Where Are Your Crypto Assets Held, and Why Does It Matter?

Traders spend most of their risk budget on the market. They size positions, manage leverage and set stop-losses. They spend far less time asking who holds the assets behind those positions, and what happens if that party fails. Under the conventional exchange model, one platform executes the trade and also holds the collateral behind it. That concentrates several kinds of exposure in one place.

This article looks at what the data says about custody concentration. It covers 2025's record theft figures, the Bybit incident and what past exchange failures meant for customers. It then explains how separating custody from execution works and which risks remain. Bitget's Open Custody Network (OCN) is covered as one example of the model, not as a cure.

Key Takeaways

• Custody risk is separate from market risk. A sound strategy cannot protect against a security breach, an operational failure or an insolvency at the venue holding your assets.

• The largest losses are concentrated. Chainalysis recorded more than $3.4 billion stolen in 2025. The Bybit breach alone accounted for $1.5 billion, and the top three hacks made up 69% of losses.

• Failure outcomes can be slow and uncertain. In past exchange bankruptcies, customers became creditors with claims. Those claims were often fixed at petition-date prices and paid years later.

• Regulators and institutions are focusing on custody. IOSCO's global standards address segregation of client assets and the conflicts that come from combining custody and trading. Institutions cite infrastructure quality as a driver of crypto allocations.

• Separating custody from execution is one of the ways to move forward. Arrangements such as off-exchange settlement (OES) can reduce how much collateral sits on an exchange. They add custodian, settlement and contractual dependencies.

What Is Custody Concentration Risk?

Custody concentration risk is the exposure that builds up when one institution performs several critical functions at once. On a typical centralized exchange, that institution matches orders, holds assets, controls withdrawals and manages the account.

That bundle is why centralized exchanges made crypto accessible. A user funds one account, trades across products and moves quickly. It also means a single incident can affect trading, access to funds and the safety of the assets together.

This does not mean exchange custody is unsafe. Many exchanges invest heavily in security, governance and operational controls. The point is structural. When more functions sit with one party, more of a user's exposure depends on that party's resilience.

Why Is Custody Risk Different From Market Risk?

Market risk comes from price movements, which traders can hedge, size and limit. Custody risk comes from the institutions and systems that hold the assets. A trader can run a disciplined portfolio and still face exposure to a cyberattack, an outage or a counterparty failure that has nothing to do with their positions.

Such events are not hypothetical. In November 2026, Brazilian exchange Mercado Bitcoin was reopening after a cyberattack froze withdrawals for about a week. Funds sitting in a frozen account cannot be used, hedged or moved, however good the underlying strategy was.

What Does the Data Say About Exchange Security Incidents?

Chainalysis reported that more than $3.4 billion in cryptocurrency was stolen between January and early December 2025. The February compromise of Bybit accounted for $1.5 billion of that total, according to its 2025 crypto theft analysis. Three findings stand out.

• Losses are concentrated. The top three hacks accounted for 69% of losses. For the first time, the largest hack was more than 1,000 times the size of the median incident.

• Centralized services drive the biggest losses. Chainalysis says attacks on private key infrastructure and signing processes can circumvent cold wallet controls. These accounted for 88% of losses in Q1 2025, despite the platforms' institutional resources and professional security teams.

• Attackers exploit trust relationships. Chainalysis notes that many attackers have developed methods to exploit third-party wallet integrations and trick legitimate signers into authorizing malicious transactions.

Bybit shows how this works. On February 21, 2025, signers approved what looked like a routine transfer from a multisig cold wallet to a warm wallet. Attackers had compromised the signing interface of Safe{Wallet}, the third-party multisignature platform Bybit used, and injected malicious code that drained over 401,000 ETH. The multisig cryptography was not broken. The attackers went after the software that shows signers what they are approving.

The aftermath is instructive too. Within roughly two days, Bybit received $1.23 billion in ETH through bridge loans, whale deposits and OTC purchases, covering the deficit. That reflects well on the exchange's response. It also depended on the exchange's ability to raise capital quickly, which not every platform could do.

What Happens to Customer Assets When an Exchange Fails?

The harder question is what happens when an incident is not contained. Past exchange failures give a consistent answer. Customers who believed they held coins found they held claims.

FTX is the high-recovery case, and even there the recovery came in dollars at petition-date prices, years after the filing. Celsius and Mt. Gox show other outcomes, which were partial recovery and long delays. The common thread is that in an insolvency, the form of custody determines where customers stand in the queue. That is settled in court, not by the user.

Why Are Regulators and Institutions Focusing on Custody?

Custody sits at the center of the global regulatory response. IOSCO's 2023 policy recommendations for crypto markets set out 18 recommendations across six areas, including custody and client asset protection and conflicts of interest. Two points matter here.

• The custody recommendations address segregation of client assets, safeguarding, disclosure of safekeeping arrangements, reconciliation and controls to prevent client assets from being mixed or misused.

• On vertical integration, IOSCO says regulators should consider requiring legal segregation of functions and activities where conflicts cannot be effectively mitigated.

A summary of IOSCO's 2025 implementation review reports that 12 of 20 jurisdictions assessed now have custody rules for crypto-assets.

Institutions are moving the same way. In a January 2026 Coinbase and EY-Parthenon survey of 351 institutional decision-makers, 46% cited improved institutional-grade infrastructure as a driver of increased crypto allocations. Regulatory clarity ranked first at 65%.

In traditional markets, execution, custody and clearing are usually handled by different providers. Crypto is gradually moving toward the same separation.

Is There a Perfect Custody Model?

No. Each model concentrates risk in a different place.

• Exchange custody is convenient, but it ties trading, access and asset safety to one institution.

• Self-custody removes the exchange as a counterparty, but it shifts the full security burden to the user. Chainalysis counted 158,000 personal wallet compromises affecting 80,000 unique victims in 2025, with $713 million stolen.

• Third-party custody brings professional safeguarding and independent controls. It adds a custodian, and the Bybit case is a reminder that third-party software can itself be an attack path.

The practical goal is to understand where your exposure sits and to hold it in more than one place. No model removes risk entirely.

What Should You Ask Before Choosing Where to Hold Assets?

A few questions help here.

• Who holds the assets? Are they held directly by the trading venue or by a separate custodian?

• How are they protected? What security, governance and approval controls apply, and who verifies them?

• What happens in an incident? How would a breach, outage or insolvency affect access to your funds?

• What are the legal rights? Under the contract and applicable law, what is your claim, and how is it ranked?

• Can custody and trading be separated? Is there a supported way to trade while assets stay with a specialist custodian?

How Does Separating Custody From Trading Work?

In an off-exchange settlement arrangement, eligible collateral stays with a third-party custodian or in a designated collateral account. The exchange provides matching trading credit, and the customer trades. Profits and losses are then settled between the custody structure and the exchange under predefined rules, on-chain or off-chain.

This changes where assets sit while trading continues. Instead of moving the full collateral balance onto the venue, only net obligations settle between the parties.

How Does Bitget's Open Custody Network Approach This?

The Bitget Open Custody Network connects third-party custody providers with Bitget's trading and account infrastructure. Eligible institutions can access spot, spot margin and futures trading while keeping supported assets with their chosen custodian. Availability and terms depend on the custody solution, client eligibility and final agreements. These arrangements are currently offered to eligible institutional clients.

The network includes six partner solutions with different structures. Details are drawn from Bitget's Open Custody Network guide.

Consider a hypothetical quantitative firm holding 1 million USDT with Copper. Under a conventional model, it would deposit that amount into an exchange account before trading. Through ClearLoop, it can delegate the collateral and receive matching trading credit on Bitget, while the assets stay in Copper's custody structure. If trading produces a net obligation of 20,000 USDT, that amount settles through the agreed cycle rather than requiring the full balance to sit on the exchange beforehand. This example is illustrative. Actual credit ratios, settlement terms and legal rights depend on the agreements involved.

What Risks Remain When Custody and Execution Are Separated?

Separation changes the shape of risk. It does not remove it.

• Market risk is unchanged. Losses, margin calls and liquidations still apply.

• Custodian risk is added. The custodian's infrastructure, controls and legal framework become a new dependency.

• Settlement risk exists. Delays or failures can affect when obligations are resolved. Frequency matters, from every four hours to daily to loss-triggered, and so does how exposure builds up between cycles.

• Collateral is encumbered. Delegated assets may be pledged or restricted, and may be subject to set-off or enforcement rights. Bitget's published Fireblocks OES service terms describe collateral pledging, settlement obligations and the circumstances in which Bitget may exercise rights over delegated assets. Standard deposits and withdrawals may also be limited once a custody mode is active.

• Legal treatment varies. What happens to externally held collateral in an insolvency depends on the custody agreement, security interests and applicable law, and recovery is not guaranteed.

Bybit cuts both ways here. It shows that a cold wallet can fail through a third-party tool, and moving assets to a custodian does not make that risk disappear. It changes who is responsible for managing it, and whether that party is a specialist with independent controls.

Why Does Custody Choice Matter Now?

Three trends point the same way.

1. Losses are rising in size, not frequency. Chainalysis found 2025's record came from fewer, larger incidents. Tail events matter most, and they are hard to predict. Its head of national security intelligence said it is difficult to forecast whether 2026 will be worse because hacks are outlier-driven.

2. Regulators are formalizing the principle. Segregation of client assets and separation of conflicting functions are now central themes in global standard-setting.

3. Institutional expectations are rising. Custody, settlement and risk controls are treated as inputs to allocation decisions, not afterthoughts.

None of this requires abandoning exchanges. It does suggest treating custody as a distinct decision, weighed alongside liquidity, execution quality, fees and market risk.

Conclusion

Managing trading risk is only part of protecting capital. The data shows that the largest losses in crypto come from a small number of large events at the institutions that hold assets. Exchange failures tend to leave customers waiting, often for less than they expected or in a form they did not choose.

Separating custody from execution is one way to manage that exposure. It is not a cure. It trades one concentration for a set of dependencies that need to be understood and priced in. Bitget's Open Custody Network is one implementation of the idea. It offers eligible institutions a choice of custodians and settlement structures, and it is best judged against the questions listed above.

Protecting capital is not only about making the right trade. It is also about knowing where that capital is held, who controls it and what happens if something goes wrong.

Frequently Asked Questions

1. What is custody concentration risk?

It is the exposure that builds up when one institution handles trading, custody and withdrawals together. A single incident, such as a security breach, outage or insolvency, can then affect execution, access and asset safety at once.

2. Is keeping assets on an exchange unsafe?

Not inherently. Many exchanges invest heavily in security and governance. The concern is structural. More functions with one party means more of your exposure depends on that party.

3. What happened to customers in past exchange failures?

Outcomes varied. FTX customers were repaid about 119% of petition-date claim values, in dollars and years later. Celsius creditors have recovered about 64.9% so far. Mt. Gox repayments began a decade after its 2014 collapse.

4. Can I trade on Bitget without holding collateral on the exchange?

Eligible institutional clients can, through supported OES arrangements. Collateral stays with an approved custodian while Bitget provides trading credit. Access depends on the custody solution, eligibility, jurisdiction and final agreements.

5. Does off-exchange settlement eliminate counterparty risk?

No. It can reduce the amount of collateral held directly on the exchange. Market, custodian, settlement, collateral and contractual risks remain.

6. Is third-party custody safer than self-custody or exchange custody?

It depends on the arrangement. Each model concentrates risk differently. Review the legal structure, security controls, approval processes and the rights that apply to your assets before deciding.

Institutions interested in the Open Custody Network can learn more on the Bitget Custody page.

Disclaimer: This article is for informational purposes only and does not constitute investment, legal or financial advice. OCN availability, supported custody providers, eligible assets, trading services and collateral arrangements vary by provider and user eligibility. Off-exchange custody reduces certain types of exposure but does not eliminate cybersecurity, counterparty, settlement, operational or market risks.