Who actually controls your tokens? That question sounds simple until a platform freezes withdrawals or files for bankruptcy. Then it becomes the only question that matters.
This is one piece of the broader risk scoring framework institutional allocators use before committing capital to a crypto or private market platform. Custody structure isn't a side detail. Custody structure, contractual terms, and asset segregation practices strongly influence whether customers retain property rights or become creditors if a platform fails.
Cryptographic control answers who can authorize a blockchain transaction. Legal ownership answers who has enforceable rights to the asset. These do not always belong to the same party.
This article compares custodial and non-custodial architecture across three axes: key control (who holds the private keys), counterparty risk (what the platform can legally do with your assets while it holds them), and legal recourse (what happens to your assets specifically in an insolvency).
We'll walk through a real bankruptcy ruling to show what legal recourse actually looks like in practice, not just in theory.
What Custodial Architecture Actually Means
In a custodial structure, a third party controls the relevant private keys. The customer's legal rights may range from beneficial ownership of segregated assets to a contractual claim against the platform, depending on the custody agreement and applicable law.
The user experience may resemble a bank account, but the legal structure can be very different. Bank deposits, brokerage custody, and crypto platform balances create distinct ownership, deposit insurance, and creditor rights.
For registered investment advisers in the United States, custody of client funds is regulated under the SEC's Custody Rule, Rule 206(4)-2 of the Investment Advisers Act. SEC Rule 206(4)2 generally requires registered investment advisers with custody of client funds or securities to maintain them with a qualified custodian (a regulated institution, such as a bank or trust company, legally authorized to hold customer assets), subject to specified exceptions and safeguards.
In its rulemaking release explaining the Custody Rule, the SEC outlines the regulatory baseline: clients generally must receive periodic account statements directly from the qualified custodian (or the adviser must satisfy alternative safeguards prescribed by the rule), and the rule may require an annual surprise examination by an independent public accountant, although exceptions apply in certain structures.
Regulatory expectations surrounding digital assets continue to evolve. SEC staff issued no action guidance clarifying conditions under which certain state trust companies and regulated entities may serve in digital asset custody arrangements. Evaluators must assess the regulatory status date, determine whether the relevant asset is structured as a fund or security, confirm which entity qualifies as custodian, and account for potential differences between state and federal requirements.
What Non-Custodial Architecture Actually Means
In a non-custodial arrangement, the user or designated signers control the credentials required to authorize transactions, although smart contract permissions and token-level controls may still affect the assets.
Self-custody architecture relies on several interconnected standards: BIP 39 defines mnemonic phrase generation, BIP 32 establishes hierarchical deterministic (HD) wallet structures, and BIP 44 specifies derivation paths. Exclusive control of the recovery material is a major element of self-custody, but secure control also depends on devices, signing policies, token approvals, and recovery design.
Institutions commonly avoid relying on one unprotected signing key and instead use multisignature (multisig), Multi Party Computation (MPC), hardware security modules (HSMs), or policy controlled custody systems.
Safe is a widely used smart contract wallet for EVM networks, particularly among DAOs and treasury operators. In a smart contract multisig, transactions require signatures from a preset threshold of designated keys (e.g., 2 of 3 or 3 of 5). However, multisig setups introduce their own operational risks: key collusion, signer unavailability, upgradeable wallet smart contracts, or scenario design flaws (such as one individual holding multiple signing keys).
Key Control Evaluation
When evaluating key control, ask the following core questions:
- Who holds or controls the transaction signing credentials?
- Who holds legal title to the assets underlying the account balance?
- Can the service provider freeze, delay, or redirect transactions?
- Is an external relayer or proprietary server required to construct or execute transactions?
- Can the wallet be fully restored if the software provider ceases operations?
In hybrid custody structures, signing power is split—for instance, between an institution and a third-party co-signer. While this prevents unilateral key control, it introduces deadlock risks, dependency on custodian availability during emergencies, and complex legal liability allocations.
Counterparty Risk, What the Terms of Use Actually Say
Key control tells you who can move the assets day to day. Counterparty risk tells you what the platform is legally permitted to do with those assets while it holds them, and this is where the real difference between custodial structures shows up.
Some custodial platforms explicitly reserve the right to rehypothecate (the practice of pledging or lending out customer assets to generate yield); they can lend out, pledge, or encumber customer assets. Beyond rehypothecation, insolvency outcomes depend on specific contractual terms:
- Title transfer vs. bailment clauses
- Express lending authorizations
- Security interests and collateral usage rights
- Omnibus pooling vs. individual segregated accounts
- Subcustody terms and set-off rights
- Suspension of withdrawal provisions
Legal Recourse And What Actually Happens in an Insolvency
This is the part most due diligence checklists skip, and it's the part that determines whether custodial risk is an abstract concept or a concrete loss.
The clearest real-world example is the Celsius Network bankruptcy. On January 4, 2023, the U.S. Bankruptcy Court for the Southern District of New York ruled on customer crypto deposited in Celsius Network's Earn accounts. The court relied principally on the account specific Terms of Use, interpreted within applicable contract and bankruptcy law. As Goodwin Law's summary of the ruling explains, the Terms of Use explicitly transferred all right and title to Celsius, making the deposited crypto property of the estate (assets legally owned by the bankrupt company to be distributed among all creditors).
Treating the assets as estate property meant their use and distribution were governed through the bankruptcy process and confirmed by the Chapter 11 plan. Earn customers became unsecured creditors whose recoveries were determined through the Chapter 11 reorganization plan rather than through direct return of the deposited assets.
Two details from this case are directly useful for evaluating any custodial platform today:
First, the ruling applied only to Celsius's Earn accounts specifically. As McDermott's coverage of the case notes, assets held under Celsius's separate Custody Program, Withhold Accounts, or Borrow Program were not covered by this ruling, since their ownership status depended on different contractual language and was left for later proceedings. This means the exact account type and its specific Terms of Use, not the platform's marketing language, determine your legal position in an insolvency.
Second, the court treated a clickwrap agreement (an online contract accepted by clicking 'I Agree' or checking a box during signup) as a legally binding transfer of title. Law firm O'Melveny's analysis points out that, unlike insured bank deposits or regulated brokerage custody, some crypto-platform accounts may lack a uniform statutory customer asset protection framework. Those terms can materially affect the customer's ownership and creditor status if the platform becomes insolvent.
Self-custody can remove the wallet custodian's insolvency risk, but it does not eliminate issuer, protocol, bridge, stablecoin, or smart contract counterparty risk. Where assets were never transferred to an insolvent platform and remain under the customer's exclusive control, they are less likely to become part of that platform's estate, though final legal classification still depends on surrounding facts and protocol design.
Custodial vs Non-Custodial, A Side-by-Side Comparison
Factor | Custodial | Self-Custodial |
Key Control | Custodian or subcustodian | User or designated signers |
Legal Ownership | Depends on agreement, segregation, and law | Usually remains with user, subject to token/protocol terms |
Platform Insolvency | May create property, trust, or unsecured creditor claims | Assets generally remain accessible if no platform control is required |
Access Recovery | Provider may offer recovery via identity verification | Depends on backup, guardians, multisig, or MPC design |
Main Risks | Insolvency, misuse, freezing, subcustody failure | Key loss, signer compromise, approval abuse, protocol bugs |
Governing Rights | Contract terms, advisory rules, applicable regulations | Token terms, protocol code, reduced wallet custodian dependence |
Neither structure is universally safer. A regulated custodian operating under Rule 206(4) 2's qualified custodian requirement, with account statements sent directly to the client, offers a layer of oversight an individual seed phrase never will. A well designed multisig can reduce unilateral custodian risk while introducing signer governance and operational risks.
Custody Due Diligence Checklist
Institutional allocators evaluating custody providers or self-custody frameworks should audit the following controls:
- Legal Entity & Status: Regulatory jurisdiction, qualified custodian status where applicable.
- Asset Segregation: Segregated accounts vs. omnibus wallets, on-chain tracing, and beneficial ownership records.
- Rehypothecation & Title: Contractual clauses regarding asset lending, pledging, or encumbrance.
- Proof of Reserves Limitations: Confirming whether proof-of-reserves audits account for off-chain liabilities, borrowing, or exclusive key ownership.
- Smart Contract & Software Risk: Upgradeability controls, module governance, and third-party audit history for smart contract wallets.
- Subcustody & Insurance: Coverage limits, exclusions, and bankruptcy remote subcustodian arrangements.
Jurisdictional Considerations
Legal asset classification varies significantly across jurisdictions. While U.S. bankruptcy courts have focused heavily on contract terms in recent cases, regulatory frameworks in the UK, European Union (under MiCA), UAE, and Singapore enforce distinct statutory segregation and customer protection requirements.
Bottom Line
The question of who controls my tokens has a specific, checkable answer for any platform: read the account-specific Terms of Use, identify whether rehypothecation is permitted, and confirm whether the custodian is a qualified custodian under applicable regulation. If the platform is non-custodial, confirm exactly who holds each key in a multisig setup and what the signing threshold is.
The Celsius ruling exists precisely because customers didn't ask these questions before depositing funds. The contract language was there the entire time. It simply wasn't read as a risk factor until it was too late to matter.
Disclaimer: This article is for educational purposes only and is not financial, legal, investment, or tax advice. Custodial and non-custodial crypto structures carry different risks, including loss, limited liquidity, key management failure, and counterparty insolvency. Review all account-specific terms and seek professional advice before investing.
