Not Your Keys, Not Your Coins: What Custody Risk Really Means

When you buy Bitcoin on a big exchange, it feels like the coins are yours. You see a balance, you can sell any time, and the app shows a green number when prices rise. But that balance is a promise from a company, not a coin in your pocket. If the company runs out of money and files for bankruptcy, what you actually hold is a claim against a failed business. The 2022 collapse of FTX taught a lot of people this the hard way. This guide explains, in plain terms, what "custodial" really means, what happens to your money when an exchange goes under, why "proof of reserves" is weaker than it sounds, and how to decide what to keep yourself and what to leave on a platform. This is educational content, not financial or legal advice.

An exchange account is custodial. That word means a third party holds the asset for you. You do not hold the cryptocurrency itself. The exchange holds the private keys (the secret codes that move coins on the blockchain), and your balance is an entry in their internal database that says they owe you that amount.

Compare it to two ways of holding cash. Money in your physical wallet is yours, full stop. Money in a bank account is a debt the bank owes you; the bank controls the cash and lends most of it out. An exchange balance is much closer to the second case, but with fewer protections. The well-known crypto slogan for this is simple: whoever holds the keys controls the coins, and on a custodial exchange that is the company, not you.

This is different from a self-custody wallet, where you hold the keys yourself. We cover that split later. On an exchange, you trust the company to keep its promise. If you want to understand the keys themselves, see our explainer on crypto wallets.

FTX was one of the largest crypto exchanges in the world. In November 2022 it stopped letting customers withdraw funds and filed for bankruptcy within days. Billions of dollars of customer money was gone, much of it funneled into a sister trading firm. Its founder was later convicted of fraud.

Here is the part that surprises people. The bankruptcy is recovering money, and most customers are getting paid, but slowly and on harsh terms. By mid 2026 the estate had paid out roughly 10 billion dollars across five rounds, the most recent beginning on 31 July 2026, according to reporting on the estate's filings. Many customers are receiving 100 percent or more of their account value, which sounds great until you read the fine print.

The catch: payouts are calculated using the dollar price of each coin on the bankruptcy filing date in November 2022, not today's price. If you held one Bitcoin valued at 16,871 dollars in the estate's petition-date pricing then, you get roughly that dollar amount back (plus interest in some cases), not a Bitcoin that may be worth far more now. You missed every gain in between, and people waited years with their money frozen while administrators worked through claims.

When a company files Chapter 11 bankruptcy in the United States, its assets are pooled and shared out in a strict order. Secured lenders and certain priority claims come first. Then come unsecured creditors, the group with no specific collateral backing their claim. In most exchange failures, customers land in this unsecured group, alongside suppliers and vendors, and only get whatever is left after the higher ranks are paid.

It can be worse than that. The crypto you deposited may not even be treated as yours. In the Celsius bankruptcy, the court looked at the company's Terms of Use and ruled in January 2023 that customers who used the "Earn" interest program had transferred ownership of their coins to Celsius. As the law firm Morrison Foerster summarized, the judge found the contract language unambiguous, and Celsius could lend, sell, or otherwise dispose of the deposited assets. About 4.2 billion dollars of customer crypto was treated as estate property on that basis, and almost every affected account holder had agreed to the relevant terms, almost certainly without reading them.

So the order of pain is twofold: first the contract decides whether the coins are even yours, then bankruptcy law decides where you stand in line.

Bank deposits in the United States are insured by the Federal Deposit Insurance Corporation up to 250,000 dollars per depositor, per bank, and brokerage accounts are covered by the Securities Investor Protection Corporation if the broker fails. Many people assume something similar protects crypto. It does not.

Cryptocurrency held on an exchange is not covered by the FDIC. The FDIC insures bank deposits, not digital assets, and Bitcoin or Ether sitting on a platform has never qualified. SIPC is also out. Its official guidance states that unregistered digital asset securities do not count as "securities" under the law it enforces, so they get no protection even at a member firm. SIPC protects stocks, bonds, mutual funds, and cash at a failed brokerage, with a 500,000 dollar limit (250,000 for cash). Crypto is simply not on the list.

One narrow exception is worth knowing. Some exchanges park your uninvested US dollar cash (not your crypto) in partner banks, and that cash may be FDIC insured if one of those banks fails. That protection covers a bank failure, not the exchange failing, and it never touches your coins.

Exchanges often advertise that they carry "crime insurance" or hold funds in "cold storage." These are real, useful security measures, but they are not the same as government deposit insurance, and they rarely protect you in the situations people fear most.

Crime insurance policies typically cover the company against large-scale theft, such as a hack of the platform's own systems. They generally do not pay out when an individual account is compromised through a phishing scam, a reused password, or a stolen phone, and they do not cover a fall in the value of your coins. Critically, none of these policies make you whole if the company itself becomes insolvent. Before trusting a platform, read its insurance disclosure and its user agreement, and notice what is excluded.

The contrast with a well-written user agreement is striking. Coinbase's United States user agreement, for example, states that title to your supported digital assets "shall at all times remain with you and shall not transfer to Coinbase," and that those assets "are not property of Coinbase, and are not subject to claims of Coinbase's creditors." That is far stronger language than Celsius used. It is not a guarantee, and bankruptcy courts have the final say, but the wording of the contract you accept matters.

After FTX, many exchanges began publishing a "proof of reserves." The common version uses a cryptographic structure called a Merkle tree that lets each user check that their balance was counted in a published total, while a snapshot shows the coins the exchange controls on the blockchain. It sounds reassuring. It is also incomplete.

The core problem: proof of reserves shows assets, not liabilities. It can show that an exchange controls a billion dollars of Bitcoin, but not whether the exchange owes two billion to customers and lenders. A solvent company needs assets greater than its debts, and a reserves snapshot alone never proves that. In late 2022, the accounting firm Mazars produced a Merkle-tree report for Binance, then stopped such work and removed the report after critics pointed out it did not verify liabilities or give a real audit opinion. Kraken's chief executive argued that a proper proof of reserves must include the full sum of customer liabilities and let users verify the result themselves.

A separate accounting change makes the liability picture murkier. In January 2025 the SEC rescinded a guidance note called SAB 121 and replaced it with SAB 122, a shift analyzed by the law firm Ropes & Gray. The old rule pushed custodians to record the full value of customer crypto as a balance-sheet liability. The new one lets them record only the amount they judge to be at risk. That is a reasonable accounting debate, but for an outsider it means a company's books may show a smaller customer obligation than the raw deposit total. Treat a reserves dashboard as one data point, not a clean bill of health.

There is no single right answer, and the choice involves real trade-offs. Self-custody takes the company's bankruptcy out of the picture, because the coins sit in a wallet only you control. But it shifts all the responsibility to you: if you lose your recovery phrase or send funds to a scammer, no help desk can reverse it. Custodial accounts give you convenience and password recovery, in exchange for trusting the company.

A practical way to think about it, used by many long-term holders:

1. Money you are actively trading or plan to spend or sell within a few weeks can reasonably sit on a reputable, regulated exchange.

2. Amounts you would be upset to lose, and intend to hold for the long term, belong in self-custody where no company failure can touch them.

3. Never keep on any single platform more than you can afford to have frozen for several years. That is the realistic timeline a bankruptcy can impose: FTX filed in November 2022, made no customer distribution until February 2025, and was still paying out in 2026.

4. Spread larger holdings across more than one custodian, rather than concentrating everything in one place.

If you decide to self-custody, our guide to cold storage and the basics of keeping crypto secure walk through the mechanics. Planning ahead also matters: think about what happens to your crypto if something happens to you.

You cannot audit an exchange yourself, but you can do basic homework before you deposit anything large.

1. Find the user agreement and search it for the words "title" and "ownership." Look for language saying the assets remain yours and are not subject to the company's creditors. Vague or missing language is a warning sign.

2. Check whether the company is registered or licensed where you live. Regulation is not a guarantee against failure, but unregulated offshore platforms have far weaker oversight. See our overview of how crypto is regulated.

3. Read the insurance page and note what it excludes. Confirm whether any FDIC reference applies only to cash, not crypto (it almost always does).

4. If the platform publishes proof of reserves, check whether it also addresses liabilities and uses a named auditor. Reserves alone are not enough.

5. Watch for promises of unusually high "interest" or "yield" on deposits. Celsius and several others paid eye-catching rates by taking risks with customer money, and those programs were often where ownership quietly transferred to the company.

6. Turn on every security feature: a strong unique password, two-factor authentication using an app rather than text messages, and a withdrawal allowlist if offered. These guard your account against theft, though they cannot protect you from the company's collapse.

A few patterns show up again and again when people lose money on exchanges. Avoiding them costs nothing.

Treating an exchange like a bank vault. It is not. A balance is a promise, and promises can break. Keeping your entire savings on one platform because the app feels safe is the single most common error.

Chasing yield without reading terms. The high-interest "Earn" style products are exactly the ones where you may sign away ownership of your coins. If you do not understand how a platform generates the return it promises, assume the return carries risk you cannot see.

Ignoring withdrawal pauses. When an exchange suddenly "pauses withdrawals for maintenance," that has repeatedly been the first public sign of insolvency, days before a bankruptcy filing.

Believing recovery firms that promise to get frozen funds back fast for a fee. In a bankruptcy, the legal process controls payouts, and no third party can jump the queue for you. Read our note on crypto recovery scams before paying anyone.

Forgetting that even a full recovery can be a loss. Getting your November 2022 dollar value back years later, while prices moved on without you, is not the same as having held the asset yourself.