovery reach customers.

The segregation question

More important than insurance for the failure case.

Whether client assets are legally separate from the firm’s own, and bankruptcy-remote, determines whether they are returnable in an insolvency or form part of the estate.

This is in the terms of service and it is the paragraph worth reading before depositing anything.

The practical arrangement

Three tiers with three different failure modes.

Working balance at a regulated venue, sized so that its total loss would be an annoyance. Platforms publishing their segregation terms and registration, such as a regulated European platform, are appropriate for this tier.

Interaction wallet, small, for connecting to applications.

Long-term holdings in self-custody or multi-signature, with a tested backup and documented inheritance.

No single event reaches all three, which is the entire argument for splitting rather than optimising one model.