Types of crypto custody explained

Crypto custody covers more ground than the phrase suggests, and the types of crypto custody in use today split along two axes that get treated as one. The first axis is control: who holds the cryptographic keys that can move an asset. The second is mechanics: where those keys live and how a signature actually gets produced.

A wallet can be self-custodied and still sit on a hot, internet-connected device, and a third-party custodian can hold keys in cold storage while signing with multisig rather than MPC. Separating who controls the keys from how the keys are stored or signed is what makes the rest of the custody landscape legible. A third category, qualified custody, sits above both axes as a regulatory classification.

Crypto custody splits into three models defined by who controls the keys: self-custody, where an individual or organization holds the keys directly; third-party custody, where a specialized provider holds them instead; and qualified custody, a regulatory subset of third-party custody that meets specific investor-protection standards.

A second axis runs underneath all three and describes mechanics rather than control: cold storage against hot storage, and multi-party computation (MPC) against multisig. Both apply inside any of the three models above, which is why a self-custodied wallet and a qualified custodian can both use cold storage, and why two third-party custodians can differ sharply in whether they sign with MPC or multisig.

Under the European Union's Markets in Crypto-Assets Regulation (MiCA), custody of crypto-assets on behalf of a client is defined as the safekeeping of the assets or of the means of access to them, most often the private cryptographic keys, rather than possession of the asset in a physical sense. That framing holds regardless of which of the three models applies: the asset never leaves its network, and custody is a claim about who can authorize its movement.

Self-custody means an individual or organization holds its own private keys, typically through a hardware device or a software wallet, with no third party able to freeze or recover the funds. Third-party custody means a specialized provider holds the keys instead, taking on the operational and security burden along with the ability to enforce controls an individual could not enforce alone.

In the United States, the Office of the Comptroller of the Currency (OCC) has described bank-provided crypto custody as a modern extension of the safekeeping services banks have always performed, conducted through cryptographic key management rather than a vault, in Interpretive Letter 1170.

A later letter confirms that a bank may outsource that custody to a sub-custodian, provided it manages the resulting third-party risk, which is why a single third-party custody relationship in practice often involves more than one custodian, as set out in Interpretive Letter 1184.

The trade-off is not one-directional. Self-custody removes counterparty risk entirely, since no provider holds the keys that could be misused, frozen, or lost on the holder's behalf. What it does not remove is operational risk: a lost seed phrase or a compromised device produces the same irreversible outcome a breach of a custodian would. This is close to the distinction international standard-setters draw between a hosted wallet, held by a licensed provider, and an unhosted one, held directly by the individual, a split described in FATF's 2025 update on virtual asset service providers (VASPs).

Cold storage keeps keys on a device that never connects to the internet, commonly a hardware module or an air-gapped machine, and signs transactions offline before broadcasting the already-signed result. Hot storage keeps keys on an internet-connected system, trading that offline isolation for faster access and higher signing throughput.

Cold storage removes the remote attack surface but adds signing latency, since every transaction needs a physical or logistical step to reach the offline key. Hot storage removes that friction but exposes the key to any compromise of the connected system.

The National Institute of Standards and Technology (NIST) treats the storage state of a key, and the exposure that state creates, as a core design variable independent of the specific algorithm in use, in its key management guidelines, and the cold-versus-hot distinction in custody is a direct application of that principle to private keys that move digital assets.

Production custody setups typically combine both states rather than choosing one: cold storage for the bulk of assets, and a smaller hot allocation for day-to-day settlement.

Multisig and MPC solve the same underlying problem, a single key that can be stolen or lost, by removing reliance on any one key, but they use different mechanisms to do it. Multisig uses several independent, complete keys and requires a set number of them, an M-of-N threshold, to sign together, with that requirement enforced on the blockchain itself and visible to anyone who checks.

MPC instead splits a single key into shares that are never reassembled, using a cryptographic protocol to jointly produce one ordinary signature without any party seeing the whole key, and enforces the threshold off-chain rather than on the network.

NIST's Multi-Party Threshold Cryptography project is actively working to standardize these threshold schemes, which signals that the underlying cryptography is still maturing rather than settled. A 2023 survey of threshold signatures distinguishes generic MPC-based thresholding from custom threshold schemes built for a specific signature algorithm, and treats the two as carrying different performance and security trade-offs rather than one simply superseding the other.

Multisig's on-chain visibility suits governance and treasury use cases where auditability matters more than speed. MPC's off-chain enforcement suits high-volume execution and multi-chain operations, since it produces a standard signature that works the same way regardless of which network is involved. Neither is inherently more secure than the other, and the choice tends to track the job rather than a security ranking.

Qualified custody is a regulatory classification, not a technology. In the United States, it refers to holding client assets with a qualified custodian under the Securities and Exchange Commission's (SEC) Custody Rule (Rule 206(4)-2), a category that includes certain banks and broker-dealers and, following a September 2025 no-action letter, state-chartered trust companies that meet specific conditions for digital assets.

The rule exists to protect investors by requiring that a registered adviser's client assets sit with a custodian separate from the adviser, segregated from the custodian's own assets, and subject to independent verification.

A custodian that simply runs a well-secured operation does not automatically qualify: qualification depends on the entity's regulatory status and on meeting the rule's specific conditions, not on the strength of its security architecture alone.

Other jurisdictions apply the same logic through different instruments. Under MiCA, a crypto-asset service provider offering custody in the European Union must be authorized and meet conduct and prudential requirements set out in the regulation, functioning as its own equivalent standard even though the term qualified custody itself is American.

None of the three models, and neither the storage state nor the signing mechanism, is a universal answer. A retail holder with no operational team is usually better served by self-custody paired with cold storage, accepting the recovery risk in exchange for removing any counterparty.

An active trading desk needs a hot allocation, regardless of which custody model it uses, because settlement speed is the point. A regulated fund or adviser is often required to use a qualified custodian specifically, independent of how well any unqualified alternative performs operationally, because the requirement is about legal status rather than technical merit.

The practical sequence is to fix the control question first, self-custody, third-party, or a regulatory requirement that settles it, and only then choose the storage and signing mix that fits the resulting operational profile. Reversing that order, picking a storage technology before deciding who holds the keys, is the most common way custody decisions go wrong.