{"@context":"https://schema.org","@type":"Dataset","name":"Proof of Custody — Custody models: fit and failure","description":"The custody models in use for bitcoin, each with what it is, who it suits, who it does not suit, and where it fails. Fit is a property of the model, not of a brand.","url":"https://proofofcustody.io/data/custody-models.json","creator":{"@type":"Organization","name":"Proof of Custody","url":"https://proofofcustody.io"},"license":"https://creativecommons.org/licenses/by/4.0/","isAccessibleForFree":true,"inLanguage":"en","dateModified":"2026-09-23T03:54:21.636Z","citation":"Proof of Custody, custody models, https://proofofcustody.io/compare","publisherDisclosure":"Proof of Custody is published by Onramp Bitcoin, which operates a multi-institution custody product. That model is described here on the same terms as every other, including who it does not suit.","models":[{"id":"exchange","label":"Exchange / single custodian account","what":"One company holds the keys; you hold a claim on the company.","rightFor":["First purchases and small balances, where losing the amount would sting but not change your life","Active traders who need the coins next to the order book","Anyone still deciding — parking funds briefly at a reputable exchange beats a rushed self-custody setup you have not tested"],"wrongFor":["Life-changing amounts: you are an unsecured creditor in the failure case, and every era of our incident registry includes this exact loss","Long horizons: platform risk compounds with time in a way price risk does not","Anyone whose plan for the provider failing is 'they seem too big to fail' — that was said of every name in the registry"]},{"id":"qualified-custodian","label":"Qualified custodian","what":"A regulated institution holds keys in segregated accounts under a legal framework built for it.","rightFor":["Entities that must satisfy a regulator, an auditor, or an investment-committee mandate","Holders who want institutional process — SOC audits, segregation, named accountability — and accept institutional control","Estates and trusts whose lawyers need a counterparty that courts already understand"],"wrongFor":["Anyone whose core requirement is that no single institution can move the coins — one institution can","Privacy-focused holders: the custodian, its regulator, and its subpoena inbox all know your position","Small balances: minimums and fees are built for institutions"]},{"id":"collaborative-multisig","label":"Collaborative multisig","what":"You hold most keys, the provider holds one, and no single party can move funds alone.","rightFor":["Technical-enough holders who want real control with a safety net — comfortable with hardware wallets, firmware updates, and a signing ceremony","People whose main fear is their own single point of failure: one lost device no longer means lost coins","Holders who want to verify rather than trust: the quorum is inspectable on-chain"],"wrongFor":["The non-technical spouse, parent, or heir who will one day hold this alone — if they cannot run a signing ceremony, the arrangement quietly becomes single-provider custody the day you are gone","Anyone who will not maintain it: devices need firmware, backups need checking, and vendor diversity is your job, not the provider's","Holders under physical-security threat: keys at home mean the threat model includes your address"]},{"id":"multi-institution","label":"Multi-institution custody","what":"Separate institutions each hold a key under their own ceremony; no one of them can move funds.","rightFor":["Holders who want independence to be structural rather than a personal discipline — the separation survives your attention span, your health, and your heirs","The person planning for a non-technical survivor: the heir works with institutions and documents, not devices and dice","Advisors, trusts, and family offices that need no-single-point-of-failure custody they can explain to a fiduciary"],"wrongFor":["Holders whose definition of bitcoin includes holding a key personally — you do not hold one, and no amount of structure changes that","Small balances: institutional fee floors make no sense under six figures","Privacy maximalists: multiple regulated institutions know the position","Anyone who wants to be able to move coins alone at 2am — the design goal is precisely that nobody can"]},{"id":"self-managed-multisig","label":"Self-managed multi-vendor multisig","what":"You build and run the quorum yourself, ideally across devices from different vendors.","rightFor":["The technically serious holder who treats custody as a discipline: multiple vendors, separate entropy, documented recovery, periodic drills","Maximum-sovereignty positions where no third party should appear anywhere in the chain","People who enjoy this — genuinely, because it is a permanent part-time job"],"wrongFor":["Anyone who has not written down what their family does on day one without them — the registry's self-custody losses are mostly operational, not cryptographic","Holders who will set it up once and never touch it again: unmaintained multisig decays into a puzzle box","Anyone who buys three devices from one vendor and calls it distributed — the Coldcard incident is what that looks like at scale"]},{"id":"single-sig-hardware","label":"Single-signature hardware wallet","what":"One device, one seed, entirely yours.","rightFor":["Learning self-custody with amounts you can afford to lose while you learn","Spending and medium-term balances where convenience matters and the amount is bounded","A component inside a larger multisig — where it is one key of several, not the whole answer"],"wrongFor":["Life savings: one firmware defect, one coerced evening, or one lost seed is total loss — one failure domain is the whole story","Inheritance: a seed phrase in a drawer is a plan that fails silently and is tested exactly once","Anyone who will not verify the device and its entropy path — 2026 demonstrated that the generator you never audited is the risk you actually hold"]}]}