Who Signs: Key Management at Custodians, Compared
The exposure is that one person can move everything. Four arrangements, and what each one survives.
Every custodian answers one question: how many people, acting together, can move client assets. The answer determines what the arrangement survives.
Single key
One key, held by one party, in one place. Whoever has it can move everything.
Survives nothing. An insider, a compromised machine or a lost backup all end it. No serious custodian operates this way and some smaller venues still do.
Multi-signature
Several keys, a threshold required. Three of five is common: any three of the five holders can sign, and any two cannot.
Survives the loss of two keys and the compromise of two holders. The protection is real and depends entirely on the keys being held independently.
Three keys in one office is a single key with extra steps.
Threshold signatures
Mathematically similar protection with a different construction: the key is never assembled in one place and signing is distributed.
Survives the same attacks, with a smaller on-chain footprint. More complex to implement, and the implementation is where the risk sits.
Hardware security modules with policy
Keys inside tamper-resistant hardware that enforces rules: amount limits, destination allowlists, time delays, dual authorisation.
Survives insider action better than the others, because the policy is enforced by the device rather than by procedure.
The question that matters more than the technology
Where are the holders, and are they genuinely independent. Geographic distribution, separate legal entities, and different people with different access.
A sophisticated scheme operated by one team in one building has one point of failure wearing a complicated hat.
What a customer can actually learn
Whether a custodian is used and who it is. Whether the venue describes its signing arrangement at all. And whether an auditor has examined the controls.
Platforms that name their custodian give you a second entity to assess, which is more than most offer.
What would have to be true
Independent holders, enforced policy, documented procedures, and external examination. Exchanges that document their cold storage split are at least willing to describe the shape of the arrangement.
Where nothing is described, assume the simplest possible setup, because a venue proud of its controls tends to mention them. A platform under a named regulator is also one whose controls have been looked at by somebody other than its own staff.