Exchange Custody Model
Understand centralised exchange custody, internal ledgers, hot and cold wallets, customer claims, segregation and counterparty risk.
Reading progress — saved on this device
On a custodial exchange, the venue or its custody provider controls the private keys or equivalent signing authority for deposited crypto. Customers trade against internal account balances while the exchange manages the underlying on-chain wallets.
Core concept
A CEX normally maintains a customer ledger showing who is entitled to what inside the platform. The sum of those customer balances should be supported by the exchange's assets and custody arrangements, subject to the platform's legal structure and obligations.
When two customers trade BTC for stablecoin on the same exchange, the exchange can simply debit one internal balance and credit another. No Bitcoin or stablecoin transfer needs to be broadcast for that fill.
On-chain movement is typically concentrated in deposits, withdrawals, treasury/custody rebalancing and wallet-management operations.
Custody layers
| Layer | Function | Main risk |
|---|---|---|
| Customer account | Internal entitlement and trading balance | Legal/counterparty access |
| Internal ledger | Records fills and transfers | Accounting/operational integrity |
| Hot wallets | Routine withdrawals and liquidity | Online attack surface |
| Cold/MPC/multisig custody | Protects larger reserves | Governance/recovery/process risk |
| Bank/custodian relationships | Fiat and third-party assets | External counterparty/legal risk |
Common institutional controls
- Cold-storage policies and limits on hot-wallet balances.
- Multisignature or MPC approval structures for sensitive withdrawals.
- Withdrawal allowlists, cooling-off periods and behavioural/risk checks.
- Reconciliations between on-chain assets, bank balances and internal customer liabilities.
- Role separation so one employee or compromised credential cannot unilaterally move reserves.
- Incident procedures for key compromise, chain forks, sanctions or network outages.
Can reduce theft probability, but does not prove the exchange is solvent.
Addresses whether assets and liabilities support customer claims, but does not eliminate hacking or operational risk.
Worked example
A trader deposits £20,000, buys 2 ETH and later sells one ETH for a stablecoin. The buy and sell can both occur entirely on the exchange's internal ledger. The customer's account may display 1 ETH plus stablecoin, while the exchange's actual ETH reserves sit across shared custody wallets holding assets for many users.
If the user withdraws the remaining ETH to self-custody, the exchange debits the internal ETH balance, passes its withdrawal controls, then broadcasts or batches an on-chain transaction to the user's address.
The risk changes at that point: exchange custody/counterparty exposure falls, while the user assumes private-key, address and device responsibility.
Common mistakes and misunderstandings
- Believing every CEX spot trade moves coins on-chain.
- Assuming an account balance means the customer controls private keys.
- Equating cold storage with solvency.
- Assuming “segregated” means the same legal protection in every jurisdiction.
- Leaving operationally unnecessary balances on one venue without considering concentration risk.
Knowledge checkpoint
- What usually changes on-chain when two customers trade against each other on the same CEX?
- Why can excellent cold-storage controls coexist with customer insolvency risk?
- What risks move from the exchange to the user after a self-custody withdrawal?
- Why should “segregated assets” be checked against legal terms rather than assumed from the word alone?
FAQ
❓ Do I control the private keys on a CEX?
Normally no. The venue or custodian controls signing authority.
❓ Why use internal ledgers?
They enable fast trading without on-chain settlement for every fill.
❓ Is cold storage risk-free?
No. It reduces some cyber risk while retaining operational and governance dependencies.
❓ Does self-custody remove all risk?
No. It changes the risk owner rather than removing risk.
Summary
- CEX balances are internal claims/entitlements backed by custody arrangements.
- Trading and blockchain settlement are separate layers.
- Cybersecurity, solvency and legal segregation should be assessed independently.
- Withdrawing to self-custody shifts rather than eliminates operational risk.
This building block is educational and not a trade recommendation.
Want this in a personalised order?
Take the crypto assessment and get a custom path of 10 modules matched to what you already know. Free, no card required.
Build my path →