Self-Custody vs. Custodial Wallets: What Attorneys Need to Know

When attorneys first encounter cryptocurrency in a legal matter, one of the most practically significant questions is whether the assets are held with a financial institution or held independently by the individual. The answer determines what institutional records exist, what can be obtained through subpoena, and what investigative techniques are required to establish ownership and value.

The distinction is not subtle. It is the fundamental design choice in cryptocurrency: either a third party holds the cryptographic key material and the user interacts with the assets through that party's platform, or the user holds the key material directly and controls the assets without any intermediary. These two arrangements have radically different evidence profiles.

The Fundamental Distinction

Every cryptocurrency asset on a public blockchain is controlled by whoever possesses the private key associated with the address where the asset is held. The private key is the cryptographic credential that authorizes spending. Nothing else matters technically. Courts, legal titles, and oral agreements about who should have access to cryptocurrency are beside the point until someone has the key.

In a custodial arrangement, the user does not possess the private key. A third party, typically a cryptocurrency exchange or institutional custodian, holds the private key and provides the user with an account interface. The user can view their balance, initiate trades, and request withdrawals, but they are relying on the custodian to execute all of that on their behalf. The custodian actually controls the blockchain assets. From a legal process perspective, this arrangement resembles a bank account: there is an institution with records, regulatory obligations, and the ability to respond to subpoenas.

In a self-custody arrangement, the user holds the private key directly. There is no intermediary. The user controls the blockchain assets personally, using wallet software or hardware to manage the key material and sign transactions. From a legal process perspective, this arrangement has no institutional analog. There is no company to subpoena for records. The evidence must come from the blockchain itself, from the user's devices, and from whatever documentary evidence exists about the key material.

Types of Custodial Custody

Cryptocurrency exchanges are the most common custodial arrangement. Exchanges like Coinbase, Kraken, Gemini, and Binance allow users to buy, sell, and hold cryptocurrency in exchange-managed accounts. The exchange holds the private keys and maintains internal ledger entries representing each user's balance. The blockchain does not necessarily reflect each user's individual holding; many exchanges aggregate user funds in pooled wallets and maintain their own off-chain record of who holds what.

Cryptocurrency ETFs and investment products hold digital assets through institutional custodians on behalf of shareholders. A person who owns shares in a Bitcoin ETF has exposure to Bitcoin price movements but does not hold Bitcoin on the blockchain and has no private key. The relevant records are with the fund and the brokerage through which the shares are held, not on a blockchain.

Institutional custody services are used by high-net-worth individuals and institutional investors who want the security of a regulated custodian combined with the direct asset ownership that exchange accounts provide. These custodians maintain blockchain records but hold the keys and provide security infrastructure that individual users cannot easily replicate. They are subject to regulatory oversight and maintain records similar to other financial institutions.

For litigation purposes, all forms of custodial custody share the key characteristic: there is an identifiable institution that holds records and can be compelled through legal process to produce them. The discovery approach for custodial assets is the same as for conventional financial assets, with the additional technical consideration of identifying the specific exchange or custodian.

Types of Self-Custody

Software wallets are applications installed on a computer or mobile device that generate and store private key material on the device. The user interacts with the wallet through the application's interface, which reads the blockchain and signs transactions using the locally stored key. Popular software wallets include MetaMask (primarily for Ethereum-based assets), various Bitcoin wallet applications, and multi-asset wallets supporting many different blockchains. Software wallets store key material on the device, which creates the possibility of recovering that material through device forensics even if the application itself has been deleted.

Hardware wallets are dedicated physical devices designed specifically to store private key material in a secure chip that is isolated from internet-connected computers. When a user wants to sign a transaction, they connect the hardware wallet to a computer, review the transaction details on the hardware wallet's display, and physically confirm the transaction by pressing a button. The private key never leaves the device. Popular hardware wallets include devices made by Ledger and Trezor. A hardware wallet can hold essentially unlimited cryptocurrency value in a device the size of a USB drive.

Paper wallets are printed records of a private key or seed phrase. At the time of creation, the user generates the key material on a device and then prints or writes it down. If the paper is stored securely, the funds are accessible to anyone who finds it. Paper wallets are less common today but were a popular storage method in earlier years of cryptocurrency adoption.

Multisignature wallets (commonly called multisig) require authorization from multiple private keys to execute a transaction. A 2-of-3 multisig wallet, for example, requires any two of three specified private keys to sign before funds can be moved. This arrangement can be used for security, for shared control, or specifically to complicate attribution in litigation. Multisig wallets have important implications for ownership evidence, because no single key establishes control.

Identifying Which Type a Party Uses

The first investigative question in any matter involving cryptocurrency is determining what type of custody the party employed. Several sources of evidence are useful:

Financial records may show purchases from or transfers to cryptocurrency exchanges. Credit card or bank statements showing payments to known exchange platforms are strong indicators of custodial holdings.

Tax records may show cryptocurrency-related transactions reported by exchanges through Form 1099 or equivalent reporting, or capital gains reported on Schedule D that reference exchange-based transactions.

Device examination may reveal installed wallet applications, browser history showing exchange account access, locally stored wallet data, or seed phrase material saved in notes or password managers.

Communications including email, text messages, or messaging app records may reference specific wallets or exchanges, amounts, transactions, or recovery phrases.

Prior disclosures in other proceedings or in tax filings may identify specific exchange accounts or addresses.

Blockchain analysis of any known addresses can identify exchange interactions in the transaction history, pointing toward specific custodial platforms. See Can Blockchain Transactions Be Traced? for how this analysis works.

Discovery Strategies for Custodial Assets

For custodial assets, the discovery approach closely parallels conventional financial asset discovery:

Identify the specific exchanges through the sources above. Serve subpoenas directly to domestic exchanges seeking KYC records, transaction history, deposit and withdrawal addresses, linked payment methods, and access logs. See Subpoenaing Cryptocurrency Exchange Records for detailed guidance on structuring these requests.

Interrogatories should require the party to identify all exchange accounts, all associated wallet addresses, and the existence of any self-custody wallets in addition to exchange accounts.

Discovery Strategies for Self-Custody Assets

Self-custody assets require a different approach. There is no exchange to subpoena. The evidence must come from the blockchain, from the devices, and from documentary sources that establish the party's connection to specific addresses.

Device discovery is the most important single step for self-custody assets. A court can order a party to produce devices, including phones, computers, and hardware wallets, for forensic examination. The forensic examination may recover wallet applications, locally stored wallet data, seed phrases saved in notes or password managers, transaction records, and other evidence connecting the party to specific addresses. Request device production early; devices get replaced, reset, or tampered with.

Blockchain analysis begins from any confirmed wallet address and traces outward. If the party disclosed any exchange accounts, the withdrawal addresses from those accounts provide starting points for tracing funds that moved into self-custody wallets.

Seed phrase and key material discovery should be addressed explicitly in discovery requests. Interrogatories should ask whether the party has written down, stored, or memorized seed phrases or private keys. Requests for production should seek any document, photograph, or record containing seed phrase or private key material.

Signed message requests can be pursued through court order in some circumstances. A court can order a party to produce a cryptographic signed message from a disputed address, which proves control without requiring the party to disclose the private key itself.

The Proving Self-Custody Problem in Specific Contexts

In divorce proceedings, a party who holds cryptocurrency in self-custody and denies owning it faces a specific evidentiary problem: the absence of institutional records creates a defense of plausible deniability that requires more investigative work to overcome. The combination of blockchain tracing from known addresses, device forensics, and seed phrase evidence is typically the path to overcoming that defense.

In fraud cases, a defendant who received fraudulent proceeds into a self-custody wallet may argue that the wallet no longer holds the funds and that they cannot access the relevant addresses. Whether this argument is credible depends on the blockchain history of those addresses and any evidence of key material in the defendant's possession.

See Understanding Wallet Ownership Evidence for a comprehensive treatment of the evidence types used to establish wallet control in litigation.

Seed Phrase Evidence Specifically

The seed phrase deserves particular attention because it is both the most complete form of ownership evidence and the most portable. A party who has memorized their seed phrase carries the controlling credential in their head. A party who has written it on paper carries it in a format that can be found, photographed, or subpoenaed.

Finding a seed phrase in a party's possession, in any form, and connecting that seed phrase to a specific wallet address through cryptographic verification, is strong evidence of control. The connection is mathematical: given a seed phrase, the set of addresses that can be derived from it is deterministic. An analyst can verify that a specific seed phrase controls a specific address without spending any funds.

Courts have treated seed phrase evidence seriously. The challenge in cases where seed phrase evidence has not been found is establishing control through other means. The absence of recovered seed phrase evidence does not mean the party does not control the wallet; it means the investigation must rely more heavily on device forensics, exchange records, transaction patterns, and the party's prior conduct and statements.

ConsensusIntel's services cover both the technical analysis needed to establish wallet ownership and the preparation of expert testimony explaining custody structures and ownership evidence in terms that a court can evaluate. For matters where self-custody is suspected or at issue, contact us to discuss the specific evidence picture and the most productive investigative approach.

Frequently Asked Questions

Can a hardware wallet be forensically examined?

Hardware wallets are purpose-built security devices and are designed to be resistant to physical extraction of the key material. In most cases, the private key cannot be extracted from a hardware wallet through standard forensic methods. However, the device's transaction history and associated addresses may be recoverable, and the device's presence in a party's possession is itself evidence relevant to the ownership question. The most useful forensic work for hardware wallets typically focuses on the associated device (the computer the hardware wallet was connected to) rather than the hardware wallet itself.

What if a party says they lost their seed phrase and cannot access the wallet?

A claimed loss of seed phrase access is a factual question. The party's testimony about loss is not dispositive. Evidence inconsistent with the claim, such as on-chain activity from the wallet after the claimed loss date, device records showing wallet access, or communications referencing the wallet, can be offered to challenge the claim. Courts draw credibility inferences from the totality of the evidence, and a convenient inability to access a wallet at the time of disclosure warrants scrutiny.

Can multisig wallets be used to hide assets from a court?

A multisig wallet requires multiple keys to spend, and the arrangement can be structured so that the party holding one key argues they cannot access the funds unilaterally. While technically true that a multisig requires cooperation of keyholders, the legal question is whether the party's interest in the wallet is an asset subject to disclosure, which it typically is regardless of the access mechanics. Courts can order parties to disclose interests in multisig arrangements even if unilateral spending is not possible.

Are cryptocurrency assets held in an ETF or investment account self-custody?

No. Assets held through an ETF or investment product are custodial: the fund's custodian holds the actual cryptocurrency, and the investor holds a financial interest in the fund. From a litigation perspective, these are treated like any other investment account: the brokerage or fund can be subpoenaed for records, and the assets appear on conventional account statements.

How does self-custody affect the valuation of cryptocurrency in divorce?

Self-custody assets are valued based on the blockchain balance at the relevant date and the applicable cryptocurrency price at that time. The valuation method is the same as for custodially held assets; the difference is that obtaining the balance information requires blockchain analysis rather than requesting an account statement from an exchange.