Wallet Custody Models
Who holds the keys, who bears loss, and who can move the assets?
By Anton Titov, Founder · Plexo Institute
Stablecoin custody maps back to familiar trad fin questions control, segregation, insurance but production models split across custodial, MPC, multi sig, and hybrid self custody patterns.
Reading Guide
Four moves that frame how custody choices map to trad-fin analogs and where those analogs break.
Control asks who can authorize movement. Segregation asks whether client assets are separable from operator assets in bankruptcy. Insurance asks what happens if assets are lost or stolen. Every model trades these differently.
A custody arrangement can combine delegated control, threshold signing, on-chain policy and customer-held credentials. Technical architecture alone does not determine legal custody, segregation, insurance or recovery rights.
The on-chain footprint, transaction cost, privacy, and portability vary by chain and implementation. Multi-signature makes policy visible on-chain; MPC commonly produces one final signature, but neither fact alone determines operational security.
A network can allocate member control, settlement authority and policy enforcement across several parties. The arrangement should specify signing thresholds, legal roles, custody status, segregation, incident response and exit or migration rights.
The Custody Question Restated
Custody is an institutional decision about key control, asset segregation, and loss protection; MPC and multi-sig implement different parts of that decision.
The crypto vocabulary changes, but the institutional questions are familiar: who controls the asset, how it is segregated, and what protection exists if something breaks.
| Property | What it asks | Trad-fin parallel |
|---|---|---|
Control | Who can authorize an outbound movement? | Signature authority and account control |
Segregation | Are client assets separable from operator assets? | Customer asset rules and qualified custody |
Insurance | What happens if assets are lost or stolen? | SIPC, specie insurance, custodian indemnity |
Custodial: The Omnibus Analog
A provider may hold credentials or operate wallets under contractual terms; legal custody and client protections depend on the entity, jurisdiction and agreement.
Custodial models are easiest to understand as delegated control plus contractual accountability.
Providers may offer institutional custody, wallet technology, governance controls, reporting and insurance arrangements. Their regulatory status, wallet structure, sub-ledger treatment, insurance scope and client protections differ by legal entity, product and jurisdiction; verify the current agreement rather than infer them from a provider name.
An omnibus arrangement can use records to attribute interests among clients. Whether a stablecoin arrangement creates segregation, a client claim, custody status or insolvency protection depends on the agreement, ledger design, applicable law and the provider—not on the omnibus label alone.
Threshold cryptography replaces one privileged private key with collaborative signing.
A threshold-MPC design distributes signing material among parties so the configured threshold participates in producing a signature without reconstructing one conventional private key. Whether one party can act alone depends on the threshold, policy engine, recovery configuration, implementation and operational controls.
MPC Moves Control Without Rebuilding The Key
Policy, separate key shares, and a threshold ceremony collapse into one ordinary on-chain signature.
First gate
Policy allows signing
Limit, role, destination, and approval checks pass before any key share participates.
Blockchain sees
One ordinary signature
No participant reconstructs the whole private key, but the transfer receives a valid signature.
MPC providers differ in signing design, deployment, policy controls, supported chains, recovery, audit evidence and portability. It can reduce a single-key concentration risk, but it does not by itself prove policy enforcement, legal custody, continuity or security.
Multi-Sig: Programmable Governance
Some multi-signature arrangements make threshold-approval logic observable on-chain; the exact policy and its consequences depend on the implementation.
Multi-signature and MPC can differ in signature format, policy visibility, fees and recovery design. Neither category has one universal chain, privacy, cost or security profile.
| Property | Multi-sig | MPC |
|---|---|---|
Visibility | Can expose threshold or contract configuration on-chain | Can produce a conventional-looking signature; implementation and disclosures vary |
Cost | Depends on contract, chain and execution path | Depends on protocol, chain and execution path |
Cross-chain | Support depends on the wallet and chain implementation | Support depends on provider, protocol and chain implementation |
Privacy | Depends on what the contract and transaction reveal | Depends on the signing and operational design |
Maturity | Assess the specific wallet, code, audit and operating history | Assess the specific protocol, implementation, audit and operating history |
DAO treasury management, protocol-foundation custody, high-value cold storage where public signer structure is acceptable, and single-chain operations where on-chain governance is meaningful.
Non-Custodial: The Qualified-Custodian Analog
The operator does not hold customer keys.
Non-custodial designs reduce operator custody risk, but they shift execution, recovery, and insurance questions to the customer or smart-account policy.
Self-custody can give a customer direct credential control and reduce one form of provider exposure. Recovery, insurance, operational support and legal responsibility depend on the wallet design, backup and recovery policy, customer agreement and jurisdiction; loss is not always irrecoverable in smart-account designs.
Account abstraction and smart-contract wallets add policies such as limits, recovery, time locks, and veto roles while leaving primary control with the customer. This creates hybrid models with no exact trad-fin equivalent.
Choosing a Model
The right model depends on counterparty profile, regulation, operational maturity, and insurance need.
The choice is an operating-model decision, not an ideological preference for one custody technology.
| Decision factor | Push toward custodial | Push toward MPC | Push toward self-custody |
|---|---|---|---|
Counterparty profile | Retail or mass-market clients | Institutional B2B | Crypto-native or sovereign |
Regulatory regime | Strict consumer protection | Institutional or wholesale | Permissive or under-regulated |
Operational maturity | Low to medium | Medium to high | High |
Insurance need | High | Medium | Low or accepted by customer |
Plexo’s proposed clearing architecture uses a hybrid pattern: member-level control plus network policy over settlement wallets. It is an architecture view, not a measurement of the market-wide custody pattern.
Counter-Arguments & Limitations
The custody stack moves risk; it does not make risk disappear.
Every custody model concentrates a different failure mode, so the right question is which failure mode the institution can govern.
A small set of MPC providers sits under much institutional activity. The counterpoint is that provider compromise is not the same as custodian theft if threshold shares remain separated. The real risk is operational continuity and migration, not unilateral asset control.
The counterpoint is that account abstraction and smart-contract wallets make self-custody less like a hardware-wallet burden and more like programmable operating policy.
About This Explainer
Scope, disclosure, and method.
Plexo’s proposed clearing architecture uses a hybrid pattern: member-level control plus network policy over settlement wallets. This is Plexo analysis, not a claim of market-wide dominance.
Data vintage: 2020-2025. Framework derived from FATF custody guidance, NYDFS Part 200, OCC custody letters, FCA CASS analogs, public provider disclosures, MPC research, Ethereum EIP-4337, and Safe documentation. This explainer is descriptive and does not endorse specific custody providers.
Relevant Reading
References
6 references- Updated Guidance for VAs and VASPs — FATF
- Part 200: Virtual Currencies — NYDFS
- Interpretive Letter 1183 — OCC
- MPC Technology and Custody Disclosures — Fireblocks; Coinbase Custody
- EIP-4337: Account Abstraction — Ethereum
- Safe Protocol Specifications — Safe