Knowledge base
Earlier in this series, we looked at how individuals store Bitcoin - wallets, keys, and the basics of self-custody. A company holding potentially significant sums needs to go considerably further than any individual typically would. This article closes out this Tier by looking at what that actually involves.
An individual losing access to a personal wallet is a serious personal loss. A public company losing access to, or control of, a treasury worth a meaningful share of its total value is a very different order of problem - with consequences for every shareholder, not just one person. That difference in stakes is why institutional custody looks considerably more elaborate than anything covered in our earlier storage article.
Rather than one person holding one key, institutional setups typically use multi-signature (“multisig”) arrangements, requiring several independent approvals before any transaction can go through - commonly described as, for example, a “3-of-5” scheme, where at least three of five authorised key holders must approve a move. This means no single individual, however senior, can move funds alone, and a single compromised key isn't enough to cause harm on its own.
Just as an individual might use a hardware wallet to keep keys offline, institutions apply the same principle at a much larger scale - keeping the vast majority of holdings in deep cold storage, often physically distributed across multiple secure locations, with only a small operational amount kept more readily accessible for day-to-day needs.
Rather than building all of this in-house, many companies choose to work with specialist custody providers - firms built specifically around securing large digital asset holdings, in much the same spirit as a bank might use a specialist security firm for physical cash or gold. This introduces a different kind of trust: relying on a custodian's own security and reputation, in exchange for infrastructure and expertise most individual companies wouldn't build themselves.
Some custody arrangements include insurance covering a defined portion of holdings against specific risks like theft. The details vary considerably by provider and arrangement, and shouldn't be assumed to cover every possible scenario - it's one layer of protection among several, not a blanket guarantee.
Beyond the technical security itself, well-run companies apply clear internal policies: who can authorise a transaction, how duties are separated between individuals, and how holdings are independently verified and reported over time. For a public company, this sits alongside the normal accountability that comes with being listed - regular reporting, external audit, and board oversight of the whole arrangement.
A company's approach to custody is a genuine, practical consideration for anyone evaluating a Bitcoin treasury company, not just a technical footnote. Weak custody, poor governance, or excessive reliance on a single individual or process all represent real operational risks, sitting alongside the market risks we've covered throughout this Tier. Nothing in this article is financial advice, and anyone considering an investment should do their own research and consider speaking to a regulated financial adviser.
Back to topNext in knowledge base
Next, we go deeper still with Explained: How Does Bitcoin Actually Work? A Look Inside the Blockchain, where we open up the technology itself.
