Best Crypto Custodians in 2026: Security Compared

By Owen Thurm Published November 10, 2026 9 min read

Quick answer. Leading institutional crypto custodians in 2026 include Anchorage Digital, BitGo, Fidelity Digital Assets, Paxos, BNY, Coinbase Custody, Gemini, Zodia Custody, Komainu and Copper. None suits everyone: compare charter, keys, SOC reports, insurance and record.

Watch: Best Crypto Custodians in 2026: Security Compared 1:39

Video transcript

No custodian suits everyone. Leading institutional crypto custodians in 2026 include Anchorage Digital, BitGo, Fidelity, Coinbase Custody and Gemini, among others.

Guardian is not a custodian, so it is not on this list. Every claim is sourced, and the order follows charter type, not quality.

We compared each firm on things a careful buyer can verify: the charter and qualified custodian status, the key architecture, named SOC reports, insurance as stated, segregation, and the public record.

Each firm gets a best for segment. Anchorage has the longest held federal crypto charter, BitGo broad asset coverage, Paxos suits stablecoin issuers, Coinbase serves ETF scale, Gemini publishes insurance limits, and Copper suits off exchange settlement.

Check the public record too. Paxos, Coinbase's exchange arm and Gemini have each settled with New York regulators, and Anchorage's OCC consent order ended in 2025.

Three lessons stand out. A charter is not a key review, so ask for a key ceremony record. Insured needs terms, including limits, exclusions and whether clients share them. And read the liability cap.

For example, the iShares Bitcoin Trust's agreement caps Coinbase Custody's liability at 100 million dollars per cold storage address.

Guardian's counterparty review treats custodians as concentrations of risk, not logos on a slide. Read the full comparison, or talk to Guardian at guardian.security.

Choosing a custodian means trusting someone else's keys, people and lawyers with your assets.

Guardian is not a custodian, so Guardian is not on this list. The comparison rests only on evidence you can check yourself.

Every claim comes from a custodian's own pages or filings, a regulator, or reputable reporting. Sources are at the end.

Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.

How We Compared Custodians

We checked seven things a careful buyer can verify:

Charter: the entity that holds assets, its license type and regulator.
Qualified custodian: whether the firm claims the status, and under which law.
Keys: HSM, MPC or multisig, and cold or hot, as each describes it.
Attestations: SOC 1 and SOC 2 reports the firm names publicly.
Insurance: only as each describes it. No fees.
Segregation: what each says about separate wallets and bankruptcy.
Public record: regulator actions and incidents we could source.

We read every page in November 2026. Where a page is silent, we say so. "None found" means we found nothing, not that nothing exists.

There is no single winner, so each firm gets a "best for" segment. The order follows the charter of the entity holding assets, OCC national trust banks first. It is not a quality ranking.

Custodians Compared

Custodian	Best for	Entity holding assets (US or main)	Attestations stated
Anchorage Digital	Longest-held federal crypto charter	OCC national trust bank, since 2021	SOC 1, SOC 2 Type II
BitGo	Broad asset coverage	OCC national trust bank, since 2025	SOC 1, SOC 2 Type 2
Fidelity Digital Assets	Custody under the Fidelity name	OCC national trust bank, 2025	SOC 1, SOC 2 Type 2, annual
Paxos	Stablecoin and tokenized asset issuers	OCC national trust bank	SOC 1, SOC 2 Type II
BNY	Crypto beside traditional custody	New York state-chartered bank	None found on pages read
Coinbase Custody	ETF-scale bitcoin and ether	NYDFS limited purpose trust company	SOC attestations on key management
Gemini	Published insurance limits	NYDFS limited purpose trust company	SOC 1, SOC 2 Type 2, ISO 27001
Zodia Custody	EU custody under MiCA	MiCA CASP, Luxembourg CSSF	SOC 1, ISO 27001
Komainu	Dubai and Jersey	VARA and Jersey JFSC licenses	SOC 1, SOC 2 Type II, ISO 27001
Copper	Off-exchange settlement	US broker-dealer; Swiss entity	SOC 2 Type 2, ISO 27001

Next, keys, insurance and the public record.

Custodian	Keys, as stated	Insurance, as stated	Public record found
Anchorage Digital	HSM-secured cold storage, biometric approvals	No digital asset figure	OCC order 2022, ended 2025
BitGo	Cold, 2-of-3 keys, multisig or MPC	Up to $250M, qualified custody	OFAC settlement 2020, hot wallet service
Fidelity Digital Assets	Offline, multi-site, tiered approvals	Named, no details	None found
Paxos	"Keys never leave the hardware"	Not on pages read	NYDFS AML settlement 2025
BNY	Fireblocks technology, 2022	Not on pages read	None found
Coinbase Custody	Mostly cold; software plus HSMs	Crime policy, shared	NYDFS settlement 2023; data theft 2025
Gemini	MPC; key never assembled	$125M for certain losses (2024)	NYDFS Earn order 2024
Zodia Custody	Cold, HSM master keys; MPC option	Policy linked, no terms	None found
Komainu	MPC and HSM	Not on pages read	None found
Copper	MPC; full key never created	$500M specie, plus crime	None found

For what each key model means, see multisig vs MPC and hot, warm and cold wallets.

The Ten Custodians

Anchorage Digital

Best for: a federal charter with the longest track record.

The OCC chartered Anchorage Digital Bank, N.A. as a national trust bank on January 13, 2021. A New York affiliate holds BitLicense 0000041, and a Singapore affiliate is a MAS Major Payment Institution.

Anchorage describes "HSM-secured cold storage" and biometric approvals around the clock. It calls itself an "SEC-qualified custodian" offering "bankruptcy-remote, segregated custody".

Its SOC 2 covers security, availability and confidentiality, scoped to its key management infrastructure. It keeps four SOC 1 and SOC 2 reports.

On April 21, 2022, the OCC issued a consent order over gaps in its BSA/AML compliance program. The OCC terminated the order on August 18, 2025.

BitGo

Best for: breadth. BitGo's 10-K says it supported over 1,770 digital assets at the end of 2025.

The OCC conditionally approved BitGo Bank & Trust, N.A. on December 12, 2025, and BitGo's 10-K says the conversion closed that day.

BitGo also runs a New York limited purpose trust company, a MiCA CASP supervised by BaFin and a VARA-regulated custodian in Dubai.

Its custody wallets are all cold and sign with 2 of 3 keys. "No one person controls more than one key for a given wallet."

BitGo reports SOC 1 Type 2 and SOC 2 Type 2 audits, and "up to $250 million" of insurance for qualified custody. Client assets are "never commingled".

In 2020, BitGo, Inc. agreed to pay OFAC $98,830 to settle 183 apparent sanctions violations through its non-custodial hot wallet service. OFAC said they did not relate to BitGo Trust Company's custody services.

We compare it with Anchorage in BitGo vs Anchorage Digital.

Fidelity Digital Assets

Best for: allocators who want a custodian under the Fidelity name.

Custody is provided by Fidelity Digital Assets, National Association, which says the OCC granted it a national trust bank charter in 2025. Its UK arm is registered with the FCA.

It lists offline, cold-vaulted, multi-site storage and a multi-tiered approval structure. It names no HSM, MPC or multisig design.

It "undergoes SOC 1 Type 2 and SOC 2 Type 2 audits annually." It mentions insurance coverage without terms.

Paxos

Best for: stablecoin and tokenized asset issuers who want issuance and custody under one bank.

The OCC conditionally approved Paxos Trust Company's conversion on December 12, 2025. Paxos now calls it a national trust bank regulated by the OCC.

NYDFS first chartered it as a limited purpose trust company in 2015.

Paxos says assets are "legally segregated and bankruptcy-remote under federal banking law." Its SOC 1 and SOC 2 Type II reports are available under NDA.

On August 7, 2025, NYDFS announced a $26.5 million penalty and $22 million of compliance investment. It cited anti-money laundering deficiencies and weak diligence of Binance, Paxos's former partner.

BNY

Best for: institutions that want crypto held by their existing traditional custodian.

BNY's main bank, The Bank of New York Mellon, is a New York state-chartered bank. BNY's digital asset custody platform went live in the US in October 2022, for bitcoin and ether, with select clients.

BNY built it with Fireblocks and Chainalysis technology. In August 2026, it announced staking through Galaxy, with assets staying in its custody.

We found no public SOC report, key design or insurance description for this platform. Ask for them.

Coinbase Custody

Best for: bitcoin and ether at ETF scale. Coinbase says it is custodian for several bitcoin and ether ETF issuers.

Coinbase Custody Trust Company is a NYDFS-chartered limited purpose trust company and, per Coinbase, a qualified custodian under the Advisers Act. Coinbase Luxembourg holds a MiCA license supervised by the CSSF.

Custody assets sit in dedicated addresses, managed with "software and hardware security modules." Coinbase generally seeks to hold no more than 2% of assets under custody in hot wallets.

An ETF filing says Coinbase Custody represents that an external provider performs SOC attestations on its private key management controls.

In January 2023, Coinbase, Inc., its exchange arm, settled with NYDFS over compliance program failings: a $50 million penalty and $50 million of compliance investment.

Coinbase's 8-K of May 15, 2025 reported that a threat actor obtained data on certain customer accounts. Coinbase says "no passwords or private keys were compromised."

Gemini

Best for: buyers who want insurance limits in writing.

Gemini Trust Company is a New York limited purpose trust company and "a fiduciary and qualified custodian under New York Banking Law."

New custody accounts sign with MPC, and "the complete private key is never assembled." It cites SOC 2 Type 2 and ISO 27001, and its prospectus says it completed SOC 1 examinations.

Gemini states $125 million of digital asset insurance "for certain types of losses", as of March 1, 2024: $25 million crime cover for the hot wallet and $100 million for cold storage.

In a February 28, 2024 NYDFS consent order focused on its Earn program, Gemini agreed to a $37 million penalty. Earn was separate from its custody product.

Zodia Custody

Best for: EU custody under MiCA with a bank owner in view.

Zodia Custody (Europe) S.A. has been a CSSF-authorized crypto-asset service provider since December 12, 2025. Its UK company is FCA-registered; Zodia notes its UK services are not subject to authorization.

Its Abu Dhabi entity is regulated by the ADGM FSRA.

Master keys are generated offline and stored in HSMs, with an MPC alternative. Each client gets segregated cold storage wallets. Its homepage cites SOC 1 and ISO 27001.

On October 21, 2026, Standard Chartered signed to acquire 100% of Zodia Custody UK Limited, subject to regulatory approvals.

Komainu

Best for: custody licensed in Dubai or Jersey.

Komainu MEA FZE holds a VARA license for custody services. Komainu (Jersey) is regulated by the JFSC, and its UK company is FCA-registered. It is backed by Laser Digital and Blockstream.

It uses MPC and HSM wallet technology and offers segregated custody "verifiable on the blockchain." It holds SOC 1 Type II and SOC 2 Type II attestations and ISO 27001.

Copper

Best for: trading firms that settle off exchange through ClearLoop.

US custody is offered by Copper Markets (US), Inc., a registered broker-dealer and FINRA member. Copper notes that non-security digital assets get no SIPC protection.

Its MPC means "a full private key is never created." It lists SOC 2 Type 2 and ISO 27001, and insurance through Aon including "$500M of specie market-based insurance".

Technology, Not Custody

Fireblocks describes itself as an infrastructure company, and BNY's platform was built with it. Its separate Fireblocks Trust Company is a NYDFS limited purpose trust company offering qualified custody.

If you hold keys yourself, compare MPC wallet providers instead.

How to Choose

Our crypto custody guide has the full scorecard. This comparison adds three lessons.

A charter is not a key review. Check controls in crypto custody security and ask to see a key ceremony record.
"Insured" needs terms. Ask for limits, exclusions and whether other clients share them.
Read the liability cap. The iShares Bitcoin Trust's agreement caps Coinbase Custody's liability at $100 million per cold storage address.

Rules are moving too. The SEC's October 2026 crypto custody proposal is still a proposal.

Checking a Custodian Independently

Guardian's counterparty and integration review assesses the custodians you would depend on "as concentrations of risk rather than as logos on a slide."

For regulated firms, Guardian's compliance audits include reviews of critical custody and other third-party dependencies, and check who can move assets on your side.

Frequently Asked Questions

What is a qualified crypto custodian?

Under the SEC's custody rule, it is a bank or savings association, a registered broker-dealer, a futures commission merchant or certain foreign financial institutions. The SEC proposed crypto custody rules on October 1, 2026, with comments due December 7.

Does a custodian's insurance cover my assets?

Not necessarily. The iShares Bitcoin Trust's 10-K says Coinbase's crime policy is shared among all Coinbase customers and may not be sufficient. Ask whether the limit is shared, which wallets it covers and what it excludes.

Who custodies the iShares Bitcoin Trust?

The iShares Bitcoin Trust's 10-K for 2025 names Coinbase Custody Trust Company as its bitcoin custodian and Anchorage Digital Bank as an additional custodian. The Bank of New York Mellon holds the trust's cash.

Sources

Get an independent read on your custodian

Guardian assesses the custodians you depend on as concentrations of risk, and tests who can move assets on your side.

Talk to Guardian Explore Guardian for institutions