Custodian (custodial)

With a custodial solution, a company holds the private keysGlossaryPrivate keyA secret, randomly generated number that you use to sign transactions and so control your bitcoin. Anyone who knows the private key can spend the bitcoin that belongs to it – it must never fall into anyone else’s hands.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →× – usually the exchange or app where you buy. Your balance in the app is an entry in the provider’s books. You only control your bitcoin yourself once you withdraw it to your own wallet.

Advantages: easy to get started, no seed words to back up, support can help if you forget your password, buying and savings plan in one place.

Risks

The provider can be hacked, go bust, stop withdrawals or freeze your account. After Mt. GoxGlossaryMt. GoxA Japanese Bitcoin exchange that collapsed in February 2014. Around 850,000 BTC were missing; just under 200,000 turned up again. Since July 2024, the trustee has also been repaying creditors in bitcoin; the current deadline is 31 October 2026.On the learning path: Stage 5 · Step 1 – Understanding custody →In the glossary →× went bankrupt in 2014, creditors only started getting bitcoin back in July 2024; at FTXGlossaryFTXA large crypto exchange that collapsed in November 2022. Around $8 billion in customer funds was missing, and founder Sam Bankman-Fried was sentenced to 25 years in prison. Customers got dollars back instead of their bitcoin.On the learning path: Stage 5 · Step 1 – Understanding custody →In the glossary →× (bankrupt in 2022), repayments began in February 2025.^[1],[2] There is no statutory deposit protection for bitcoin like the one for bank deposits.^[3]

What regulation changes

In the EU, providers that hold crypto-assets for customers need an authorisation under MiCAGlossaryMiCA (Markets in Crypto-Assets Regulation)The EU regulation on markets in crypto-assets. Since 30 December 2024, exchanges, brokers and custodians in the EU have needed authorisation; the last transitional period ended on 1 July 2026. MiCA regulates providers, not Bitcoin itself.On the learning path: Stage 4 · Step 2 – Choosing a provider →In the glossary →× and must keep their customers’ holdings separate from their own. In Germany, crypto-assets held in custody also count as belonging to the customer – unless the customer has agreed that the provider may use them on its own account or for third parties (§ 45 KMAGGlossaryKMAG (German Crypto Markets Supervision Act)Germany’s act accompanying the EU’s MiCA regulation. It makes BaFin the competent supervisor, makes providing crypto services without authorisation a criminal offence and protects crypto-assets held in custody if the provider becomes insolvent.On the learning path: Stage 5 · Step 1 – Understanding custody →In the glossary →×, the German Crypto Markets Supervision Act).^[4],[5] This strengthens your position if the provider goes bust, but doesn’t protect you from hacks, fraud or lengthy proceedings.

The alternative is self-custodyGlossarySelf-custodyYou hold the private keys to your bitcoin yourself – in your own wallet rather than with a provider. Nobody can freeze your bitcoin. But nobody can help you if you lose your seed phrase and keys.On the learning path: Stage 5 · Step 1 – Understanding custody →In the glossary →× – with full control and full responsibility. Understanding custody compares both approaches.