The U.S. Securities and Exchange Commission (SEC) has released a new investor bulletin, “Crypto Asset Custody Basics,” to inform investors about how cryptocurrencies are stored and accessed.
The bulletin, prepared by the SEC's Office of Investor Education and Assistance, addresses fundamental concepts and critical questions, particularly for individual investors, regarding how to safely hold their cryptocurrencies.
According to the SEC, crypto asset “custody” refers to how and where crypto assets are stored and how they are accessed. Investors typically access crypto assets through devices or software called “crypto wallets.” However, crypto wallets store not the assets themselves, but the private keys that provide access to those assets.
The bulletin defines crypto assets as assets created and transferred on blockchain or similar distributed ledger technologies, including tokens, digital assets, virtual currencies, and coins. The SEC notes that each crypto asset may have different characteristics, advantages, and risks.
When a crypto wallet is created, two primary keys are generated. The private key is a secret code that authorizes transactions and acts as a kind of password for the wallet. Losing this key can permanently result in loss of access to crypto assets. The public key, on the other hand, acts as an identifier, similar to an email address, allowing others to send crypto assets to the wallet. The SEC states that these two keys together prove ownership of the crypto assets.
The bulletin divides crypto wallets into two categories: “hot wallets,” which are connected to the internet, and “cold wallets,” which are not. While hot wallets offer ease of use, they can be more vulnerable to cyberattacks. Cold wallets, being offline, are considered more secure against cyber threats, but there is a risk of complete loss of crypto assets if they are physically lost, stolen, or damaged. The SEC also emphasizes that investors should store recovery phrases, known as seed phrases, with extreme care.
The SEC states that it is critical for investors to decide whether to keep their crypto assets under their own control or entrust them to a third party. In self-custody, the investor retains complete control but is also fully responsible for the security of the private keys. In third-party custody services, the keys to crypto assets are managed by exchanges or professional custodians. In this method, access to investors' assets is at risk if the organization is hacked, ceases operations, or goes bankrupt.
The bulletin states that when choosing a third-party custody service, investors should thoroughly research the institution's history, regulatory status, security measures, insurance terms, and fees. It also notes that some custodians may use client assets as collateral or hold assets belonging to different clients together, and investors are advised to demand clear and transparent information regarding these practices.
In its general security recommendations for protecting crypto assets, the SEC states that private keys and recovery phrases should never be shared, the amount of crypto assets should be kept confidential, caution should be exercised against phishing scams, and strong passwords and multi-factor authentication methods should be used.
The commission reminds investors that the crypto asset ecosystem is still in its developmental stage and that they should carefully consider the balance between security, cost, and responsibility when choosing custody methods.
*This is not investment advice.
