You receive an urgent message: a critical security vulnerability was exploited on a bridge overnight, resulting in stolen funds and a flood of support requests. While you don’t use that particular bridge, it makes you wonder if your own systems would have been able to withstand a similar attack.
I’m facing a tight deadline. Two weeks ago, a potential solution for handling overflow balances fell through – withdrawals were put on hold for manual review, and the explanation was pretty unhelpful, just something about timing. Now, my board wants a clear and concise custody memo by Friday. They’re asking for something straightforward, practical, and legally sound – basically, something that won’t be easily challenged.
Today’s focus is to get past the jargon, understand the pros and cons, and create a secure system that you can confidently troubleshoot, even in a crisis.
Custody of assets isn’t just a routine task anymore; it’s now a major focus for regulators because the risks have increased and regulations are evolving. In July 2026, Europe’s financial regulator will begin a thorough review of how crypto companies protect their customers’ assets, with a particular emphasis on custody practices. This review will continue into 2027 and culminate in a public report, clearly indicating that regulators will be paying very close attention to custody arrangements – it’s an area where they expect the highest standards (according to a statement from the European Securities and Markets Authority).
As an analyst, I’ve observed that investors have recently favored quick and easy access to markets, driving capital towards whatever was performing best – essentially chasing ‘hot streaks’. However, increased regulatory scrutiny and recent losses are now pushing the market in a different direction. We’re seeing a renewed focus on systems with predictable speeds and clear separation of assets to minimize risk.
As a researcher tracking bridge security, I’ve recently observed a stark example of the risks involved. A custodial bridge operating on Arbitrum, linked to AFX Trade, suffered a significant drain – approximately 24.15 million USDC was stolen. The attackers managed to compromise the hot validator keys and then moved those funds to Ethereum where they were converted into ETH. This incident really highlights the fundamental danger of relying on hot keys; it’s as direct an example of this risk as you can get (according to CoinDesk, reporting data from Blockaid and chain analysis).
The risk of using centralized cryptocurrency exchanges remains a concern. AscendEX, for example, stopped normal withdrawals on July 1, 2026, and began reviewing them manually, admitting they couldn’t guarantee when or how much users would receive. Even if users eventually get their funds back, such a sudden freeze can disrupt trading strategies and financial plans very quickly, as reported by The Block.
Major companies are increasingly investing in security research and development. In July 2026, a group including BlackRock, Coinbase, and Fidelity Digital Assets created the Bitcoin Security Consortium, committing $15 million over three years to improve Bitcoin’s security and prepare for the challenges of post-quantum computing. While not directly related to holding digital assets, these advancements often influence the design and security standards used by companies that do offer custody services.
What hot, cold, and qualified custody really mean
Let’s put aside the technical jargon for a moment. These concepts really boil down to how exposed your private keys are online and the legal agreements governing them.
Hot wallets: speed with strings attached
A ‘hot key’ is one that’s connected to the internet and can immediately approve transactions. This allows for fast processing, broader access to markets, and automated processes, but it also significantly increases the risk of hacking. Examples include systems for depositing or withdrawing funds from exchanges, automated trading in decentralized finance (DeFi), and everyday mobile apps.
Cold storage: isolation as a feature
Keeping systems completely isolated – or ‘cold’ – means signing processes happen offline, and approvals are handled in groups. This makes things slower, sometimes by design. The benefit is a much lower risk of remote attacks. Truly isolated systems often use physically disconnected devices, secure locations, and require manual sign-off.
Qualified custody: the legal shield
Qualified custody means keeping client assets safe with a regulated company – often a bank or trust – that’s legally authorized to hold them. This setup provides strong protection through clear segregation of funds, structures that shield the assets if the custodian fails, and thorough record-keeping for audits. While it doesn’t eliminate all risk, qualified custody offers legal protections and avenues for recovery that you typically wouldn’t get with a standard exchange wallet.
Here’s a breakdown of different custody types for digital assets, outlining their key features and typical use cases:
Hot Custody: This is the fastest option, with assets stored fully online (on servers, Hardware Security Modules, or using Multi-Party Computation). It’s best for frequent transactions, like those used by exchanges, traders, and decentralized applications (dApps). Security relies on measures like rate limits, spending limits, and constant monitoring.
Warm Custody: A hybrid approach, partially online (using MPC or staged processes), offering a balance between speed and security. It’s suitable for funds that are regularly rebalanced. Security features include threshold signing, approval processes, and automated circuit breakers.
Cold Custody: The most secure option, storing assets completely offline (air-gapped). Access is slower, taking hours or days. This is ideal for long-term storage and treasuries. Security depends on physical controls, multiple approvals (‘4-eyes’ principle), and strict offline procedures.
Qualified Custodian: These providers often use a combination of hot, warm, and cold storage tiers to meet different service level agreements (SLAs). Security varies, but includes legal segregation of assets and is commonly used by institutions, funds, and corporations. They are subject to regulatory oversight, audits, and often carry insurance (SOC/ISO compliance).
How keys move: from request to settled transaction
You don’t have to understand complex cryptography, but it’s helpful to know the steps your money takes when you withdraw funds – from when the request is approved to when it’s fully processed. Here’s how a typical withdrawal works.
- Portfolio manager requests a withdrawal from cold to a pre-approved hot address with a reason code.
- Operations verifies balances, whitelist entries, and compliance flags; kicks off a policy check.
- Two or more approvers sign off in the custody system (4-eyes or quorum policy).
- A transaction is assembled offline; keys are brought to an air-gapped device or HSM enclave.
- Signatures are produced (via multisig or MPC) and exported over a controlled channel (QR, removable media, or secure relay).
- The signed payload is broadcast from an online relay; monitoring begins.
- Settlement is confirmed; reconciliation and immutable logs are updated; risk limits reset.
Multisig vs MPC in the real world
Both multisig and MPC are ways to securely manage digital assets by requiring multiple approvals for transactions. Multisig uses several distinct keys that are visible on the blockchain (like Bitcoin), while MPC creates a single key from pieces held by different parties, often appearing as just one address. Both systems let you define how many approvals are needed. The best choice depends on your preference for vendor flexibility, which blockchains you use, and what feels easiest to manage. Many custodians offer both options.
Where HSMs and KMS fit
Hardware security modules and key management services safeguard your encryption keys whether they’re stored or being used. However, these tools aren’t foolproof. You also need clear rules about who can authorize digital signatures, how code updates are checked, and how you practice recovering from potential disasters.
Exchange wallets vs third-party custodians vs self-custody
Most teams end up with a mix. But each bucket behaves very differently when stress hits.
Exchange custody: convenience with counterparty exposure
Cryptocurrency exchanges are generally quick and have plenty of trading activity, but they’re still businesses and come with their own set of potential problems. The recent situation with AscendEX – where operations were halted in July 2026 and users couldn’t withdraw funds easily – shows that even standard exchange functions can be unexpectedly suspended (according to a report from The Block).
Third-party qualified custodians: legal rails and segregation
Using a qualified custodian to hold your assets helps keep them separate from other funds and can protect them if a company goes bankrupt, depending on where you are located. This approach involves more paperwork and takes a little longer, but many financial institutions see that as a worthwhile trade-off.
Self-custody: maximal control, maximal responsibility
Managing everything yourself – from hiring and security to compliance and disaster recovery – gives you complete control, but also full responsibility. If you’re uniquely good at these things, that’s a benefit. Otherwise, consider partnering with others or focusing your internal efforts only on the most critical parts of your business to stay flexible.
The 2026 rulebook and industry moves you should watch
Financial regulators are increasingly focused on how well companies can withstand disruptions. In July 2026, the EU’s securities watchdog will begin a detailed review of crypto-asset firms, specifically examining how they protect customer assets and defend against digital threats. The results of this review are expected in the second half of 2027. Companies should prepare for questions about keeping client funds separate, how they handle security incidents, their reliance on third-party providers, and the accuracy of their data.
What regulators usually probe
- Client asset segregation and reconciliations you can actually evidence
- Incident timelines: detection, containment, notifications
- Key ceremonies, change control, and dual-control enforcement
- Business continuity: restore times, backup testing, and failovers
- Third-party service dependencies and exit plans
Industry self-help
Protecting systems through practical efforts is just as important as simply having rules in place. The Bitcoin Security Consortium’s investment in essential and future-proof research highlights that the basic encryption methods and wallet standards we use are constantly evolving. Updates to these areas will likely become requirements for those safeguarding digital assets, according to a recent press release.
Bridge and L2 exposure is on the checklist now
If you’re using systems that move assets between different blockchains or operating on layer-2 networks, regulators will likely take a close look. The recent AFX Trade hack on Arbitrum happened because of weak security around the ‘hot key’ used to control the bridge connecting chains – hackers quickly moved the stolen funds. Expect supervisors to ask detailed questions about how you protect these keys, monitor for suspicious activity, and have systems in place to automatically stop attacks (as reported by CoinDesk based on Blockaid’s analysis).
Building a custody stack you can defend
Don’t think in rigid terms of ‘fast’ or ‘slow’. Instead, create different levels of speed – make things quick when necessary, and deliberately slow them down when you don’t need speed.
Segment balances with policy, not vibes
- Hot: operational float sized to 1–3 days of expected activity, capped by per-asset spend limits.
- Warm: threshold signatures and time-locked approvals for weekly rebalances.
- Cold: offline, quarterly access cadence unless a break-glass event triggers more.
Pick a governance model you’ll actually enforce
- Define named approvers, backups, and rotation schedules.
- Tie every signing flow to ticketed requests with reason codes.
- Ship immutable logs to a write-once store you don’t admin.
Vendor due diligence without the theater
- Evidence of segregation and legal ownership. Ask for sample account statements and how they reconcile on-chain balances.
- Reports you understand (e.g., SOC 2 Type II, ISO 27001) and what scope they actually cover.
- Disaster-recovery drill cadence and the last time they restored from cold backups.
- Key compromise runbook: who does what in the first hour.
Bridges and L2s: treat them as separate risk buckets
- Limit bridge exposures, set per-route caps, and prefer routes with independent validators and public monitoring.
- Use allow-lists for destination contracts and trigger human review above thresholds.
Costs, SLAs, and the questions that save you later
Custodial costs differ. Some charge a percentage of your total holdings, while others use a fixed fee along with charges for each withdrawal. When choosing a custodian, don’t get too caught up in tiny cost differences – focus on avoiding major risks first.
Ask these out loud
- What’s the withdrawal SLA from each tier (hot, warm, cold) and how is it enforced during an incident?
- Where is key material physically and legally located? What jurisdictions have reach?
- How are client assets segregated on-chain and on the balance sheet? Show me the ledger.
- What happens if your cloud provider is down? Walk me through a day-two recovery.
- What are your spend limits, velocity checks, and anomaly alerts on hot paths?
- How do you audit smart-contract risk for supported tokens and chains?
- Insurance: what’s covered, what’s excluded, and who gets paid.
Risks & What Could Go Wrong
- Hot-key compromise on bridges, validators, or exchange hot wallets leading to rapid drains, as seen in July 2026 with AFX Trade’s bridge route.
- Counterparty failure or shutdown at a venue, freezing withdrawals or forcing manual queues, exemplified by the AscendEX wind-down.
- Poor segregation where client assets co-mingle with operating balances, complicating recovery in a bankruptcy.
- Smart-contract bugs in custody-integrated tooling (wrappers, token standards, or vault contracts).
- Jurisdictional actions or freeze orders creating legal, not technical, lockups.
- Human error in key ceremonies, backups, or policy configuration.
- Incomplete insurance that excludes social engineering, insider fraud, or contract exploits.
Most major failures aren’t caused by complex technical issues with encryption. They happen when security rules aren’t clear and quick actions are taken with sensitive information online.
For reliable updates on security breaches and new regulations in the crypto world, I recommend checking Crypto Daily. It’s a good way to verify what companies say against real-world incidents that have already happened.
Frequently Asked Questions
What is a qualified custodian in crypto?
This organization is legally authorized to hold customers’ assets safely, usually as a bank or trust company. It doesn’t guarantee perfect security, but it does ensure assets are kept separate, tracked with detailed records, and provides clear options for recovery if problems occur. Even these secure custodians often categorize their storage methods into different levels of access – ‘hot,’ ‘warm,’ and ‘cold’ – for efficiency.
How is cold storage different from just using a hardware wallet?
Cold storage isn’t just about *what* you use, but *how* you use it. A secure cold storage system involves strict procedures – it’s completely disconnected from networks, automated with scripts, physically protected, and meticulously tracked with multiple approvals and practiced recovery methods. Simply owning a hardware wallet isn’t enough; it needs to be used correctly to ensure it’s truly offline and managed securely.
How much should we keep in hot wallets?
As an analyst, I typically recommend provisioning only the resources you absolutely need for a standard operating period – often just a few days’ worth. This involves setting strict spending limits and velocity caps. The precise amount will vary based on how frequently you trade, the associated on-chain fees, and how quickly you can scale up from reserve or standby modes when demand surges.
Is MPC safer than multisig?
As an analyst, I’ve been looking at different secure custody solutions, and it’s clear that both multisig and MPC approaches tackle the same core problem – protecting digital assets – but they do so with different strengths and weaknesses. Multisig is straightforward and works well on blockchains that directly support it, offering a high degree of transparency. MPC, on the other hand, handles the complex decision-making process off-chain, which makes it more flexible when dealing with various types of assets. Ultimately, though, the actual security isn’t determined by *which* method you choose, but rather by *how* it’s implemented, the policies surrounding its use, and ongoing monitoring.
Do custodians insure assets?
While some insurance policies cover crypto losses, the extent of coverage can differ greatly. Many don’t cover losses from things like smart contract hacks, phishing scams, or dishonest employees. Always carefully review the policy details – specifically, the maximum payout per event, what’s *not* covered, and who receives the money. Remember, insurance should be a safety net, not your main method of protection.
What happens if our custodian or exchange goes down?
A qualified custodian helps legally protect your assets and ensures they can be returned to you smoothly. Using an exchange, however, means your assets are subject to the risks of that exchange – like potential operational shutdowns. No matter which route you choose, it’s crucial to have a plan for getting your assets out, including backup options and clear instructions on how to move them.
Are bridges and L2s safe enough for treasury?
While related, these issues should be handled as distinct risks, each with its own limits and approval processes. The AFX Trade problem in July 2026 stemmed from a problem with how critical keys were managed, not from a flaw in the token itself. Therefore, your solutions should focus on protecting those keys – things like isolating them, closely monitoring access, and using automated safeguards to quickly stop any problems.
2026-07-28 17:18