Custody Explained: Who Holds the Keys to Your Money

Every crypto payment platform holds keys. Something has to sign transactions, and a signature requires a private key. The marketing question of custodial versus non-custodial is less useful than the engineering one: where does the key live, and what can reach it?

The three questions that matter

1. Where does the key live?

The wrong answers are in application code, in a config file, in an environment variable, or in a database. All of them mean anyone who reaches your server reaches your money.

The right answer is a hardware security module or a managed key service, where signing happens inside a boundary the key never crosses. An attacker who compromises the application can then ask for signatures, which is bad, rather than walk away with the key, which is terminal. The first is detectable and stoppable. The second is not.

2. Are funds segregated?

Pooled custody means every merchant's balance sits in shared wallets and an internal ledger records who owns what. It is simpler to build and it means one merchant's problem is structurally everyone's problem.

Per-merchant wallets tied to your own account keep your funds identifiable on-chain and separate from everybody else's. Ask this question directly, because the answer is short if the architecture is right.

3. How are hot and cold separated?

A hot wallet is reachable from an internet-facing service, which makes it fast and makes it the attack surface. A cold wallet is offline and safe and slow.

Any serious platform runs both, keeping the hot balance deliberately small, sized to expected payouts rather than to total holdings. If a platform cannot describe that split, it probably does not have one.

What good looks like operationally

• Keys generated inside the HSM, never exported, rotated on a schedule.
• Signing requests logged, so there is a record of every use of a key.
• Payout approval thresholds, so a large transfer needs a second person.
• Separate keys for separate purposes, so one compromise is not total.
• A documented break-glass procedure that has actually been rehearsed.

The honest trade-off

Non-custodial sounds strictly better until you consider what it means for a business. You now run key management as an operational discipline: backups, staff turnover, someone available to sign at 3am, and no recovery path if it goes wrong. Plenty of businesses have lost more to their own key handling than they would ever have lost to a custodian.

The realistic answer for most merchants is a custodial platform with segregated wallets, HSM-backed signing, and controls you can inspect. Not because trusting someone is ideal, but because the alternative is a job you are not staffed to do.

What you should never accept is not knowing which of the two you have.

Frequently Asked Questions

What does custody mean in crypto payments?

Custody is who controls the private keys that can move funds. A custodial platform holds them on your behalf. A non-custodial arrangement leaves them with you, which means full control and full responsibility for losing them.

What is a segregated wallet?

A wallet tied to one merchant's account rather than a pooled balance shared across all customers. Segregation means one merchant's problem, freeze or dispute does not touch anyone else's funds.

Why should private keys be in an HSM?

A hardware security module performs signing inside a tamper-resistant boundary the key never leaves. Even an attacker who reaches the application server cannot extract the key, only ask for signatures, which is a far smaller and more detectable problem.

What questions should I ask a provider about custody?

Three. Where do the keys live and what signs with them. Are my funds in wallets tied to my account or pooled with everyone else. And how are hot and cold balances separated. Short answers to all three indicate the architecture is sound.