What institutional custody actually means for digital assets

Ask ten digital asset managers who holds their assets and you will get ten confident answers that mean ten different things. Custody in this market spans everything from a hardware wallet in a drawer to a regulated trust company with a balance sheet behind it. The word alone carries almost no information.

What an allocator is actually trying to establish is narrower and more answerable: who can move the assets, what has to happen before they move, and what remains if the manager disappears.

Key material

A blockchain position is controlled by a private key. The central question in any custody arrangement is where that key exists and in how many pieces.

Multi-party computation splits the key into shares that are never assembled into a complete key at any point, not during storage, and not during signing. Signing is performed collaboratively by the share-holders without any one of them ever holding the whole. This is a meaningfully different security property from a key that is stored encrypted and decrypted to sign, because there is no moment at which a complete key exists to be captured.

Where the shares live matters as much as how they are split. Hardware-isolated secure enclaves mean the share material is not exposed to the general-purpose operating system, and so is not reachable by an attacker who has compromised the host.

Transaction authority

Key security answers who can sign. It does not answer what gets signed. That is a governance question, and it is where most operational failures actually occur.

A policy engine sits between a request to move assets and the signing operation. A well-configured one enforces several things at once: destination whitelisting, so assets can only move to pre-approved addresses; approval quorums, so no single person can authorize a transfer; and separation of duties, so the people who execute trades are structurally unable to authorize withdrawals.

That last point deserves emphasis. A large share of catastrophic losses in this market were not cryptographic failures. They were cases where trading authority and withdrawal authority sat with the same people.

Segregation

Assets belonging to different vehicles should sit in different vault accounts, not in a pooled account with an internal ledger apportioning claims. Segregation at the account level means each fund's position is independently verifiable on-chain, which is what makes an administrator's NAV and an auditor's confirmation possible.

What attestations tell you, and what they do not

SOC 2 Type II, SOC 1 and ISO 27001 are frequently cited and frequently over-read. They are evidence that controls were defined and that an independent party tested them over a period. They are not a statement that any particular configuration is correct, and they say nothing about how a specific client has set up their policy engine.

The attestation is a floor, not a conclusion. The configuration on top of it is where the actual risk sits, and that is a question for the manager, not the custodian.