Institutional Bitcoin Custody: How It Works

How institutions acquire and secure Bitcoin: OTC execution, cold storage, multisig and MPC, the custodian landscape, regulation and insurance — with the failures that shaped today's practices.

44 tracked holders hold 3,064,990 BTC ($196.9B, 15.43% of supply) at $64,246 per BTC. Data as of .

Why custody is the linchpin of institutional Bitcoin

Every institutional Bitcoin position — an ETF share, a corporate treasury line item, a pension allocation — ultimately resolves to a private key that must be generated, stored, and used without ever being stolen or lost. Bitcoin transactions are irreversible, so a custody failure is not an operational inconvenience the way a failed equity settlement is; it is a permanent loss of the asset. That is why custody, more than trading or accounting, has been the gating factor for institutional adoption, and why the period from January 2025 through mid-2026 — which removed the main accounting, banking, and regulatory obstacles to holding Bitcoin for clients — matters so much for the entities tracked across BTC Crawl's holder database.

Speaking at Consensus in May 2026, panelists from the ETF and custody industry argued that while spot ETFs solved the access problem, custody infrastructure, advisor platforms, and market plumbing still lag the demand they unlocked (CoinDesk, May 2026). This guide covers what a qualified custodian actually is, who the major custodians are as of August 2026, how the underlying key-management architectures differ, what insurance really covers, and how the regulatory picture changed through 2025 and 2026.

What is a qualified custodian?

The term comes from the SEC's custody rule — Rule 206(4)-2 under the Investment Advisers Act of 1940. A registered investment adviser that has custody of client funds or securities must keep them with a "qualified custodian": a bank or savings association, a registered broker-dealer, a futures commission merchant, or certain foreign financial institutions. National banks and Federal Reserve member state banks are presumptively qualified; the harder question for crypto has always been whether state-chartered trust companies — the charter most crypto custodians actually hold — count as "banks" for this purpose.

Two developments settled much of that uncertainty:

  • In June 2025 the SEC formally withdrew its February 2023 proposed "safeguarding rule" amendments, which would have expanded and tightened the custody rule in ways the crypto industry argued were unworkable, and stated it did not intend to finalize the proposal (noted in the SEC staff relief coverage by Morgan Lewis).
  • On September 29, 2025, SEC staff issued no-action relief allowing registered investment advisers and regulated funds to treat state-chartered trust companies as "banks" for custody-rule purposes with respect to crypto assets and related cash — effectively blessing the NYDFS-trust-company model used by Coinbase Custody, Gemini, Fidelity Digital Assets and others (Morgan Lewis, October 2025).

In practice, institutional Bitcoin custodians operate under one of three charter models: a state trust charter (most commonly the New York limited purpose trust company supervised by NYDFS), a federal charter from the Office of the Comptroller of the Currency (a national trust bank or, in Anchorage's case, a full national bank charter), or — increasingly since 2025 — an existing bank's own national charter, now that the OCC has confirmed crypto custody is a permissible banking activity.

The major custodians in 2026

The competitive map shifted meaningfully in 2025–2026: BitGo went public and converted to a federally chartered national trust bank, Coinbase won preliminary OCC approval for a national trust charter of its own, and Standard Chartered moved to fold Zodia Custody into its corporate and investment bank. The table below summarizes what could be verified as of August 2026.

CustodianType / charterNotable verifiable roles
Coinbase Custody / Coinbase PrimeNYDFS-chartered trust company; OCC preliminary conditional approval for Coinbase National Trust Company, April 2026 (Forbes)Custodian for 9 of 12 US spot Bitcoin ETFs, roughly 84% of US spot-ETF Bitcoin (Bitwise via Crypto Briefing); custody business reported $245.7B in assets under custody as of June 30, 2025 (Forbes)
BitGoOCC-chartered national trust bank (BitGo Bank & Trust, N.A.); publicly listed NYSE: BTGO since January 22, 2026 (Business Wire)Custodian for Hashdex's US crypto index ETF; named backup custodian for Fidelity's FBTC in an 8-K (TFTC)
Fidelity Digital AssetsNYDFS limited purpose trust company, chartered 2019 (CoinDesk)Self-custodies Fidelity's own FBTC spot Bitcoin ETF — the only major US issuer using an affiliated custodian
Anchorage DigitalAnchorage Digital Bank N.A. — the only US federally chartered digital asset bank with a full OCC national bank charter (The Block)Added as an additional custodian for BlackRock's IBIT and ETHA in April 2025, creating a dual-custodian model alongside Coinbase (Bloomberg)
Gemini CustodyNYDFS-chartered trust companyCustodian for VanEck's HODL spot Bitcoin ETF (Gemini)
Zodia CustodyStandard Chartered-backed; in May 2026 Standard Chartered announced plans to fold Zodia's digital asset custody business into its corporate and investment bank (Bitcoin.com News)Bank-grade custody for institutions, primarily outside the US
KomainuNomura-backed regulated custodian; licensed or registered in Jersey, the UK, Italy, and Dubai (VARA) (Komainu)Segregated institutional custody; Komainu Connect lets clients trade on venues while assets remain in custody

Alongside these custodians sit the technology providers — Fireblocks, Taurus, and similar MPC/wallet-infrastructure firms — which do not take custody themselves but supply the key-management stack that many banks and fintechs build on. Deutsche Bank, for example, is building its 2026 custody service with Bitpanda's technology unit and Taurus (Bloomberg, July 2025).

Cold storage, multisig, and MPC: how the vaults actually work

Charter type tells you who regulates a custodian; architecture tells you how the keys are protected. Three models dominate, and most large custodians blend them.

Deep cold storage

Keys are generated and held on devices that never touch the internet — hardware security modules or air-gapped machines in geographically distributed vaults. Signing a withdrawal requires a human ceremony: multiple employees, identity checks, and deliberate time delays. This is the model regulators and insurers understand best, and it is why ETF custody agreements typically require the overwhelming majority of fund Bitcoin to sit in cold storage. The trade-off is latency — withdrawals can take hours to days — which is acceptable for an ETF that settles creations and redemptions on known schedules, and less so for an active trading desk.

Multisignature (multisig)

Bitcoin natively supports requiring M-of-N keys to spend (for example 2-of-3), so no single key — and no single person, device, or site — can move funds. Multisig is transparent and auditable on-chain, and it underpins BitGo's long-standing model as well as collaborative-custody arrangements where a corporate holds some keys and a custodian holds others. Its limits: the quorum policy is visible on-chain, and native multisig is Bitcoin-specific rather than a uniform scheme across assets.

Multi-party computation (MPC)

MPC splits a single private key into mathematical shares held by different parties or devices; signatures are computed jointly without the full key ever existing in one place. It produces a standard-looking on-chain signature, works identically across chains, and allows fast, policy-governed signing — which is why it dominates the technology stacks (Fireblocks, Taurus, and peers) that banks are adopting. The trade-off is that security rests on the correctness of relatively new cryptographic implementations rather than on Bitcoin's simple, battle-tested script rules.

In practice, an institutional custodian's real security perimeter is as much organizational as cryptographic: dual-control policies, hardware-enforced withdrawal allowlists, time-locked approvals, background-checked signing officers, and SOC 1/SOC 2 audited processes. The key ceremony matters less than whether any single insider — or any single compromised office — can move client Bitcoin.

Insurance: real, but far smaller than the assets

Custodial insurance exists, and it is routinely misunderstood. Coinbase, per its own disclosures, carries a commercial crime insurance policy of $320 million covering hot, warm, and cold storage assets — a policy shared across the platform, not a per-client guarantee (Coinbase insurance disclosure). Industry comparisons place Copper's base cold-storage policy around $500 million and BitGo's primary specie coverage around $250 million (Spark custody insurance comparison). Zodia has advertised coverage above $100 million (Cobo custodian guide, 2026).

Set those numbers against the assets: Coinbase alone reported roughly $376 billion in assets on platform at year-end 2025 (Forbes, April 2026). Insurance limits are three orders of magnitude smaller than assets under custody. The realistic reading is that insurance covers operational-scale losses — a compromised hot wallet, insider theft within a bounded window — not a catastrophic cold-storage failure. Policies also exclude losses from a client's own credential compromise, and there is no FDIC or SIPC equivalent for crypto assets. What actually protects clients at scale is bankruptcy-remoteness: assets held in segregated accounts under a trust or bank charter are client property, not the custodian's balance-sheet assets, and should not be available to the custodian's creditors in an insolvency. That legal structure, more than any insurance policy, is the core of the institutional custody value proposition.

Concentration risk: the Coinbase question

The most-cited structural risk in institutional Bitcoin custody is that so much of it sits in one place. Per Bitwise research reported in 2026, Coinbase custodies 9 of the 12 US spot Bitcoin ETFs — roughly 84% of the Bitcoin those funds hold — and CEO Brian Armstrong said in February 2026 that Coinbase custodies more than 80% of US BTC and ETH ETF assets (Crypto Briefing). The exceptions among major funds: Fidelity's FBTC uses affiliated Fidelity Digital Assets, VanEck's HODL uses Gemini, and Hashdex uses BitGo (Gemini).

Issuers are aware of the concentration. In April 2025, BlackRock — sponsor of IBIT, the largest spot Bitcoin ETF — added Anchorage Digital Bank as an additional custodian alongside Coinbase via a Form 8-K, explicitly to add operational resilience through a dual-custodian model (Bloomberg; etf.com). Fidelity likewise named BitGo as a backup custodian for FBTC (TFTC).

Two honest caveats cut in opposite directions. First, "Coinbase custody" is not one vault: assets are held in segregated cold-storage accounts per client, so concentration is about shared organizational and software risk, not a literal single point of theft. Second, concentration is still real risk — a critical flaw in one custodian's key-generation process, signing infrastructure, or personnel controls would touch most of the US ETF complex at once. The dual-custodian trend, plus the arrival of chartered bank competitors, is the market's response. You can see how much Bitcoin sits behind each fund on the ETF holdings tracker.

The regulatory arc: 2022 to 2026

SAB 121 and its rescission (SAB 122, January 2025)

From 2022, SEC Staff Accounting Bulletin 121 directed companies that safeguard crypto for clients to record those client assets as liabilities on their own balance sheets — a treatment that made custody capital-prohibitive for regulated banks, since a bank holding $10 billion of client Bitcoin would carry a $10 billion balance-sheet liability. On January 23, 2025, the SEC issued SAB 122, rescinding SAB 121; safeguarding obligations are now assessed as contingent loss exposures under normal FASB/IAS standards instead of gross balance-sheet liabilities (Ropes & Gray; ABA Banking Journal). This single change is the main reason large custody banks re-entered the market.

OCC interpretive letters 1183 and 1184 (2025)

In March 2025 the OCC issued Interpretive Letter 1183, reaffirming that crypto-asset custody, certain stablecoin activities, and node-network participation are permissible for national banks — and rescinding the prior requirement that banks obtain supervisory non-objection before engaging in them. In May 2025, Interpretive Letter 1184 went further: banks may buy and sell custodied crypto at customer direction, provide trade-execution services around custody, and outsource custody and execution to sub-custodians under normal third-party risk management (OCC news release). The OCC issued further interpretive guidance on bank crypto activities in November 2025 (Interpretive Letter 1186), and moved into chartering: BitGo received full OCC approval as a national trust bank in January 2026 (BitGo), and Coinbase received preliminary conditional approval for a de novo national trust company in April 2026 (Forbes).

Legislation: GENIUS Act enacted, market structure pending

The GENIUS Act — the federal payment-stablecoin framework — was signed into law on July 18, 2025 (Sullivan & Cromwell). It matters to custody indirectly: stablecoin reserve and settlement infrastructure runs through the same regulated custodians. The broader market-structure bill, the CLARITY Act, passed the House 294–134 on July 17, 2025 and would hand the CFTC spot-market jurisdiction over digital commodities including Bitcoin, but as of August 2026 it remains pending in the Senate (Arnold & Porter). Custody rules for advisers therefore still rest on the SEC custody rule plus the 2025 staff relief, not on a completed statutory framework.

The banks arrive

With SAB 121 gone and OCC permission explicit, traditional custody banks — which safeguard tens of trillions of dollars in conventional assets — moved in earnest:

  • BNY Mellon was the earliest mover among the giants, already offering Bitcoin and Ether custody and planning to expand token coverage; it obtained regulatory clearance to custody Bitcoin and Ether ETF assets in 2024 (The Crypto Basic).
  • State Street, the world's second-largest custody bank, has said it will begin custodying Bitcoin and other crypto assets for clients in 2026 (The Crypto Basic).
  • Citi has confirmed it is on track to launch crypto custody for asset managers and institutional clients in 2026, after two to three years of build-out (Ledger Insights).
  • Deutsche Bank plans a 2026 custody launch built with Bitpanda's technology arm and Taurus (Bloomberg).
  • JPMorgan is the notable holdout: it will let clients buy Bitcoin, but Jamie Dimon has said the bank will not custody it — "custody is not on the table" (TheStreet).

The likely effect is a two-tier market: crypto-native custodians (Coinbase, BitGo, Anchorage, Fidelity Digital Assets, Gemini) with deep operational history, and global custody banks bringing existing client relationships and balance-sheet credibility. Standard Chartered's move to absorb Zodia into its investment bank (Bitcoin.com News, May 2026) suggests the two tiers may converge through acquisition as much as competition.

Self-custody vs third-party custody for corporates

Corporate treasuries tracked on our public companies page face a different calculus than ETFs. An ETF sponsor effectively must use a qualified custodian; a corporation holding Bitcoin on its own balance sheet is not bound by the Advisers Act custody rule and can legally self-custody. In practice, most large corporate holders — including Strategy (MicroStrategy), whose SEC risk-factor disclosures describe reliance on regulated custodians rather than self-custody — choose institutional custody, for reasons that map to how public companies are actually run:

  • Auditability. External auditors can confirm holdings via custodian attestations and SOC reports; auditing a self-managed multisig is harder and less standardized.
  • Key-person risk. Self-custody concentrates catastrophic power in a handful of employees; custodians replace that with institutional controls and legal accountability.
  • Insurance and legal recourse. A chartered custodian offers a regulated counterparty, segregation of assets, and at least bounded insurance; self-custody offers neither recourse nor coverage.
  • Governance optics. Boards and D&O insurers are far more comfortable approving a custody agreement with a chartered trust bank than an internal key ceremony.

The middle path — collaborative custody, where the corporate holds one or more keys in a multisig quorum alongside a custodian — is growing among mid-sized treasuries that want to eliminate unilateral custodian risk without taking on full operational burden. Whichever model a company chooses, BTC Crawl's methodology only records what is publicly disclosed: filings rarely specify custody architecture, so custody details on entity pages are noted only when a company or fund has disclosed them.

How institutions actually buy Bitcoin

Custody is where Bitcoin rests; execution is how it arrives. Institutions rarely buy on retail exchange order books, because a nine-figure market order would move the price against them and leak their intentions. The standard channels:

  • OTC desks. Over-the-counter desks (run by firms such as Galaxy, Cumberland, FalconX, and Coinbase's institutional arm) quote a single price for a large block, absorbing the size into their own inventory and hedging across venues. Settlement is typically same-day, direct to the buyer's custody account, with no public order-book footprint.
  • Prime brokers. Crypto prime brokerage bundles execution, financing, and custody access behind one credit relationship — Coinbase Prime is the dominant US example, and OCC Interpretive Letter 1184's blessing of bank-provided execution around custody points to banks entering this layer too (OCC).
  • Agency execution algorithms. For programmatic accumulation — the pattern used by ETF authorized participants and treasury companies alike — agency desks work TWAP/VWAP-style orders across many venues over hours or days, minimizing market impact. Corporate buyers like Strategy and Twenty One Capital disclose purchases at a blended average price, which is the signature of this kind of execution.
  • In-kind ETF flows. Since US spot Bitcoin ETFs began, authorized participants have increasingly moved actual Bitcoin (rather than only cash) between their own custody and fund custody accounts during creations and redemptions, tightening the link between the execution and custody layers.

The common thread: in every channel, the Bitcoin ends its journey at a custodian, which is why custody capacity — not trading capacity — sets the ceiling on institutional adoption.

Frequently asked questions

Who custodies BlackRock's Bitcoin ETF?

Coinbase Custody is the primary custodian for BlackRock's iShares Bitcoin Trust (IBIT). In April 2025 BlackRock added Anchorage Digital Bank N.A. as an additional custodian via a Form 8-K, creating a dual-custodian structure for resilience (Bloomberg).

What is a qualified custodian?

Under SEC Rule 206(4)-2, a qualified custodian is a bank, savings association, registered broker-dealer, futures commission merchant, or certain foreign institutions that holds client assets for a registered investment adviser. Since September 2025, SEC staff relief lets advisers treat state-chartered trust companies — the charter most crypto custodians hold — as banks for crypto custody purposes (Morgan Lewis).

Is custodied Bitcoin insured?

Partially. Custodians carry commercial crime or specie policies — Coinbase discloses a $320 million crime policy, and industry comparisons put Copper around $500 million and BitGo around $250 million — but these limits are a tiny fraction of assets under custody, and there is no FDIC/SIPC equivalent (Coinbase; Spark). The primary protection is legal segregation of client assets, not insurance.

Which banks offer Bitcoin custody in 2026?

BNY Mellon already custodies Bitcoin and Ether; State Street and Citi have both said they will launch institutional crypto custody in 2026, and Deutsche Bank plans a 2026 launch in Europe. JPMorgan allows clients to buy Bitcoin but has ruled out custodying it (Ledger Insights; Bloomberg).

Why does it matter that most ETFs use Coinbase?

Because roughly 84% of US spot-ETF Bitcoin sits with one custodian (per Bitwise research), a critical failure in that custodian's infrastructure or controls would touch most of the ETF complex simultaneously (Crypto Briefing). Assets are segregated per client, so this is shared operational risk rather than a single vault — but it is the main reason issuers are adding second custodians.

Sources