explains

Wallet Custody Models

Who holds the keys, who bears loss, and who can move the assets?

Published

Stablecoin custody maps back to familiar trad fin questions control, segregation, insurance but production models split across custodial, MPC, multi sig, and hybrid self custody patterns.

Reader Brief

Reading Guide

Four moves that frame how custody choices map to trad-fin analogs and where those analogs break.

Custody decomposes into control, segregation, and insurance.

Control asks who can authorize movement. Segregation asks whether client assets are separable from operator assets in bankruptcy. Insurance asks what happens if assets are lost or stolen. Every model trades these differently.

Three production patterns dominate.

Custodial providers resemble omnibus prime brokers. MPC distributes signing without reconstructing a single key. Multi-sig enforces on-chain governance through smart contracts.

MPC and multi-sig are not interchangeable.

Multi-sig is transparent and battle-tested for on-chain governance. MPC is generally more private, lower gas, and more chain-agnostic. Cross-chain stablecoin operations push toward MPC.

The B2B clearing pattern is hybrid.

Each member FI controls its own keys through its preferred provider while the network uses MPC for settlement wallets and policy enforcement.

The Custody Question Restated

Digital-asset custody answers the same three questions trad-fin has refined for decades.

The crypto vocabulary changes, but the institutional questions are familiar: who controls the asset, how it is segregated, and what protection exists if something breaks.

PropertyWhat it asksTrad-fin parallel
ControlWho can authorize an outbound movement?Signature authority and account control
SegregationAre client assets separable from operator assets?Customer asset rules and qualified custody
InsuranceWhat happens if assets are lost or stolen?SIPC, specie insurance, custodian indemnity

Custodial: The Omnibus Analog

A regulated custodian holds the keys and gives the customer a contractual claim.

Custodial models are easiest to understand as delegated control plus contractual accountability.

Production custodial providers

Examples include Coinbase Custody, Anchorage Digital, BitGo Trust, Fidelity Digital Assets, and Komainu. Common traits: regulated trust-company or equivalent status, institutional client base, omnibus wallets, internal sub-ledgers, and insurance programs [2][3].

Why omnibus is the trad-fin analog

A prime broker or custodian may hold assets in an omnibus account while internal records attribute holdings to specific clients. Custodial stablecoin custody works similarly: the custodian controls the on-chain wallet and owes the customer a contractual and regulatory custody obligation.

MPC: Shared Signing Without a Single Key

Threshold cryptography replaces one privileged private key with collaborative signing.

Multi-Party Computation splits signing authority across N parties. A threshold of those parties collaborates to sign a transaction without reconstructing a full private key. The result is a single valid blockchain signature, but no single party can move assets alone [4].

Threshold ceremony diagram showing policy approval, an example two-of-three set of MPC shares, and one ordinary blockchain signature without reconstructing the full private key.
MPC custody works as a ceremony: policy permits the transfer, enough partial shares cooperate, and the chain receives one ordinary signature.

Production MPC providers

Fireblocks, Copper, Cobo, Fordefi, Safeheron, and Liminal are common production providers. For stablecoin clearing operators, MPC is attractive because it supports policy enforcement and cross-chain operations without putting one private key in one place.

Multi-Sig: Programmable Governance

Multi-sig puts the signing policy on-chain.

The key distinction is where the signing policy lives: on-chain for multi-sig, off-chain for MPC.

PropertyMulti-sigMPC
VisibilitySigners visible on-chainSigners off-chain; final signature visible
CostHigher gas for multiple signaturesLower gas for one signature
Cross-chainChain-specific implementationsGenerally chain-agnostic
PrivacyLowerHigher
MaturityBattle-tested since 2014Production maturity since roughly 2020

When multi-sig wins

DAO treasury management, protocol-foundation custody, high-value cold storage where public signer structure is acceptable, and single-chain operations where on-chain governance is meaningful.

Non-Custodial: The Qualified-Custodian Analog

The operator does not hold customer keys.

Non-custodial designs reduce operator custody risk, but they shift execution, recovery, and insurance questions to the customer or smart-account policy.

Self-custody trade-off

Self-custody gives the customer direct control and avoids operator-key exposure. The trade-off is operational complexity, limited insurance, and no recovery if the customer loses keys.

Smart-contract account patterns

Account abstraction and smart-contract wallets add policies such as limits, recovery, time locks, and veto roles while leaving primary control with the customer [5][6]. This creates hybrid models with no exact trad-fin equivalent.

Choosing a Model

The right model depends on counterparty profile, regulation, operational maturity, and insurance need.

The choice is an operating-model decision, not an ideological preference for one custody technology.

Decision factorPush toward custodialPush toward MPCPush toward self-custody
Counterparty profileRetail or mass-market clientsInstitutional B2BCrypto-native or sovereign
Regulatory regimeStrict consumer protectionInstitutional or wholesalePermissive or under-regulated
Operational maturityLow to mediumMedium to highHigh
Insurance needHighMediumLow or accepted by customer

Evidence And Sources

This raw HTML export preserves source visibility for crawler and contractor review. Indexing decision: index, follow.

  1. Updated Guidance for VAs and VASPs - FATF
  2. Part 200: Virtual Currencies - NYDFS
  3. Interpretive Letter 1170 - OCC
  4. MPC Technology and Custody Disclosures - Fireblocks; Coinbase Custody
  5. EIP-4337: Account Abstraction - Ethereum
  6. Safe Protocol Specifications - Safe

Internal Graph