In 2025, hackers stole $3.4 billion in crypto, according to Chainalysis. A single attack on the Bybit exchange took $1.5 billion. For any firm that holds digital assets, the question is no longer whether to take custody seriously, but how.
At the same time, the door to custody has opened. US regulators removed the rules that kept banks away, a wave of crypto firms won national trust charters, and the EU’s MiCA rules now set one standard across 27 countries.
This guide explains crypto custody solutions for banks and large firms: what custody means, the main models, what changed in the rules, who the leading custodians are, what custody costs, and when it makes sense to build your own.
What Is Crypto Custody?
Crypto custody is the safekeeping of digital assets for someone else. In practice, it means protecting the private keys that control the assets, and making sure only approved people can move them, under clear rules.
Old-style custody holds a record of who owns what. Crypto custody holds the keys themselves. Lose the keys, and the assets are gone. Leak the keys, and anyone can take them. That is why crypto custody is as much about security engineering as it is about legal structure.
Good custody covers four things:
- Key security: how keys are created, stored and used to sign.
- Rules: who can approve a transfer, and up to what limits.
- Segregation: keeping each client’s assets apart and safe if the custodian fails.
- Records: clear reports for clients, auditors and watchdogs.
What Risks Does Crypto Custody Protect Against?
Custody exists to stop four kinds of loss:
- Outside attacks: hackers going after hot wallets, signing systems or staff. Chainalysis found that North Korean groups alone stole $2.02 billion in 2025, and the three largest hacks made up 69% of losses at services.
- Inside threats: a staff member, or a stolen login, moving funds without approval.
- Lost keys: keys that are deleted, damaged or known only to one person.
- Mistakes: sending to the wrong address, the wrong chain or the wrong client.
The FBI tied the Bybit theft to North Korea’s TraderTraitor group. The lesson for any firm holding crypto: the attack often targets people and approval steps, not only the code. Strong custody splits trust so no single person, device or login can move funds alone.
What Are the Main Crypto Custody Models?
There are four main ways to hold crypto for clients, and many institutions combine them.
- Qualified custodian: a regulated trust bank or trust company holds assets for you. Many funds and advisers must use one.
- Self-custody with MPC: keys are split into shares held by different parties or devices. No full key ever sits in one place.
- Multisig: a set number of keys, such as 2 of 3, must sign each transfer.
- Hardware security modules (HSMs): keys live in tamper-resistant hardware that signs inside the device.
Storage is split into tiers. Cold storage keeps keys offline for most assets. Hot wallets stay online for daily withdrawals. Warm setups sit in between, online but behind strict approvals. Fidelity Digital Assets keeps keys offline in several sites. Anchorage uses sealed hardware and face or fingerprint checks.
For the technology behind self-custody, see our guide to MPC wallet development, and for app wallets, our explainer on wallet-as-a-service.
How Did US Rules Change for Crypto Custody?
Between January 2025 and July 2026, US rules turned from a barrier into a green light.
- SAB 122 (January 2025): the SEC rescinded SAB 121, which had forced custodians to book client crypto as a liability on their own balance sheet. That rule had made custody very costly for banks.
- OCC Interpretive Letter 1183 (March 2025): confirmed that national banks can hold crypto in custody without asking for prior approval.
- FDIC and Federal Reserve (March to April 2025): removed their prior-approval rules and withdrew earlier warnings.
- National trust charters (December 2025 onward): the OCC conditionally approved charters for Circle, Ripple, BitGo, Fidelity Digital Assets and Paxos, then Bridge, Crypto.com and Coinbase in 2026. Circle received final approval in July 2026.
- SEC relief (September 2025): a no-action letter let advisers and funds use state trust companies as qualified custodians for crypto, under conditions such as segregation and audits.
The result is more choice. Banks can offer custody themselves, and large firms can pick from a growing list of licensed custodians.
What Does MiCA Require for Crypto Custody in the EU?
In the EU, custody is a licensed crypto-asset service under MiCA. A provider needs at least EUR 125,000 in capital, or a quarter of the previous year’s fixed costs if higher.
Article 75 of MiCA sets the core rules:
- A written contract with each client and a written policy.
- A register of each client’s positions.
- Statements to clients at least every three months.
- Client assets kept apart in law and in practice, so they stay safe if the custodian fails.
- Only authorised sub-custodians may be used.
Since 1 July 2026, ESMA has made clear that custody cannot be handed to firms without a MiCA licence, even in business-to-business deals. Our crypto license guide covers MiCA and other regimes in more detail.
Who Are the Leading Crypto Custodians?
| Custodian | Type | Scale or note |
| Coinbase Custody | NY trust company, qualified custodian | $246B in assets on platform (June 2026) |
| BitGo | Trust company, listed on NYSE since January 2026 | $65.2B in assets on platform, 5,833 clients (Q2 2026) |
| Anchorage Digital | US national trust bank | Valued at $4.2B after a Tether investment (Feb 2026) |
| BNY | Global custody bank | Crypto custody since 2022; added staking in 2026 |
| Fidelity Digital Assets | Trust company | Custody since 2018; conditional national charter (Dec 2025) |
| Sygnum, AMINA | Swiss licensed banks | Custody for professional clients |
The market is splitting in two. Crypto firms lead on speed and the number of coins they support. Big banks bring their brand, their size and their current clients.
How Much Does Crypto Custody Cost?
Few custodians publish prices. One that does is Coinbase: its custody pricing page lists 50 basis points a year, a $500,000 minimum balance, and a one-time setup fee of up to $10,000.
A worked example makes this real. At 50 basis points, holding $10 million costs about $50,000 a year, and holding $100 million costs about $500,000 a year. BNY, State Street, Anchorage and Fidelity do not publish their fees, so large clients negotiate.
That is why firms with large balances often look at running custody themselves. The upfront build is bigger, but there is no fee that grows with every dollar held.
Build Institutional-Grade Custody Technology
Crypto Wallet and Custody Development — done right.
- MPC and Multisig: Split-key signing with policy controls and approval flows.
- Hot and Cold Tiers: Automated sweeps between hot, warm and cold storage.
- Audit Trails: Full logs, role-based access and reporting for regulators.
- Integrations: Connect exchanges, custodians, staking and treasury tools.
Get a free custody architecture consultation — before spending a single dollar.
Book a Free Demo to see how we build secure custody wallets for exchanges and institutions.
Can Custodians Offer Staking and Other Services?
Yes, and it is becoming standard. Clients want their held assets to earn, not just sit. BNY added staking to its crypto custody service in August 2026 through a partnership, and many crypto custodians let clients stake from cold or warm storage without moving assets out.
The same custody layer can also support settlement with exchanges, lending under client consent, and voting in blockchain governance. Each service adds risk, so each needs its own rules in the policy engine: who can approve it, which assets it covers and how rewards are reported.
Should You Use a Custodian or Build Your Own Custody?
Use a licensed custodian if:
- The rules say your clients need one, as with many funds and advisers.
- You hold assets for others but custody is not your core business.
- You want to launch fast without a security team.
Build your own custody stack if:
- You are a bank, exchange or fintech that will hold large balances.
- You need your own brand, controls and speed.
- Custody fees at scale would outweigh the cost of building.
Choose a hybrid if:
- You want control but also a regulated co-signer. With MPC, you and a licensed partner each hold key shares, and neither can move funds alone.
What Does a Custody Platform Need?
Whether you buy or build, check for these parts:
- Signing engine: MPC, multisig or HSM-based signing.
- Policy engine: approval rules, spending limits, allow-lists and time locks.
- Tiered storage: automated movement between hot, warm and cold wallets.
- Segregated accounts: per-client records that meet MiCA or trust law rules.
- Audit and reporting: full logs, SOC reports and client statements.
- Links to other tools: exchanges, staking, settlement and bookkeeping.
A secure crypto wallet development partner can build these layers under your brand, so your team controls the rules and the data.
Frequently Asked Questions
What is crypto custody?
Crypto custody is the safekeeping of digital assets on behalf of clients. It means protecting the private keys, controlling who can move assets, keeping each client’s assets separate, and reporting to clients and regulators.
Can banks offer crypto custody?
Yes. In the US, OCC Interpretive Letter 1183 (March 2025) confirmed banks can hold crypto for customers without prior approval, and SAB 122 removed the accounting rule that made it costly. In the EU, custody needs a MiCA licence.
What is a qualified custodian for crypto?
A regulated firm allowed to hold client assets for investment advisers and funds, such as a national or state trust bank. In September 2025, SEC staff said state trust firms can act as qualified custodians for crypto, if they meet set terms.
How much does crypto custody cost?
Coinbase publishes a fee of 50 basis points a year with a $500,000 minimum. On $10 million, that is about $50,000 a year. Most others set fees in private talks.
What is the difference between hot and cold storage?
Cold storage keeps keys offline and is used for most assets. Hot wallets are online for daily transfers and hold only what is needed. Custodians move funds between them under strict approval rules.
What is MPC custody?
MPC custody splits a private key into shares held by different parties or devices. They sign together without ever rebuilding the full key, which removes the single point of failure.
How much capital does a MiCA custody licence need?
At least EUR 125,000, or a quarter of the previous year’s fixed costs if that is higher.
Why did SAB 121 matter?
SAB 121 required custodians to record client crypto as a liability on their own balance sheet, which made custody expensive for banks. SAB 122 rescinded it in January 2025.