For anyone building a substantial position in digital assets, attention shifts quickly from the purchase to the safekeeping. Storing crypto is not a secondary matter but the core of the risk. Unlike a bank balance, there is no institution that administers the holding or reverses a transaction when something goes wrong. Whoever has access to the keys has, in practice, access to the wealth.
With modest amounts this remains manageable. As positions grow larger, however, the question of how to store crypto safely becomes decisive. One lost password, one successful breach or one human error can be irreversible. The considerations are set out below.
Whoever controls the keys controls the holding
Ownership of crypto comes down to control over the private keys. Those keys give access to the positions on the blockchain and form the only proof of control. A crypto wallet stores these keys, but the blockchain itself has no central register that records or restores ownership. If a key is lost or falls into the wrong hands, the position is as a rule permanently lost. Key management is therefore the real question of safekeeping.
Reachable online or protected offline
Storage solutions differ above all in their connection to the internet. With hot storage the keys reside on a device that is online, which enables fast transactions but increases exposure to attacks. With cold storage the keys are kept offline, for instance on hardware without a permanent internet connection. The essence of any explanation of cold storage is simple: less reachability means less attack surface. Convenience decreases, resilience increases. For that reason larger positions are usually held predominantly offline.
Self-custody or a qualified custodian
Broadly speaking there are two routes. With self-custody you keep the keys entirely under your own control, with maximum oversight but also the full operational burden. Loss, theft and mistakes are then entirely for your own account. The alternative is professional or institutional crypto custody, in which a specialised party manages the keys according to strict procedures. For larger positions that procedural soundness weighs heavily, because a single point of failure has major consequences here.
Since 30 December 2024, providers of crypto-asset services in the EU have been subject to the rules of the Regulation on markets in crypto-assets (Regulation (EU) 2023/1114, MiCA). An authorised provider that carries out custody and administration must, under Article 75, keep clients’ holdings segregated from its own, maintain a custody policy and keep a register of positions. It is moreover liable for the loss of the assets or the means of access that is attributable to it. In the Netherlands the AFM supervises these authorisations.
The Callisto Capital approach
At Callisto Capital, the safekeeping of digital assets is part of the design: no private hardware that goes missing and no recovery phrase kept at home. As a Dutch registered investment fund under the AIFMD-light regime, not subject to ongoing supervision by the AFM, we manage the portfolio according to fixed rules, with an emphasis on risk management, diversification and transparency. Participation is open from an investment of 100,000 euro.
This information is provided for general explanation only and does not constitute investment advice.
