The Third Way: Ownership, Counterparty Risk and the Structure of Bitcoin Custody

In brief

• Bitcoin custody is usually presented as a choice between holding keys personally and leaving the asset with a single institution. Both arrangements leave the owner exposed to a single point of failure.
• Years of exchange failures made self-custody the standard. In 2026 the risk surfaced on the holder’s side, through flawed entropy at Coldcard, tampered Ledger devices in the reseller channel and a rise in physical attacks, while exchange failures continued.
• The relevant measure is the number of independent failures required before an owner permanently loses funds. Adding keys does not change it when one person or one institution controls them.
• Multi-Institution Custody places one key with each of three independent, regulated institutions and requires two to sign. The owner keeps segregated, verifiable ownership on chain and manages no keys, and control passes to designated beneficiaries without changing the quorum.

Read the PDF edition, with all exhibits and full notes.

Custody is the asset

For most financial assets, custody is a matter of record-keeping. A share of stock or a bond exists as an entry on a register, client securities are held apart from the custodian’s own balance sheet, and if a custodian fails, the ownership records survive it and the client’s claim is settled through a legal process refined over generations. The custodian keeps the records, and the owner’s protection rests on the register and the law behind it.

Bitcoin has no registrar to appeal to. The ledger recognizes whoever can produce a valid signature, so for the owner, control of the keys amounts to control of the asset. If the keys are lost, the bitcoin is lost with them, and if a single other party holds them, the owner is left with a claim that is only as good as that party’s solvency and conduct. The choice of custody therefore determines what kind of ownership a bitcoin holder has. For most of the asset’s history the market has offered two arrangements, and each of them rests that ownership on a single point of failure.

Two arrangements

The first is self-custody. Bitcoin was designed so that individuals could hold it directly, and self-custody remains a sound arrangement for holders with the time and discipline it demands. Its cost is that the holder becomes the single point of failure. That is true of a single hardware wallet, of a multisig in which the holder controls every key, and of collaborative custody, in which the holder manages two of three keys. In each case one person is responsible for generating keys from sound randomness, trusting hardware they did not build, protecting backups in separate locations, withstanding coercion and, eventually, passing all of it to beneficiaries.

The second is to leave the bitcoin with an exchange or to buy an exchange-traded fund. That removes the operational burden and places the asset with a single institution whose internal controls the owner cannot see, so a hack, an insolvency or a lapse inside that institution becomes the owner’s loss. More than 80% of U.S. spot bitcoin ETF assets are held by a single custodian, Coinbase. The shareholder owns an interest in a trust, a claim that cannot be moved on chain or matched to specific coins on the ledger, and how a fund’s bitcoin would be treated in a custodian’s bankruptcy remains relatively untested. Within a day of the Coldcard exploit in July, CoinDesk was reporting that it might push investors toward ETFs.

An asset designed to remove the need for a trusted third party is increasingly held by placing a single third party at the center.

Each arrangement is reasonable for some holders, and both rest on the same premise, that custody is a decision about who bears the burden and that the only candidates are the owner or a single institution. That premise is inherited from physical money. Gold has to sit somewhere, and wherever it sits becomes the point of failure, which is why earlier monetary systems concentrated custody in vaults, depositories and banks. Bitcoin carries no such constraint. A single bitcoin address can require signatures from several independent keys, so control can be divided among separate parties and exercised by quorum, which makes a third arrangement possible.

How self-custody became the standard

The case for self-custody was built on a long record of custodial failure. Mt. Gox, once the largest bitcoin exchange in the world, filed for bankruptcy in 2014 saying it may have lost 850,000 BTC, 750,000 of them belonging to customers. QuadrigaCX followed in 2019. The exchange said its co-founder had died as the only person able to reach its cold wallets, and some 76,000 clients were owed about C$215 million. Staff of the Ontario Securities Commission later concluded that the shortfall came mostly from his fraud and that lost keys were not the main cause. In 2022 Celsius and Voyager froze withdrawals and filed for bankruptcy, BlockFi followed within months, and FTX failed with roughly $8 billion in customer funds missing.

In each case a single institution held unilateral control over client assets, so its entire risk profile passed to its clients, who learned its size only after the fact. The industry’s answer hardened into a doctrine, “not your keys, not your coins,” and holders acted on it. In the week FTX collapsed, Ledger recorded the highest sales in its history. The advice was sound, but it relocated the risk to the holder, and the incidents of 2026 show what that risk looks like.

The record of 2026

The 2026 record in four figures: about 1,790 BTC attributed to the Coldcard entropy flaw by Galaxy Research as of late August; $72 million to $102 million in estimated losses tied to tampered Ledger devices; $387.5 million taken from Bitget without a compromised private key; 52 confirmed wrench attacks in the first half of 2026.

The failures of 2026 have landed on both sides of the binary, and the newest of them on the side the industry spent a decade promoting. In July attackers began draining wallets whose seeds had been generated on Coldcard hardware wallets. A firmware build error introduced in 2021 had left the devices’ randomness weak enough to search, and it sat unnoticed for five years in a public code repository. By late August Galaxy Research had attributed about 1,790 BTC in thefts to the flaw. In October Ledger confirmed a hardware implant in a device sold by CryptoBilis, an authorized reseller in Southeast Asia, and said the implant reads the recovery phrase from the screen during setup. Independent estimates of the losses, spread across several blockchains, run from $72 million to $102 million. Researchers have since reported implanted devices bought from authorized sellers in Singapore and Germany, Ledger asked sellers in seven Asian markets to pause sales, and within days Trezor began cutting back its own reseller network.

The physical threat has grown alongside the technical one. CertiK verified 52 wrench attacks in the first half of the year, a third more than in the same period of 2025, and 33 of them took place in France. Some of that targeting now begins with data held by a third party. In September Revolut confirmed that fraudsters using a legitimate government email domain had obtained data on a limited number of customers, and its notices to those affected listed identity documents and transaction histories. The group claiming responsibility says it used blockchain analysis to select roughly 680 customers with large holdings.

Custodial failures continued as well. In September Bitget lost $387.5 million when attackers, whom the exchange initially linked to North Korea, exploited a flaw in a third-party security product to obtain internal credentials and issue fraudulent withdrawal commands. Bitget says its private keys were not compromised and its cold wallets were not affected.

Exhibit 1. The 2026 custody record. Wrench attacks, January to June: 52 confirmed. Coldcard, from July 30: about 1,790 BTC attributed. Revolut, confirmed in September: about 680 targeted customers, as claimed by the attackers. Bitget, September 24: $387.5 million. Ledger via CryptoBilis, confirmed October 10: $72 million to $102 million, estimated.

Bitcoin’s protocol and cryptography were never broken in any of these incidents. Each loss ran through a single component that had been trusted on its own, whether a device’s random number generator, a reseller’s supply chain, a holder at home or an exchange’s internal controls.

Counting independent failures

Exhibit 2. Independent failures required before a permanent loss of funds: one under self-custody, one under a single custodian, two under Multi-Institution Custody.

The usual reply to this record is that multisig already solves the single point of failure. It does so only when the keys can fail separately. Collaborative custody clients who had generated both of their keys on affected Coldcards were exposed through two weak keys, a majority of their quorum, because the same person and the same model of device stood behind both. At Bitget, however many layers its controls had, they operated inside one organization, and one compromised security product was enough to pass fraudulent withdrawals through all of them.

The relevant measure of a custody arrangement is therefore the number of independent failures that must occur at the same time before the owner permanently loses funds. Under self-custody the holder stands behind every key, so coercion, error, incapacity or death reaches all of them at once, and the number is one however many keys or devices are involved. Under a single custodian it is also one, however many controls sit inside the institution. An arrangement deserves to be called a third way only if it removes the owner and the single institution as points of failure together, keeps the members of its quorum independent of one another, and lifts the burden of key management from the owner.

Multi-Institution Custody

Exhibit 3. How Multi-Institution Custody is structured. Onramp and BitGo Trust (United States) sign; Coincover (United Kingdom) holds the recovery key. Each generates its key in its own ceremony on air-gapped hardware, splits it into shards held separately and secures it on its own infrastructure. A withdrawal moves from client instruction to Onramp verification to BitGo Trust verification to settlement on chain, typically in 24 to 48 hours.

Bitcoin supports this structure at the protocol level. A multisig address is defined by a set of public keys and a threshold, and the network accepts a transaction from it only when the required number of those keys has signed. Every node that validates the transaction enforces the rule, so no single keyholder can move funds on its own.

Multi-Institution Custody uses that property to meet the standard set out above. Three independent, regulated institutions each hold one key to the client’s vault, and two keys are needed to move funds. Onramp and BitGo Trust form the standard signing path, and Coincover holds the third key for recovery. Clients who want their keyholders spread across more jurisdictions can substitute Tetra Trust, a Canadian trust company, into the quorum. Each institution generates its key in its own key ceremony, on offline, air-gapped, purpose-built hardware with institutional-grade entropy generation, then splits it into shards that are held separately and secures it on its own infrastructure. No key touches a consumer device, and the client holds no key material while directing every transaction.

The vault is segregated and on chain. It sits on no institution’s balance sheet, is never commingled or lent out, and can be verified against the ledger by its owner at any time. The arrangement keeps the verifiable on-chain ownership that self-custody offers and, like a custodian, removes the operational burden, while changing where a loss can originate. A flaw in one institution’s randomness or hardware compromises one key, which cannot move funds alone. A fraudulent request inside one institution still requires a second, separately operated institution to sign. There is no key at home to surrender under duress, and withdrawals require a liveness check and video verification with two institutions, typically over 24 to 48 hours. The quorum is designed so that any one keyholder, Onramp included, can fail while the client keeps access to the vault.

The arrangement still requires trust. Clients rely on three institutions instead of one, each with its own infrastructure, charter and ownership. It is also an identified relationship in which more than one institution holds the client’s identity data, which offers less privacy than holding keys directly, and the friction on withdrawals is a real cost for anyone who needs to move quickly. A client can still be deceived or coerced into requesting a withdrawal, and against that the verification process and its waiting period are the defense. In exchange, any loss of funds without the client’s authorization would require two independent regulated institutions to fail or collude at the same time, and the client can verify the whole arrangement on chain.

Exhibit 4. Where each failure lands, across self-custody, a single custodian and Multi-Institution Custody, for flawed randomness, supply-chain tampering, forged internal approval, coercion, failure of one institution and death of the owner.

Custody measured in decades

Many people hold bitcoin as long-term savings, on the view that a supply no central bank can expand spares them the slow dilution borne by whoever sits furthest from newly created money, and savings held for that reason are usually meant to outlast their owner. Custody has to keep working after the owner is gone.

Both conventional arrangements are weakest at that moment. The self-custody setups that best resist theft are the hardest for a family to open, and each precaution added after this year’s incidents widens the gap. A custodial account passes through the institution’s own process and on its timeline, and the beneficiaries inherit the same single point of failure the owner lived with. In Multi-Institution Custody the owner designates beneficiaries in advance, and control passes to them with the quorum unchanged.

Everything else an owner may want to do with the asset rests on the same foundation. Borrowing against bitcoin without selling it, holding it in a retirement account or a trust, or pledging it toward a mortgage each depends on knowing where the bitcoin is and that no single party can lose it, which is why Onramp built custody first.

Where custody is heading

Policy and market structure have begun to make room between the two poles. On October 1 the SEC proposed a custody framework that would treat certain state trust companies as qualified custodians and allow advisers to hold client digital assets directly when no permitted custodian is available, provided at least two people jointly authorize each transaction. On October 5 FinCEN withdrew its long-pending proposals on unhosted wallets and mixing. Regulators are writing rules for intermediaries, building divided control into them, and stepping back from proposals that treated self-hosted wallets with suspicion. After the CryptoBilis incident, Ledger said it was reviewing how its devices are sold to consumers.

Custody has mostly been sold on brand, on convenience and, more recently, on proof of reserves, which records balances at a point in time and says little about whether an institution can lose them. Owners, fiduciaries and families who intend to hold bitcoin for decades will increasingly ask how many independent failures stand between them and a loss. The answer they should require is ownership they can verify on chain, with control distributed across parties that do not fail together. Bitcoin is the first monetary asset that makes this possible.

Alone, you are the single point of failure.
Handed over, someone else is.
The third way is built so there is none.

Full notes and sources are in the PDF edition.