Who Custodies Bitcoin ETFs?
Brian Cubellis | Chief Strategy Officer
Most United States spot bitcoin ETFs do not hold their own bitcoin. They hold it through a small number of third-party custodians, and the market is heavily concentrated: by recent estimates, a single custodian underpins more than 80 per cent of US spot bitcoin ETF assets. When you buy a spot bitcoin ETF, you own shares in a trust that holds a claim on that custodian, which holds the bitcoin. You do not hold the keys, and in most cases you cannot see the custody arrangement beneath your position. That concentration has become significant enough that market participants now refer to it as "the systemic custodian question," and it is a central theme of Onramp's research report, The Architecture of Failure, which examines what the Prime Trust bankruptcy reveals about how bitcoin is held for other people.
This guide explains who actually custodies bitcoin ETFs, where the concentration sits, why the structure matters for whether a bitcoin ETF is safe, what an ETF holder should ask, and what a more resilient custody design would look like.
Who custodies bitcoin ETFs, in plain terms
A spot bitcoin ETF is a fund that holds real bitcoin and issues shares that trade on a stock exchange. The fund is structured as a trust. The trust does not put private keys on a hardware device in the issuer's office. Instead, it appoints a custodian, a regulated firm whose job is to hold the underlying bitcoin. The share you buy is a claim on that trust, and the trust's claim runs to the custodian.
That is the first thing to understand about ETF custody: there are layers. The holder is at the top, then the fund and its trust, then the custodian, and beneath some custodians there are sub-custodians as well. Each layer is a separate legal relationship, and the holder generally sees only the top one.
The appeal of the ETF is exactly this arrangement. It offers exposure to bitcoin's price through a familiar brokerage account, with no wallets to manage and no keys to lose. As The Architecture of Failure puts it, the very feature that made ETFs attractive, exposure to bitcoin without holding keys, is the feature that places the holder at the top of a custody stack whose lower layers they neither control nor see.
Where the concentration sits: the systemic custodian question
The most important fact about ETF custody is not that custodians exist. It is how few of them carry the weight of the market. By recent estimates, a single custodian underpins more than 80 per cent of United States spot bitcoin ETF assets. That is the concentration market participants have begun to call the systemic custodian question, and it is the reason ETF custody is worth examining rather than assuming.
The exceptions are worth stating precisely, because precision matters here. The largest fund names that dominant custodian as its primary custodian, while disclosing a second custodian as available. One large issuer self-custodies through its own affiliated digital asset business rather than outsourcing to a third party. Others spread custody across a mix of providers, two or three names in total. But the weight of the market still rests on a single provider, and that is the heart of the concern.
For readers who want the specifics from public ETF-market reporting rather than the report itself: the dominant custodian behind most US spot bitcoin ETFs is widely reported to be Coinbase Custody, holding roughly 80 per cent or more of assets by recent estimates. Fidelity is the large issuer that self-custodies, through its own affiliated digital asset business, and other issuers spread custody across names such as Gemini, BitGo, Anchorage, and BNY. Treat all of this as third-party market context on the ETF industry. None of these firms is part of Onramp's own custody model, described separately below.
The point of the concentration is not that any one custodian is badly run. It is structural. When most of a market's assets sit behind a single provider, a problem at that provider is no longer that provider's problem alone. It becomes a market-wide event.
Is a bitcoin ETF safe? What the structure actually exposes you to
"Safe" is the wrong single word for a layered structure. A spot bitcoin ETF is a regulated, transparent, convenient way to hold price exposure to bitcoin, and for many holders it does exactly what they want. But it is not the same thing as holding bitcoin yourself, and the difference is entirely about what sits beneath your shares.
Here is the exposure, stated plainly. An ETF holder owns shares in a trust that holds a claim on a custodian. If that custodian were subject to a Prime-style recharacterisation event, the kind of event The Architecture of Failure documents at Prime Trust, where a court treated commingled client assets as property of the bankruptcy estate, the fund's holders would sit in a position structurally similar to the failed custodian's direct customers, with additional layers between them and the news. They would learn of a problem the way the rest of the market does, through the financial press and a falling share price, not through any direct line to the asset.
This is the lesson of the Prime Trust case applied to the ETF layer. Prime Trust did not fail because it was uniquely unlucky. It failed because of a custody architecture that let a single entity hold the private keys, take title to client assets in its own name, and commingle those assets until they could no longer be traced. Contractual language describing ownership is not the same as ownership, and a regulated charter is not the same as physical segregation. A qualified custodian label addresses regulatory status, not whether your assets are held apart from the custodian's own.
Two of the ideas at the centre of the Prime Trust collapse map directly onto ETF custody. The first is commingling, mixing client assets together or with the custodian's own assets so that individual ownership can no longer be traced. The second is the omnibus account, a single pooled account holding many clients' assets together rather than a segregated, per-client vault. An ETF holder generally cannot see whether the fund's bitcoin sits in a segregated arrangement or an omnibus pool, and public disclosures often describe custody only in general terms. That gap between what is disclosed and what would actually determine your recovery in a failure is the structural risk, not a prediction that any specific custodian will fail.
What an ETF holder should be asking
Most readers will not be able to answer the following questions about the fund they hold. As The Architecture of Failure observes, that inability is precisely the problem. These are the questions the report sets out for anyone holding a spot bitcoin ETF:
- Who is the fund's custodian, and are there sub-custodians beneath it? The named custodian may not be the only party in the chain.
- How concentrated is that custodian across the wider ETF market? If your fund's custodian is the same provider behind most of the market, a problem there is a market-wide event, not an isolated one.
- What is the fund's recourse if the custodian fails, what happens to the share price, and how quickly? A recovery mechanism that takes years, as bitcoin custodian failures have historically taken, is very different from one that resolves in days.
- Is the bitcoin held under a qualified arrangement, a segregated arrangement, or both, and do you know the difference? A qualified custodian meets a regulatory definition. Segregation is about whether your assets are physically held apart. They are not the same guarantee, and the distinction is exactly what the Prime Trust ruling turned on.
If you cannot answer most of these questions for the fund you hold, that does not mean the fund is about to fail. It means you are relying on the same category of arrangement that produced the Prime Trust collapse, without visibility into the parts that would determine your outcome. That is not a reason to panic. It is a reason to start asking questions.
The alternative is architectural, not contractual
If the problem is architectural, the answer must be architectural too. No amount of contractual drafting, regulatory licensing, or insurance can fully repair a structure in which a single party can move, lose, or take title to client assets. The fix is to remove that single point of failure, and the same solution available to any entity holding bitcoin for others is available to an ETF issuer.
That solution is multi-institution custody. Instead of one custodian holding the keys, signing authority is distributed across independent regulated institutions in a two-of-three multi-signature arrangement. Moving the asset requires the cooperation of at least two of the three. The consequences follow directly: no single custodian can move the asset, because one key cannot sign a transaction; no single custodian can lose the asset, because losing one key still leaves a working two-of-three; and no single custodian can take title to or commingle the asset, because none of them ever holds it alone and each client's holdings sit in a segregated vault rather than an omnibus pool.
This is the part most discussions miss, and it is the heart of the legal argument. When a single custodian fails, the receiver inherits that custodian's powers, and because those powers included the ability to move and take title to client assets, the assets are drawn into the estate. In a multi-institution structure that pipeline breaks. If one custodian enters receivership, its receiver inherits one key. The other two custodians do not work for the failed entity, do not take instructions from its receiver, and act on behalf of the title owner, which is the client. The failed custodian's estate cannot reach the asset, because the failed custodian never had the unilateral ability to dispose of it.
As The Architecture of Failure argues, an ETF issuer that held bitcoin in this kind of structure, with no single custodian able to move or title the asset, would materially reduce the structural risk borne by its holders, and could disclose that arrangement as a genuine point of difference. The concentration the market now worries about is not inevitable. It is a design choice, and a different choice is available.
How Onramp's custody model works
Onramp is not an ETF issuer, and the custodians named above in the ETF-market context are not part of Onramp's stack. It is included here as one concrete implementation of the multi-institution architecture the report describes.
Onramp's Multi-Institution Custody (MIC) uses a 2-of-3 multisig arrangement in which the three keys are held by Onramp, BitGo Trust, and CoinCover. No single institution can move the bitcoin alone, and each client's holdings sit in a segregated vault the client can verify independently by running a watch-only wallet. For some account types, Tetra Trust is available as an additional key-holder option, though not for the IRA. For clients who prefer a simpler arrangement, Onramp Finance offers single-custodian custody with BitGo Trust and a clear upgrade path to the multi-institution structure. In each case, the design goal is the one the report identifies: remove the single point of failure so that no one party can move, lose, or take title to client bitcoin.
Whether you hold bitcoin through an ETF, a treasury company, or directly, the question is the same: how many parties stand between you and the asset, and what can each of them do, or fail to do, with it. Bitcoin makes a durable answer possible at the level of the protocol. Whether it is true of your holdings depends on the architecture above the protocol.
If you are evaluating how your bitcoin is held, or want an alternative to single-custodian exposure, schedule a consultation with Onramp to discuss multi-institution custody and how it removes the single point of failure at the heart of the Prime Trust case. To open an account, sign up here.
Related Reading