Archived article · Original source date: 2024-08-23
This article is preserved from the previous Solana Bulls site as a historical archive. It reflects its original context; references to products, people, market conditions, eligibility, or rules may no longer be current.
Editorial note: This article is educational and is not financial, investment, legal, or tax advice. Products, protocols, yields, fees, liquidity, regulations, and tax treatment can change; verify current primary sources and evaluate the specific risks before acting.
Custody is about authority, not interface design. If a provider controls the keys or can authorize asset movement on a customer's behalf, the arrangement is custodial; if the user alone controls the signing and recovery path, it is generally self-custodial.
Early hosted accounts
Centralized exchanges and hosted wallet services made SOL access easier by managing keys, deposits, withdrawals, passwords, recovery, and customer support. Users gained convenience but depended on the operator's solvency, security, policies, and continued account access.
Modern key-management systems
Custodians may use hardware security modules, multiparty computation, geographically separated approvals, cold and warm storage tiers, withdrawal policies, allowlists, and transaction monitoring. The exact architecture and failure modes vary; labels such as MPC or multisignature do not prove that control is decentralized or safe.
Institutional operations
Institutional customers may need segregated accounts, role-based approvals, audit logs, insurance disclosures, service-level commitments, legal agreements, reporting, and integrations with trading or treasury systems. A regulated or qualified-custodian status has a specific legal scope and should be verified in the relevant jurisdiction.
Solana-specific support
A Solana custodian must correctly support SOL, selected token programs and mints, address ownership, deposits, withdrawals, transaction parsing, network upgrades, and incident handling. Staking, Token-2022 extensions, NFTs, or program interactions require additional operational and policy support and should never be assumed from basic SOL custody.
Recovery and policy
Provider-managed recovery can help when a customer loses a password or device, but it also creates identity, social-engineering, insider, and account-freeze risks. Strong recovery requires deliberate verification, delay and notification rules, escalation paths, and auditable exceptions.
Do not misclassify self-custody tools
Phantom, Solflare, and Backpack are ordinarily self-custody wallets in which the user controls the signing and recovery path. Squads provides programmable smart-account and multisignature tooling. A self-custody interface, smart account, portfolio dashboard, or dApp integration is not a custodial service merely because it simplifies asset management.
What to evaluate
- Who can authorize a transfer and under what legal agreement?
- Are customer assets segregated, and how are liabilities disclosed?
- Which Solana assets, token features, staking actions, and withdrawals are supported?
- What are the key architecture, approval policy, recovery process, and insider controls?
- What audit, incident, insurance, availability, and withdrawal evidence is public?
- Which entity and jurisdiction govern the service, and what protections actually apply?