The choice is usually presented as self-custody or exchange custody, and the actual range of arrangements is considerably wider.
Full self-custody
Keys held solely by the owner with no third party involved.
Which removes counterparty risk entirely and places all operational risk on the holder.
Loss, theft, death and error have no recourse, which is the trade being made.
Multisignature
Multiple keys required, with a threshold to authorise.
Which removes single points of failure for both loss and theft.
Keys can be distributed across devices, locations and people, and the configuration itself becomes the thing to get right.
Collaborative custody
A service holds one key in a multisignature arrangement.
Which provides recovery assistance without the service being able to move funds alone.
The user retains sufficient keys to act independently if the service disappears, which is the design intent.
Threshold signatures
Cryptographic splitting of a single key across parties so that no complete key ever exists.
Which produces an ordinary-looking transaction and is widely used by institutional custodians.
Implementation quality matters considerably here and is not visible from outside.
Qualified custodians
Regulated entities holding assets under specific legal obligations.
Which includes segregation, insurance and audit requirements depending on jurisdiction.
This is the arrangement institutional participants generally require and is a different proposition from an exchange account.
Exchange custody
Assets held by the trading venue, generally commingled.
Which means an account balance is a claim on the exchange rather than an asset held.
Failures have made this concrete repeatedly, and the resulting bankruptcy proceedings have taken years.
Proof of reserves
Cryptographic demonstration that a custodian holds claimed assets.
Which proves assets without proving the absence of liabilities.
Complete assurance requires both sides, and few implementations provide it.
Choosing
The appropriate arrangement depends on amount, on technical capability and on who needs access if something happens to you.
Inheritance planning is the consideration most consistently neglected and the one that eventually matters most.
Inheritance planning
Arrangements ensuring assets are accessible after death without exposing them beforehand.
Which ranges from sealed instructions to timelock mechanisms to legal arrangements with professionals.
The trade-off is between the risk of premature access and the risk of permanent loss, and there is no arrangement without one.
Organisational custody
Businesses holding assets need controls, segregation of duties and audit trails.
Which multisignature and threshold arrangements provide with defined signing policies.
Single-signer arrangements in an organisational context are a governance failure regardless of the individual's trustworthiness.
Insurance
Custodial insurance exists and generally covers specific loss types up to defined limits.
Which frequently excludes losses arising from the client's own credential compromise.
The scope of cover is what matters, and it is stated in policy documents rather than in marketing.
Operational security
The recurring failures involve people rather than cryptography — phishing, insider access and process failures.
Which is where attention and controls are best directed.
Deciding
Match the arrangement to the amount, the threat model and who else needs access.
Hot and cold separation
Keeping operational funds accessible and reserves offline.
Which is standard practice for custodians and applies equally to individuals.
The proportion held hot is a policy decision balancing convenience against exposure.
Address whitelisting
Restricting withdrawals to pre-approved destinations, with a delay on adding new ones.
Which substantially limits the damage from account compromise.
It is offered by most custodial services and enabled by relatively few users.
Authentication
Hardware security keys resist phishing in a way that code-based second factors do not.
Which matters because phishing is the dominant attack on custodial accounts.
Phone-based authentication is vulnerable to number porting attacks, which have been used repeatedly.
Bankruptcy treatment
Whether customer assets are property of the estate depends on the arrangement and the jurisdiction.
Which has determined outcomes in several proceedings, with customers of some arrangements recovering more than others.
Terms of service language about ownership is consequential and is rarely read.
The recurring lesson
Assets held by someone else are a claim on that party, whatever the interface displays.
Reviewing periodically
Arrangements that suited a smaller holding may not suit a larger one.
Which argues for revisiting the setup rather than leaving it indefinitely.
Testing recovery as part of that review is what converts a plan into something that will work.
Closing
The right arrangement depends on amount, capability and who else needs access, and there is no single correct answer.
Documentation
Written records of what exists, where keys are and how recovery works.
Which must be secured without being so secured that nobody can find it.
This is the practical problem that inheritance arrangements exist to solve, and most people never write anything down at all.
The arrangement that survives contact with real life is the one that gets maintained, which usually means the simplest one that meets the actual requirement rather than the most sophisticated available.