As of February 13, 2026, the date used in its annual report, Strategy Inc held about 717,131 bitcoin with a fair market value of $49.3 billion. Its 8-K filed October 5, 2026 puts the count at 848,000 as of October 4. None of it sits in a bank vault in the usual sense. What the company actually controls is a set of private keys, strings of numbers that can move those coins with one signature. Lose the keys, or let the wrong person copy them, and the money is gone.
That is the custody problem in one sentence. A gold bar is hard to steal because it is heavy. A bitcoin private key weighs nothing and can be copied in seconds. So how do institutions holding billions sleep at night?
The answer, spelled out in their own SEC filings, is layers: offline keys, split control, regulated custodians, outside auditors, and contracts. Here is how each layer works, current as of October 7, 2026.
The Key Is the Asset
Every bitcoin is controlled by a private key (the basics are in Private Keys and Public Keys in Plain English). Whoever can sign with that key can send the coins, and a confirmed transfer cannot be reversed. The iShares Bitcoin Trust's 10-K puts it plainly in its risk factors: digital assets are bearer instruments, and loss or compromise of the associated private keys "could result in permanent loss of the asset."
Individuals solve this with a hardware wallet. Institutions face the same problem with three extra twists: the amounts are enormous, employees come and go, and regulators, auditors and shareholders all need proof the coins are safe.
Cold Storage, Explained by the Biggest ETF
BlackRock's spot bitcoin ETF describes its setup in detail. According to the iShares Bitcoin Trust's 10-K for 2025, its primary custodian is Coinbase Custody Trust Company, with Anchorage Digital Bank N.A. as an additional custodian. The custodian "keeps all of the private keys associated with the Trust's bitcoin held at the Bitcoin Custodian in the Vault Balance in cold storage."
The filing defines cold storage as keys "generated and stored in an offline manner," on computers or devices not connected to the internet "so that they are more resistant to being hacked." A smaller trading balance sits with a prime execution agent affiliated with the custodian to handle creations, redemptions and the sale of bitcoin to pay fees. The vault balance is held in segregated accounts, separate from the custodian's own assets and other customers'. The same idea at household scale is in Hot Wallets vs. Cold Wallets.
Analogy: Think of a bank safe deposit vault that needs two keys to open, one held by you and one by the bank. Now imagine the vault is underground in an undisclosed location, the keys are cut into pieces held by different people in different cities, and an outside inspector checks the procedures every year.
Multisig and MPC: No Single Point of Failure
Storing a key offline protects against hackers. It does not protect against an insider, or against one key holder losing a device. For that, custodians split control.
There are two main techniques. Multisignature (multisig) uses Bitcoin's own scripting so that a transaction needs signatures from several separate keys, for example 3 of 5. Multi-party computation (MPC) splits one key into mathematical "shards" held by different parties, who jointly produce a signature without ever reassembling the full key. The SEC's October 1, 2026 custody proposal (Release IA-7023) discusses both and would require advisers that self-custody to use joint authorization of transactions "by at least two persons." It also cites further safeguards such as whitelisting recipient addresses, time-delayed withdrawals, and spreading copies of key material across locations and people.
Who Counts as a Qualified Custodian
Investment advisers who hold client assets must generally use a "qualified custodian." Under the existing Advisers Act custody rule, that means banks or savings associations, registered broker-dealers, futures commission merchants, and certain foreign financial institutions.
Bitcoin raised a question: does a state-chartered trust company count as a "bank"? On September 30, 2025, SEC staff issued a no-action letter saying they would not object if advisers and funds treated qualifying state trust companies as banks for crypto custody, provided the adviser does annual due diligence, including reviewing audited financial statements and an internal control report such as a SOC 1 or SOC 2. Federally, the OCC confirmed in Interpretive Letter 1183 (March 7, 2025) that crypto-asset custody is permissible for national banks.
On October 1, 2026, the SEC went further and proposed rules that would write the state trust company path into the custody rule and allow adviser self-custody in limited cases. It is a proposal with a 60-day comment period, not a final rule.
Here is who holds the keys for two of the largest holders, from their latest annual reports:
| Holder | Custodians named in the 10-K | Storage disclosed |
|---|---|---|
| iShares Bitcoin Trust ETF | Coinbase Custody Trust Company; Anchorage Digital Bank N.A. (additional) | Vault balance keys in cold storage, segregated accounts |
| Strategy Inc | Anchorage Digital Bank N.A.; Coinbase Custody Trust Company; Fidelity Digital Assets, NA | Keys generally held in cold storage under custody agreements |
Trust, but Read the SOC Report
How does a company know its custodian is doing what it promised? Strategy's 10-K lists its ongoing monitoring: obtaining and reviewing annual Services Organization Controls (SOC) reports, exercising contractual rights to review internal controls "such as through on-site audits," and supplemental due diligence reviews. A SOC 1 report covers controls relevant to financial reporting; a SOC 2 covers security and availability. Both are prepared by independent auditors.
Contracts and insurance form the top layer. Strategy says it negotiates provisions holding custodians responsible for failures to safekeep its bitcoin. The iShares 10-K notes that Coinbase Global maintains a commercial crime insurance policy, but that it is shared among all Coinbase customers and "may not be available or sufficient" to cover a loss.
The Accounting Rule That Kept Banks Out
From March 2022 until January 2025, SEC Staff Accounting Bulletin 121 told public companies that safeguard crypto for customers to record a liability on their own balance sheet, with a matching asset, at fair value. In effect, customers' coins showed up as the custodian's own obligation. Congress passed H.J.Res.109 in 2024 to overturn it; the measure was vetoed, and the House vote to override failed.
On January 23, 2025, the SEC issued SAB 122, rescinding SAB 121 effective January 30, 2025. Custodians now assess whether to recognize a liability for the risk of loss using the ordinary contingency rules (ASC 450-20 under US GAAP). The holder side of the accounting is covered in Bitcoin Treasury Accounting, Explained Simply.
What This Means for You
- Read the custody section. Every bitcoin ETF and treasury company names its custodians in its 10-K. Search the filing for "custodian" and "cold storage."
- Look for split control. Multisig or MPC with two-person approval removes the single point of failure that sinks most thefts.
- Ask about audits, not slogans. A SOC 1 or SOC 2 report from an independent auditor is evidence; a marketing page is not.
- Remember insurance is shared. Custodian crime policies cover all clients together and may not cover a large loss in full.
- Apply the same logic at home. If you self-custody, a hardware wallet plus a tested backup follows the same offline-first principle.
Billions in bitcoin come down to who can sign, and how many people it takes.