How to Choose Crypto Exchange Custody: Hot, Cold, and MPC Checklist
Users want withdrawals in seconds. Regulators want most client crypto in cold storage. Attackers almost always hit the online signing path, not the air-gapped vault. This institutional crypto custody setup checklist helps exchange operators set hot, warm, and cold targets, layer MPC with multisig or HSM, vet providers, and leave with a pre-launch go/no-go list.
TL;DR / Quick take: Keep hot wallets small (often ≤5–10%; treat >10% as high risk), use a warm buffer for refill, and park most reserves in cold storage (90%+; Hong Kong VATP targets 98% cold). Prefer MPC for high-tempo signing, add HSM or air-gapped cold for deep reserves, and do not go live without multi-party approvals, a recovery drill, and cert evidence.
This guide is for exchange founders and operators – not a retail wallet shopping list. On a white-label stack, treat custody as a configured module: who holds key shares, which tier holds client assets, and which policies gate withdrawals.
1. Map custody risk before you pick a vendor
Custody on an exchange is a tier problem: how much value sits online for speed versus offline for safety. Before demos, write four lists: asset classes you list, peak daily withdrawal demand, jurisdictions you will license in, and which balances are client assets versus corporate treasury.
Client assets need segregation (kept separate from your own books). Jurisdiction floors change the math: Hong Kong SFC VATP Terms push Platform Operators toward 98% of client virtual assets in cold storage; MAS-style Singapore guidance is often cited at 90% cold. Do this: lock those constraints on one page before vendor calls. Do not start with a product pitch and reverse-engineer risk later.
2. Hot vs warm vs cold: set your allocation targets
A hot wallet stays online so the exchange can sign withdrawals quickly – like a till at the front of a store. A cold vault stays offline or heavily gated – the back vault. A warm tier sits between them as a controlled bridge for batch settlement and refill.
Exchanges commonly keep roughly 1–10% hot and 90–99% colder; many aim for ≤5% hot with automated refill. A useful frame is hot 2–10%, warm 10–20%, cold 70–90%. An industry “Custody 3.0” pattern uses hot 5–10%, warm 15–25%, cold 70–80% – a design frame, not a law.
| Tier | Typical share | Job | Operator rule |
|---|---|---|---|
| Hot | ~1–10% (target ≤5–10%; >10% high risk) | Instant withdrawals | Minimize; automate refill with cooldowns |
| Warm | ~10–25% | Bridge / batch settlement | Policy-gated moves only |
| Cold | ~70–99% (HK VATP: 98% client VA) | Client reserves | Minimize outflows; document every transfer |
Workflow:
Map peak withdrawals → set hot ceiling → size warm buffer → put the rest cold → rebalance on a schedule.
Do this: publish internal tier percentages and a refill policy before soft launch. Do not casually park more than 10% hot because “liquidity feels safer.”
3. MPC, multisig, and HSM: pick and layer the control plane
MPC (multi-party computation) splits a private key into shares. Signing uses threshold math so the full key is never rebuilt in one place – like three people each holding part of a combination. Multisig needs multiple complete keys or on-chain M-of-N approvals: transparent, but slower and chain-dependent. An HSM (hardware security module) stores keys in tamper-resistant hardware; FIPS 140-3 is the 2026 buyer benchmark (FIPS 140-2 moves to NIST’s Historical List on 21 September 2026).
- Choose MPC for high-tempo exchange signing across chains.
- Keep multisig where you want visible on-chain governance.
- Put deep reserves behind HSM or air-gapped cold processes.
- Compose layers (MPC hot + HSM/multisig warm + cold) instead of one slogan.
- Require third-party cryptographic attestation of any MPC stack.
For an exchange profile, a practical start is MPC plus cold HSM. Do this: write which tier uses which crypto model. Do not treat “we use MPC” as a substitute for cold-storage floors and approval policy.
4. Build vs managed custody for a CEX
Many large exchanges hybridize: hot signing in-house for latency, majority cold with a third-party or qualified custodian for segregation, insurance, and audits. Wallet-as-a-Service (WaaS) means a vendor runs wallet infrastructure so you integrate via API instead of building every signer.
If you buy managed MPC / WaaS, require API-first integration, webhooks, bulk addresses, deposit monitoring, Travel Rule hooks where needed, reconciliation files, and an emergency freeze. Comparing build paths? See white-label vs build.
Do this: decide which path is latency-critical (often hot) versus audit-critical (often cold). Do not assume a white-label package is a finished vault without reading the custody module.
5. Provider due-diligence checklist
Shortlist providers against evidence, not rankings. Common 2026 comparison names include Fireblocks, BitGo, Coinbase Custody, Anchorage, Copper, Cobo, Liminal, and Ledger Enterprise – evaluate them; do not treat any list as a sponsored ranking.
| DD item | What to demand | Fail signal |
|---|---|---|
| Key tech | MPC and/or HSM – not software-only keys | “Keys live on an app server” |
| Certs | SOC 2 Type II and/or ISO 27001 evidence | Marketing claims only |
| MPC proof | Independent cryptographic attestation | No third-party review |
| Policy engine | Initiator ≠ approver; whitelists; velocity limits | Single-person signing |
| DR / recovery | Documented key reconstruction drill | Never tested restore |
| Insurance / PoR | Schedule + exclusions; Proof of Reserves path | Vague coverage; no reconciliation |
Hong Kong-style regimes also expect documented hot/cold transfers, minimized cold outflows, and clear insurance. Pair this with the crypto exchange compliance checklist. Do this: score every vendor on the table in writing. Do not accept SOC/ISO logos without dated reports.
6. Governance ops: refill, approvals, monitoring, recovery
Architecture fails in operations. Wire controls before volume grows:
- Document hot↔cold transfers with dual control and cooling periods.
- Automate refill from warm/cold with velocity limits and address allowlists.
- Separate duties: the initiator must not be the only approver.
- Monitor continuously with anomaly alerts and KYT screening on risky flows.
- Run a freeze playbook for suspected hot-path compromise.
- Test recovery and key rotation on a calendar.
Ops loop:
Withdrawal request → policy check → multi-party approve → sign (MPC/HSM) → monitor → reconcile → refill hot.
Breaches almost always hit the hot wallet or signing workflow – not broken cold cryptography. Do this: rehearse freeze and refill before public deposits. Do not approve cold moves over undocumented chat. Assembling a full stack? Explore White Label Exchange solutions and confirm wallet tiers and policy hooks – custody remains your go/no-go gate.
7. Pre-launch go/no-go checklist
- Hot share inside risk budget; local cold floor met (HK 98% cold / MAS-style 90%+).
- Warm buffer + refill automation with cooldowns; crypto model per tier chosen with MPC attestation plan.
- Build vs managed split documented; APIs, webhooks, bulk addresses verified in staging.
- Provider DD passed: certs, policy engine, DR drill, insurance, PoR/reconciliation.
- Initiator ≠ approver; allowlists; audit trail; freeze tested; client assets segregated; KYT where required.
No-go if hot share is undefined or above budget, approvals are single-person, recovery was never tested, certs or insurance are missing where required, PoR/reconciliation is absent, or the cold-storage floor is unmet.
What to do next
Write your risk map and tier percentages this week, pick the control-plane mix, run the DD table on two providers, and schedule a recovery drill. More playbooks: White Label Exchange blog. Ready to map custody into a launch stack? Talk to the White Label Exchange team.
Reviewed by: White Label Exchange Editorial.
Data integrity: Hot/warm/cold ranges and MPC/HSM notes from industry custody guides reviewed on 2026-07-17 (Liminal, Interexy, Dappfort, Blockchain Council). Hong Kong SFC VATP 98% cold floor from the SFC Terms PDF. Vendor marketing not treated as audited fact. Yandex Wordstat volumes were unavailable and are not asserted here.
Frequently asked questions
How much should a crypto exchange keep in hot wallets?
Keep the minimum for daily withdrawals – commonly ≤5–10% of reserves. Treat >10% as high risk. Under Hong Kong VATP rules, plan for about ≤2% hot / ≥98% cold of client virtual assets.
MPC vs multisig – which for a CEX?
For high-volume signing, start with MPC: no full key in one place, faster, usually chain-agnostic. Keep multisig for transparent on-chain governance. Many stacks use both across tiers.
Do we need a third-party custodian or can we self-host?
Many exchanges hybridize: self-manage hot signing for latency, outsource cold or qualified custody for segregation and audits. Choose by licensing, capital, and ops maturity.
What certifications should we require from an MPC provider?
Ask for SOC 2 Type II and ISO 27001 evidence, independent cryptographic attestation, a tested DR drill, and a clear insurance schedule with exclusions.
Does a white-label exchange stack include custody?
Treat custody as a configured module. Confirm hot/warm/cold wallets, who holds key shares, and whether policy, refill, and Proof of Reserves paths are included before go-live.
What kills most exchange custody designs in practice?
Over-sized hot wallets, single-person signing, undocumented cold transfers, and no recovery drill. Breaches usually hit the online signing path – rehearse freeze and refill first.