Why Institutional Investors Are Rethinking Crypto Custody

For the institutions now holding digital assets, the hard question has changed. It is no longer whether to own crypto or not, but how to hold it without putting the firm itself at risk. Pension funds, corporate treasuries, and asset managers have moved well past the experiment stage; once real capital is committed, custody stops being a back-office detail.

Over the past two years, that shift has pushed custody into the same conversation as counterparty limits and audit controls. The question now reaching boards and risk committees is easy to state and awkward to answer: if the provider holding our assets fails, what happens to them? How a firm answers it increasingly decides who guards its digital assets.

Custody Climbs the Org Chart

As auditors, risk officers, and directors turned to digital assets, they brought the questions they ask of any holding: where is it kept, who can move it, and what protects it if the counterparty collapses? Custody now sits inside the same governance framework as cash management and securities safekeeping; a vague trust in the exchange no longer passes a board review.

No Longer the Trading Desk's Call Alone

One sign of how far this has gone is where the decision now sits. In the past, choosing a custodian fell to whoever ran the trading relationship. Today it pulls in legal, compliance, and finance, and often the board, because a custody failure is a balance-sheet event, not a bad trade. By design, it moves slower now. Committees that already vet a prime broker or a banking partner now hold the custodian to the same bar.

Counterparty Exposure Moved to the Center

The sharpest driver of the rethink is counterparty exposure, the risk that the other side of a relationship fails and takes client assets with it. In crypto, that risk stopped being theoretical in 2022. When FTX collapsed, customer funds that should have been segregated were funneled into an affiliated trading firm, and a U.S. court later ordered 12.7 billion dollars returned to customers. For institutional allocators, the takeaway was structural, not emotional; a venue that both executes trades and holds the keys concentrates risk in one place, and breaking up that concentration is what a risk team exists to do.

Combining Functions Without Repeating the Mistake

Concentration was not the whole lesson, though. At FTX, the damage came from commingling client money and operating without segregation, not from running several services at once. Pairing execution with custody is not itself the danger; losing segregation is.

Some firms now look for that pairing done properly, where a managed crypto brokerage offering institutional-grade custody and OTC trading keeps safekeeping and settlement inside one accountable relationship, with a single answerable line on who can move the keys. What counts is not how many functions sit under one roof, but whether the controls behind them hold.

The Operational Risks Behind Digital Assets

Beyond outright failure, digital assets carry operational risks that traditional instruments do not. A private key is a bearer instrument, so whoever holds it can move the funds; no clearing house exists to reverse an error or claw back a theft. Because settlement is final, a control that only flags a problem after the fact is close to useless once the transfer clears. Insider access, a lost key, or a single compromised laptop can each end in permanent loss.

Reconciliation is harder because on-chain records and the firm's internal books have to agree continuously and in real time, rather than being squared away once a month in a routine close. For a firm handling other people's money, each of these is a line in a risk register with a named owner.

Why the Shift Is Happening Now

The timing is not accidental. As spot Bitcoin exchange-traded funds and corporate buyers pulled digital assets into mainstream portfolios, administrators, auditors, and compliance teams came with them, all expecting a recognized standard. A hardware wallet in a drawer does not meet it.

Institutions want audited controls, insurance, clear reporting, and a custodian they can name in a filing, and the market for that service has widened to match.

How Firms Now Choose a Custodian

With the risks in view, institutions assess custody providers the way they would any critical vendor, and a familiar set of questions settles most decisions. Segregation comes first, because client assets must be legally separate from the provider's own so an insolvency cannot sweep them up. Independent assurance follows, usually a current SOC 2 Type II report, sometimes backed by proof-of-reserves attestations.

Key management draws close scrutiny, including how much stays in cold storage and whether more than one person must approve a large transfer. Beyond those, insurance, clear reporting, and a documented recovery plan round out the list, and the custodian's jurisdiction can decide who owns the assets if the business enters administration.

What This Means for Institutional Desks

None of this is settled, and crypto custody will keep maturing as regulation and products catch up. The direction, though, is set. For institutions entering digital assets, custody has become part of the diligence done before capital moves, written into mandates and revisited as positions grow, not bolted on once the trade is booked.

Chainalysis estimated that roughly 2.2 billion dollars was stolen from crypto platforms in 2024, a reminder that the threat is current, not historical. The desks that treat custody with the rigor they give any other counterparty are the ones least likely to become the next cautionary tale.