Exchange Asset Custody Models: Custody, Self-Custody and MPC

A custody model answers who may sign on the user's behalf and who carries the safekeeping duty, while MPC answers how signing capability is distributed. MPC can be used in custodial or self-custodial products and is not a legal relationship in itself.

How does exchange custody work?

After a user deposits, the platform controls the on-chain wallets and keeps the books in an internal ledger. Trades usually only update a database, and on withdrawal the platform runs risk checks and approvals before sending the on-chain transaction.

This model makes account recovery, matching and batch processing convenient, but users depend on the platform's keys, internal controls, asset segregation and solvency. An account balance does not mean the user individually controls an on-chain address.

Who takes the responsibility in self-custody?

In a self-custody wallet, the user or a designated signer controls the keys. The platform cannot unilaterally stop a normal on-chain transfer, and it usually cannot reset a lost seed phrase either.

Self-custody reduces exposure to misappropriation and bankruptcy by a custodian, yet it adds risks around devices, backups, malicious signing and inheritance. It is not "free of all third parties": wallet front ends, RPC providers, bridges and DApps can still affect what you do.

Where does MPC fit in?

MPC lets several shares jointly compute a signature, so the normal flow never rebuilds a complete private key in one place. An exchange can spread shares across different systems, people or locations and layer spending limits and approval policies on top.

Consumer wallets can also split shares between the user's device and a server to support recovery. In that case, check what happens when the service stops, how identity recovery works, how shares are refreshed and who holds unilateral authority, rather than trusting "keyless" marketing claims.

How do you judge a platform's real custody boundary?

Read the terms of service, the legal status of customer assets, whether lending or staking is permitted, any third-party custodian, bankruptcy treatment and withdrawal authority. Then review the technical architecture: the hot and cold wallet ratio, approvals, MPC or multisig thresholds, emergency keys and audit logs.

Third-party custody can isolate some operational risk, but it also adds custodian, contractual and cross-system transfer risk. What matters is that responsibility is traceable, authority is constrained, and assets and liabilities can be verified.

For a broader exchange assessment, see Exchange Security and Trustworthiness.

FAQ

Are MPC and multisig the same technology?

No. MPC typically produces one signature jointly at the cryptographic layer, while multisig verifies multiple signatures through an on-chain script or contract.

If an exchange gives me a deposit address, is that self-custody?

No. The deposit address is normally controlled by the platform, and the user only holds a balance record in the platform account.

Is third-party custody always safer than a platform holding assets itself?

Not guaranteed. It depends on the custodian's controls, insurance, contracts, audits, availability and the platform's authority to move assets.

Are self-custodied assets completely unaffected by platform risk rules?

An on-chain wallet does not depend on one exchange for withdrawals, but trading, fiat on-ramps, stablecoins and DApps can still be affected by their own rules.