Join our Newsletter — 33% off our NHI Course

Crypto Custody

Crypto custody is the secure holding and control of digital assets or the keys that unlock them. In identity and security terms, it depends on protecting secrets, enforcing access controls, and proving who can authorize transfers, often through multi-signature approval, hardware protections, and strong governance over human and non-human identities.

What Crypto Custody Really Means

Crypto custody is not just storage, it is controlled possession of the private keys, signing authority, and transfer rights that determine who can move digital assets. The security problem is therefore less about the coins themselves and more about safeguarding the authority that unlocks them.

That distinction matters because custody failures usually start with key exposure, weak authorization, or unclear ownership. In practice, the custody model has to answer who may sign, under what conditions, and how much trust is placed in any single person, system, or device.

Why Custody Depends on Keys, Secrets, and Control Boundaries

Crypto custody is fundamentally a secrets problem. The private keys, recovery phrases, and related signing material must be protected against theft, loss, accidental disclosure, and unauthorized duplication. Once an attacker gains that material, asset transfer can become immediate and irreversible.

Custody also depends on where control boundaries are drawn. A well-designed setup separates storage from approval, approval from execution, and day-to-day access from emergency recovery. That is why hardware-backed key storage, offline or segregated signing paths, and strong approval workflows are so central to custody design.

In stronger custody models, one compromise is not enough to move funds. Multisignature controls, policy-based approvals, and segregated roles reduce the chance that a single compromised credential, operator, or endpoint can authorise a transfer alone.

How Organisations Evaluate Custody Exposure

To assess custody risk, organisations first need an accurate inventory of what is held, where keys live, and which systems or people can sign. That includes wallets, vaults, hardware devices, backups, recovery procedures, and any third-party service involved in execution or recovery.

They then check whether the assets are exposed to internet-facing infrastructure, browser-based workflows, weak admin separation, or overly broad operational access. A custody setup can look secure on paper while still being weak if the signing path is reachable through compromised endpoints, shared accounts, or poorly governed privileged access.

Vendor assurances and custody architecture documents matter as well, especially when a custodian, wallet provider, or infrastructure provider participates in key management. The question is not only whether a platform is reputable, but whether its operational model matches the organisation’s tolerance for loss, insider abuse, and recovery failure. For a practical view of wallet and custody controls, see Crypto Wallet Security Guide and ISO/IEC 27001:2022 Information Security Management.

Custody Controls, Recovery, and Governance

Custody control design should balance security with recoverability. Overly rigid controls can strand assets if signers, devices, or backups fail, while overly flexible controls can make compromise too easy. Good custody design therefore pairs strong approval rules with tested recovery processes, documented ownership, and clear authority limits.

Governance is especially important when humans and automation both participate in transfers. Teams need to know which identities are allowed to initiate, approve, or execute custody actions, and how those permissions are reviewed over time. That often means limiting standing access, using separate approval paths, and keeping recovery authority distinct from routine operational authority. NIST guidance on key lifecycle management is especially relevant here, including NIST SP 800-57 Key Management and the broader control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls.

In practice, custody is strongest when the organisation can prove who may authorise transfers, demonstrate that secrets are protected, and recover safely after device loss, staff turnover, or compromise.

Risk and Threat Considerations

Crypto custody is attractive to attackers because a single successful compromise can convert directly into transfer authority. The main risks are key theft, phishing against signers, insider abuse, backup exposure, and operational mistakes that weaken the separation between approval and execution.

Failure mechanism: An attacker steals or coerces the signing secret, abuses a privileged workflow, or finds a weak recovery path that bypasses intended approval controls, then initiates irreversible asset movement.

Impact: Funds can be drained quickly, recovery may be impossible, and the organisation may also lose trust, face legal exposure, or suffer cascading operational disruption if custody controls were shared across multiple assets or entities.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 addresses the attack surface, NIST SP 800-57, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.

Framework Control / Reference Relevance
NIST SP 800-57 Key Management Crypto custody centers on protecting and managing private keys across their lifecycle.
Recommendation — Apply lifecycle controls to protect, rotate, back up, and retire the keys that authorize transfers.
NIST SP 800-53 Rev 5 IA-5 — Authenticator Management Custody depends on safeguarding the secrets that enable signing authority and transfer approval.
AC-6 — Least Privilege Custody controls require tightly limited signing and approval authority.
Recommendation — Manage custody secrets so they are protected, rotated, and revoked under defined authority. Limit custody permissions so no account or operator holds more authority than needed.
ISO/IEC 27001:2022 A.5.15 — Access control Custody requires controlled access to signing material, recovery paths, and approval workflows.
A.8.24 — Use of cryptography Custody is directly about protecting cryptographic material that controls asset transfer.
Recommendation — Define and enforce access rules for custody systems, keys, and approval roles. Protect custody cryptographic material with approved storage, handling, and operational controls.
CIS Controls v8 CIS-6 — Access Control Management Custody risk is driven by who can access and approve transfers, keys, and recovery paths.
Recommendation — Review and restrict access to custody systems, signer roles, and recovery functions.
OWASP Non-Human Identity Top 10 NHI-02 — Secret Leakage Custody fails when private keys or recovery material leak from storage or workflows.
NHI-05 — Overprivileged NHI Non-human signing and automation in custody can become overly powerful if permissions are excessive.
Recommendation — Prevent leakage of custody secrets through storage, backup, endpoint, and process controls. Constrain automated custody actors to the minimum signing and transfer authority they need.

Practitioner Guidance

Why practitioners should care: Custody is only as strong as the control over signing authority, not the branding of the wallet or custodian. Treat the key lifecycle, approval path, and recovery process as the core security problem, and verify that each one is independently hardened.

Common misunderstanding: Many teams assume multisignature alone solves custody risk. Multisig reduces single-point failure, but it does not protect against weak signer hygiene, poor endpoint security, or poorly governed recovery access.

Practitioner takeaway: The best custody model is one that can withstand both theft and human error without losing the ability to prove, review, and safely control every transfer.