CustodyStress

Custody Product & Service Boundaries in Bitcoin Custody

What custody products and services actually cover — and where that coverage ends.

This reference is published by CustodyStress, an independent Bitcoin custody stress test that produces reference documents for individuals, families, and professionals.

A holder uses a hardware wallet and considers the Bitcoin secured. The device works as described. But the manufacturer's firmware update server is a dependency the holder didn't choose, the device's lifespan is shorter than the holder's time horizon, and the recovery process assumes a technical competence the holder's heirs do not have. The product protects what it claims to protect. It does not protect what the holder assumes it protects.

A managed custody service promises institutional-grade security. The service operates as described. But the service agreement includes terms that can change unilaterally, the provider's continuity is not guaranteed, and the fee structure creates a dependency the holder cannot exit without operational disruption. The service covers what its terms define. It does not cover what the holder's mental model expects.

Common questions that surface include:

– “What happens to my Bitcoin if the wallet company goes out of business?”

– “Is my exchange account actually protected the way I think it is?”

– “Can the custody service change its terms and affect my access?”

This reference traces the coverage boundaries of Bitcoin custody products and services — the points where a product's actual protection ends and the holder's unprotected exposure begins. It examines what products and services cover, what they imply but do not guarantee, and what happens when the holder's assumptions about coverage do not match the structural reality.

Includes (common boundary surfaces):

– Hardware wallet manufacturer discontinuation, firmware trust, and device obsolescence

– Managed and collaborative custody counterparty dependency and exit friction

– Exchange withdrawal policy, bankruptcy exposure, and estate settlement timing

– Unilateral service terms changes and provider discontinuation

– Dashboard interfaces, protection language, and insurance analogies that imply coverage that does not exist

Hardware Wallet Coverage Boundaries

Hardware wallets protect private keys from network-based attacks. They do not protect against manufacturer discontinuation, firmware trust dependencies, device obsolescence, or the gap between device operation and heir recovery capability. When a hardware wallet manufacturer ceases operations, the device may still function temporarily but firmware updates, replacement hardware, and recovery support become unavailable — creating a degradation timeline the user may not be aware of. A separate but related condition arises when a device physically fails: the holder's access depends on whether backups exist independently of the hardware, and whether those backups are compatible with available recovery tools.

Hardware has a lifespan shorter than most holders' time horizons. The patterns in technology decay and device obsolescence trace what happens when a device becomes unsupported before recovery is needed — connectors change, firmware is discontinued, companion software moves on. Below the visible interface, the device depends on firmware the holder physically possesses but cannot independently verify. The firmware handles key generation, transaction signing, and display of transaction details. The holder trusts it because they trust the manufacturer. That trust is a dependency that does not appear in any backup plan. On the software side, wallet applications that are deprecated or abandoned leave holders with tools that no longer receive updates, compatibility fixes, or security patches — and the holder may not learn this has happened until they attempt a recovery. Related operational conditions are documented in the Coordination & Dependency Surfaces category.

Managed & Collaborative Custody Coverage Boundaries

Managed and collaborative custody services transfer operational complexity to third parties. They introduce counterparty dependency, terms-of-service risk, and fee structures that create exit friction. The coverage limits of delegated custody arrangements differ from what the implied promise of full protection suggests — the provider manages keys, but the holder's access remains subject to the provider's operational continuity, legal obligations, and business decisions. Collaborative models that distribute keys across multiple parties reduce single-point-of-failure risk but introduce coordination dependencies that compound under stress, particularly during inheritance or incapacity.

Fee structures are not only a cost. The patterns in custody provider fee arrangements trace how ongoing fees create dependency signals — the holder who stops paying may lose access to the infrastructure their custody arrangement depends on. The relationship between custodial services and the assets they hold rests on an assumption that does not always survive examination: that the custodian's continuity implies the continuity of access. A custodian can promise availability. Bitcoin's protocol does not enforce that promise. The structural gap between what the custodian implies and what Bitcoin actually guarantees is the coverage boundary.

Exchange & ETF Coverage Boundaries

Exchange custody and Bitcoin ETFs provide familiar account-based interfaces. They introduce withdrawal policy risk, bankruptcy exposure, and estate settlement dependencies that differ from the access model users expect. Holding Bitcoin on an exchange means the holder's access is subject to the exchange's withdrawal policies, legal obligations, and operational timeline — none of which the holder controls and none of which appear in the interface. When an exchange shuts down or suspends operations, the timing of the shutdown relative to the holder's access needs determines whether the assets are recoverable at all.

ETFs eliminate operational custody complexity but substitute a different risk surface. The observations in comparing ETF custody risk to self-custody risk trace how the familiar brokerage account interface obscures the underlying custody chain — the ETF holds Bitcoin through a custodian, the custodian holds it through infrastructure the investor cannot inspect. The structural differences between custodial and non-custodial models are not always visible to the holder, but they determine how access, recovery, and survivability behave under stress.

Service Terms & Unilateral Change Risk

Every third-party custody service operates under terms that can change. Users who build custody arrangements around specific service features face a coverage boundary when those features are modified, repriced, or discontinued. When a service provider changes terms without the holder's input, the holder's custody arrangement may depend on features or pricing structures that no longer exist. The holder built around what the service offered. The service is not obligated to keep offering it.

The more severe version of this problem arises when a service provider discontinues operations entirely. The holder's custody arrangement does not degrade gradually — it loses a structural component. A related timing condition appears when service changes occur during a recovery or succession delay: the holder is incapacitated, deceased, or otherwise unable to respond, and the service they depend on modifies its terms, migrates its platform, or shuts down while no one with authority is available to act.

Interface Trust & Implied Protection

Custody product interfaces create impressions of safety that may not correspond to the underlying custody conditions. A dashboard that displays green icons and status indicators suggests safety that may not match what is actually happening underneath. The dashboard displays what is true right now. It does not display what the system depends on or what will happen when a dependency fails. Wallet interfaces are designed for simplicity, but the complexity they hide does not stop existing because it is not displayed — derivation paths, passphrase configurations, account structures, and specific technical settings that make the bitcoin accessible are obscured behind send/receive buttons and balance displays.

The broader pattern extends beyond interfaces. Some custody arrangements appear structurally sound but contain gaps that only surface under stress — the backup exists but cannot be used, the document is signed but does not grant the right authority, the device works but the recovery path depends on a service that no longer exists. The language used to describe custody often reinforces this gap. Terms like "protected," "secured," and "insured" imply the existence of a protector entity that does not exist in self-custody. Similarly, insurance analogies applied to self-custody arrangements create expectations of recovery and reimbursement that the structural properties of self-custody cannot fulfill. The comparative coverage boundaries between service-based and self-directed custody models determine which risks are transferred, which are retained, and which are created by the choice of model itself.

Index of Memos in This Category

The following memos document coverage boundaries, implied protections, vendor dependencies, and service terms across custody products and services. Each memo examines one surface where the product's actual coverage differs from what the holder expected. Some memo titles are phrased as questions for search discoverability; the documents remain descriptive.

← Return to CustodyStress

For anyone who holds Bitcoin — on an exchange, in a wallet, through a service, or in self-custody — and wants to know what happens to it if something happens to them.

Start Bitcoin Custody Stress Test

$179 · 12-month access · Unlimited assessments

A structured, scenario-based diagnostic that produces reference documents for your spouse, executor, or attorney — no accounts connected, no keys shared.

Sample what the assessment produces
Original text
Rate this translation
Your feedback will be used to help improve Google Translate