Custody risk
Whoever has the key has the assets - and that is two routes with two risks
What can happen
The question is not which route is safer. The question is against whom you are protecting yourself.
| Held yourself | Nobody can block access, nobody can restore it. If the key is lost, the assets are permanently out of reach. If its holder is deceived, they approved it themselves. |
|---|---|
| Held for you | Access can be restored, but the assets sit with somebody else. Their solvency, care and honesty are from now on part of your own risk. |
Custody by others adds a property unfamiliar from banks: it cannot be verified from outside whether the assets are really there. What the custodian displays is a figure on its own interface.
How that turns into a financial loss
With self-custody the loss arises with the holder. With third-party custody it arises with a third party - and then hits all of its customers at once.
The second case is the larger one, because a great deal concentrates there. A custodian holds the assets of thousands of people in one place. If it fails - through insolvency, misuse or an attack - it is not one account that is affected but all of them.
Anyone with a claim then has it against a company, not against the blockchain. What that is worth depends on what is still there.
A documented case
DOCUMENTED CASEInsolvency of the trading platform FTX, November 2022
The case is included here deliberately, even though it is not a blockchain event. That is precisely the point: having assets held for you trades a technical risk for a commercial one. Whether a cover product captures that is an entirely different question from smart contract risk.
Can this be the subject of a cover?
Partly, and here for once the answer is not simply yes.
For self-custody: loss of the key and deception of the holder are often expressly excluded in cover wordings - not out of reluctance, but because the event cannot be established from outside.
For third-party custody there are products that address the failure of a custodian. They then resemble classical insurance more than a protocol cover, because the event lies entirely offchain.
What the wording has to answer
| Self-custody or third-party custody? | Most products mean exactly one of the two. Which one is rarely in the name. |
|---|---|
| Is loss of the key covered? | As a rule not. Where it is, only under narrow conditions - read that line closely. |
| Is deception of the holder covered? | Whoever approved it themselves has technically consented. That is the most common exclusion. |
| Which custodian exactly? | A product names a company, not an industry. Assets held at a different one are not meant. |
| What counts as failure? | Insolvency, a filing, a halt on withdrawals - or only a concluded proceeding? |
| How long does the determination take? | An insolvency proceeding takes years. Does the payment wait for it? |