When cryptocurrency first emerged, the mantra “not your keys, not your coins” was a badge of honour for those who insisted on self-custody. But as the market has matured, millions of users have chosen to hold digital assets through centralised exchanges for convenience, trading liquidity, and access to financial services. The collapse of FTX in 2022 made brutally clear what happens when custody is mismanaged. For UK investors, understanding how exchanges safeguard funds is no longer optional — it is essential due diligence.
The Custody Model: Who Holds the Keys?
At its core, crypto custody is about control of private keys. A centralised exchange typically operates a combination of hot wallets (connected to the internet for day‑to‑day withdrawals) and cold wallets (offline or air‑gapped storage for the vast majority of user funds). The industry standard is to keep 90–95% of assets in cold storage, with only a small percentage in hot wallets to meet withdrawal demand.
These wallets are secured using multi‑signature (multi‑sig) technology, meaning that multiple private keys — held by different individuals or systems — are required to authorise a transaction. This reduces the risk of a single compromised key draining funds. Some exchanges also employ threshold signature schemes (TSS) or hardware security modules (HSMs) to further isolate key material.
Importantly, the exchange acts as the custodian, meaning the user does not hold the private keys. Instead, the user’s balance is recorded in the exchange’s internal ledger. This model is similar to how a bank holds your money in a pooled account, but with the added complexity of blockchain transactions and the irreversible nature of crypto transfers.
Security Layers: Beyond the Vault
Custody is only one part of the picture. A responsible exchange deploys multiple layers of operational security. Withdrawal whitelists, for instance, allow users to lock addresses to which funds can be sent, making it harder for attackers to redirect stolen assets. Time‑delayed withdrawals and manual review of large transfers add friction for bad actors while remaining manageable for legitimate users.
On the infrastructure side, exchanges use extensive monitoring for unusual activity, including brute‑force login attempts, abnormal withdrawal patterns, and address clustering linked to known malicious wallets. Most credible platforms also undergo regular third‑party security audits and penetration testing, though the quality and frequency of these audits vary widely.
Insurance is another layer, but it is important to understand its limits. Some exchanges purchase crime insurance policies that cover losses from breaches of their hot wallets. However, cold wallet theft is rarely insured, and policies often exclude social‑engineering attacks or gross negligence. UK users should never assume that insurance equals a full safety net.
Regulatory Oversight in the UK
The Financial Conduct Authority (FCA) currently requires all crypto asset exchanges operating in the UK to register under the Money Laundering, Terrorist Financing and Transfer of Funds Regulations. While registration focuses on anti‑money laundering (AML) and know‑your‑customer (KYC) procedures, the FCA does not directly regulate custody standards or solvency. This means an exchange can be FCA‑registered yet still hold user assets in a way that exposes them to risk.
There have been moves toward stronger safeguarding rules. In 2023, the UK government consulted on a comprehensive cryptoasset regulatory framework that would include custody requirements — such as segregation of client assets and periodic reconciliation. Until those rules are enacted, UK users must rely on the exchange’s own policies and any voluntary codes of conduct, such as those published by industry bodies like CryptoUK.
It is also worth noting that some exchanges choose to operate from jurisdictions with more stringent custody regulations, such as the UK’s own e‑money framework or the European Union’s Markets in Crypto‑Assets (MiCA) regulation. While MiCA is not yet fully in force, it already influences how exchanges treat user funds.
What Users Should Look For
Due diligence begins with transparency. A reputable exchange will publish clear documentation about its custody architecture, including the percentage of funds held in cold storage, the type of multi‑sig setup used, and how keys are distributed. Proof‑of‑reserves (PoR) reports — ideally verified by a third‑party auditor — can provide some confidence that the exchange holds the assets it claims to hold.
When evaluating an exchange, consider these factors:
- Cold storage ratio: Look for an explicit commitment to keeping at least 90% of assets offline.
- Multi‑signature and key management: Are keys distributed geographically? Are they stored in hardware security modules?
- Withdrawal safeguards: Does the exchange offer address whitelisting, time delays, and manual approvals for large sums?
- Audit history: Has the exchange undergone regular independent security audits? Are the findings published?
- Regulatory status: Is the exchange registered with the FCA or an equivalent authority? Does it hold relevant licenses in other jurisdictions?
It can also be instructive to look at how different operators tackle these issues in practice. For example, operators such as Thunderpick provide clear information about their security practices, including cold storage policies and withdrawal procedures, allowing users to judge for themselves whether the approach meets their needs. While each platform’s setup may differ, the common thread is a willingness to share details rather than relying on opaque assurances.
Risks and Responsible Custody
No exchange can eliminate all risk. Even the most secure hot wallet has some exposure to online threats, and cold storage does not protect against inside jobs, regulatory freezes, or the exchange becoming insolvent. Users should treat exchange custody as a convenience, not a guarantee, and consider spreading assets across multiple platforms or, for long‑term holdings, learning to manage their own non‑custodial wallet.
Cryptocurrencies remain a high‑risk asset class. Never invest more than you are prepared to lose, and always withdraw any funds you do not intend to trade or use actively. The security landscape is constantly evolving — what works today may be obsolete tomorrow — so staying informed is part of the responsibility that comes with holding digital assets.
In a world where trust in centralised intermediaries has been badly shaken, the best defence is a healthy scepticism backed by knowledge. Understanding how custody and security work is the first step to making confident decisions about where — and how — to store your crypto.
Further reading
For additional context on the operators and platforms discussed above, see Thunderpick.
Related stories
Rachel Dunn covers culture, lifestyle and society stories across the UK.