Bitcoin custody model faces governance gap in corporate adoption

Traders Union
All News
Crypto
Bitcoin custody corporate governance

Highlights

Coinbase scrutiny spotlights a governance gap in corporate bitcoin custody, as boards and auditors lack independent asset verification and visibility into custody controls.
Physical and digital security threats are rising, with over 60 bitcoin-related attacks recorded in 2024 and Coinbase incurring up to $400 million in losses from a data breach last year.
Major institutions like Morgan Stanley are shifting toward multisignature, multi-custodian models amid findings that accounting, auditability, and control complexity are key obstacles to wider corporate bitcoin adoption.

Custody controls emerge as core barrier

As argued by CoinDesk, the dispute triggered by accusations against Coinbase has exposed a broader governance weakness in how companies hold bitcoin, beyond the immediate question of whether the claims are true. The article says outside parties cannot independently verify the assets or the controls around them, leaving boards and auditors without the visibility they routinely expect in conventional financial accounts.

Michael Tanguma, chief executive of Onramp, argues that this gap is slowing adoption more than the asset itself. In the text, he contrasts corporate bitcoin holdings with bank and brokerage accounts, where named users, approval rules for withdrawals and audit trails are standard, while bitcoin custody often reduces control either to a single exchange login or to hardware wallets held by an individual.

The article points to longstanding examples of governance failure across the sector. It cites QuadrigaCX, where the chief executive's death in 2018 left roughly $190 million in customer assets inaccessible, and Prime Trust, which discovered in December 2021 that it could not open legacy wallets and still could not do so 18 months later when Nevada sought receivership. It also references Deloitte survey data showing accounting and controls complexity ranked among the main obstacles for chief financial officers considering bitcoin exposure.

Security risks and market implications widen

The governance problem is becoming more urgent as both physical and digital threats expand. The article says Jameson Lopp's public tracker records more than 360 known physical attacks since 2014, including 86 in 2025 and more than 60 so far this year, highlighting how bitcoin holders can become direct targets.

It also notes that Coinbase last year disclosed a data breach tied to bribed support staff, with names, addresses and balance information stolen and an estimated cost of up to $400 million. Combined with artificial intelligence-driven phishing, voice cloning and social engineering, these risks increase the exposure for companies relying on a single credential or a single institution to safeguard bearer assets.

Tanguma argues that the industry has tended to concentrate rather than disperse risk, whether through self-custody by one key holder or exchange custody with limited client visibility. He presents multisignature custody across independent regulated institutions as a more durable approach, saying it can provide legal ownership, named user roles, withdrawal approvals and auditable records while limiting any single party's ability to move or lose the assets.

The article adds that larger institutions are already moving in that direction, citing Morgan Stanley's proposed bitcoin ETF custody design with two custodians rather than one. Its central conclusion is that broader corporate adoption depends less on bitcoin's market profile than on whether custody arrangements can meet the governance, verification and continuity requirements that boards already demand from every other financial account.

Our earlier report on the Bank of England’s push for “bare metal” recovery planning explained why regulators want banks to build independent, end-to-end fallback systems that keep critical services running if core technology is compromised. We noted that AI is increasing the scale and complexity of cyber attacks, prompting supervisors to raise expectations for deeper resilience and recovery—not just perimeter defenses.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.